Kitsana Thuekoh vetementsvmnts

██╗  ██╗██╗████████╗███████╗ █████╗ ███╗   ██╗ █████╗
██║ ██╔╝██║╚══██╔══╝██╔════╝██╔══██╗████╗  ██║██╔══██╗
█████╔╝ ██║   ██║   ███████╗███████║██╔██╗ ██║███████║
██╔═██╗ ██║   ██║   ╚════██║██╔══██║██║╚██╗██║██╔══██║
██║  ██╗██║   ██║   ███████║██║  ██║██║ ╚████║██║  ██║
╚═╝  ╚═╝╚═╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝

Kitsana Thuekoh

`whoami`

Offensive security professional with a recognized Vulnerability Disclosure to NASA . Proven ability to execute full attack chains from initial access to domain compromise, identifying business-logic and authorization flaws that automated tools miss. I am seeking a penetration testing role where I can leverage my deep technical expertise to directly strengthen an organization's security posture.

◈ Technical Arsenal

Offensive Frameworks

Active Directory

Mobile & Reverse Engineering

Network & Analysis

SIEM & Detection

Development

◈ Key Impact

300+
TryHackMe Machines Rooted
_{Kerberoasting · AS-REP Roasting
Pass-the-Hash · Golden Ticket}

6,000+
Telemetry Events Processed
_{7 Critical · 71 High findings
Zero third-party dependencies}

30%
Attack Surface Reduction
_{Network segmentation · Firewall
hardening · CVE remediation}

40%
Assessment Time Reduced
_{Python recon automation
standardized data collection}

◈ Technical Projects

NASA Vulnerability Disclosure Program — Letter of Recognition

Identified critical vulnerabilities in production public-facing NASA systems through authorized testing
Developed and submitted proof-of-concept exploits with detailed remediation guidance
All findings accepted and patched by the NASA security team
Demonstrated disciplined operation within legal scope boundaries and responsible disclosure timelines

Threat Hunting Automation Framework (PowerShell)

Architected an agentless, zero-dependency PowerShell framework ingesting native Windows telemetry — Event Logs, Sysmon, Defender, Registry, WMI, Scheduled Tasks — across 6 modular risk-classification engines.

FINDINGS  →  7 Critical  |  71 High-risk  (from 6,000+ telemetry events)

DETECTED  →  PowerShell execution policy bypass
             COM object abuse (MITRE T1546.015)
             Local group enumeration reconnaissance
             Registry-based persistence mechanisms

OUTPUT    →  Dark-themed HTML dashboard
             Sortable risk-prioritized tables
             Modular CSV exports for SIEM ingestion / SOC handoff

Mobile Application Reverse Engineering — InsecureBankv2

Full-cycle security assessment of a deliberately vulnerable Android application, mapped to OWASP MASVS, MITRE ATT&CK Mobile, and scored with CVSS 3.1.

STATIC     →  JADX-GUI / apktool decompilation, manifest & permission audit
DYNAMIC    →  Frida & Objection instrumentation, runtime hooking, SSL pinning bypass
NETWORK    →  Burp Suite MITM proxy, Wireshark capture, cleartext HTTP transmission analysis
EXPLOIT    →  Hardcoded crypto keys, insecure local storage, exported component abuse

Web Application Security Portfolio (12+ CVSS-scored Reports)

Methodology-driven assessments against Juice Shop, DVWA, and PortSwigger Web Security Academy, aligned with OWASP Testing Guide v4.2.

Vector	Technique
SQL Injection	Union-based → Blind Boolean → Time-based inference; bypassed input validation without error feedback
XSS	Chained Stored XSS with session hijacking → full account takeover; DOM-based XSS in client-side sinks
Auth Bypass	JWT algorithm confusion (none/HS256), weak secret brute-forcing
IDOR	Unauthorized record access via object reference manipulation
SSRF / CSRF	Internal network probing; authenticated action execution without user consent

Vulnerability Assessment — CVE-2010-4221 (CVSS 10.0)

Authorized penetration test against Ubuntu 16.04.3 LTS identifying ProFTPD 1.3.3c backdoor — a decade-old unpatched vulnerability exposing unauthenticated remote root access.

RECON      →  Nmap service/version enumeration identified ProFTPD 1.3.3c on non-standard port
RESEARCH   →  Correlated version fingerprint to CVE-2010-4221; validated backdoor presence
EXPLOIT    →  Weaponized Metasploit module → unauthenticated root-level RCE
POST-EXPL  →  /etc/shadow extraction · process enumeration · lateral movement analysis

◈ Blue Team & Detection Engineering

While my primary lane is offensive, I build and operate the defensive side too — SIEM engineering, detection logic, and telemetry-driven threat hunting that closes the loop on what red team work uncovers.

SIEM         →  Splunk Enterprise + Sysmon lab: log onboarding, index design,
                 SPL query development, MITRE ATT&CK-mapped detections
DETECTION    →  Threat Hunting Automation Framework (PowerShell) — agentless
                 collection across Event Logs, Sysmon, Defender, Registry,
                 WMI, Scheduled Tasks; 6 modular risk-classification engines
REPORTING    →  Executive and SOC-analyst report formats, Sigma-style
                 detection logic, CSV exports for downstream SIEM ingestion

Windows SIEM Lab — Splunk + Sysmon

Built a Windows-focused SIEM lab on Splunk Enterprise with Sysmon as the primary telemetry source, developing SPL queries and detections mapped to MITRE ATT&CK, delivered across multiple executive and technical report formats.

◈ Reverse Engineering

Reverse engineering runs through both my mobile assessment and malware/telemetry-analysis work — decompiling, instrumenting, and tracing behavior down to the binary and API-call level rather than relying on automated scanners alone.

MOBILE (Android)  →  JADX-GUI / apktool static decompilation
                      Frida & Objection dynamic instrumentation and hooking
                      SSL pinning bypass, hardcoded secret and crypto-key recovery
                      Exported component and IPC abuse analysis
WINDOWS           →  Native telemetry reverse analysis (Event Logs, Sysmon, WMI,
                      Registry) to reconstruct attacker technique from raw
                      artifacts — COM hijacking, persistence, execution-policy bypass

◈ MITRE ATT&CK Coverage

RECONNAISSANCE     T1595  Active Scanning · T1589 Credential gathering
INITIAL ACCESS     T1190  Exploit Public-Facing Application · T1566 Phishing simulation
EXECUTION          T1059  PowerShell · Bash · T1203 Exploitation for Client Execution
PERSISTENCE        T1546  COM Hijacking (T1546.015) · T1053 Scheduled Tasks · T1547 Registry Run Keys
PRIVILEGE ESCAL.   T1548  SUID/SGID Abuse · T1055 Process Injection · T1134 Token Manipulation
CREDENTIAL ACCESS  T1003  OS Credential Dumping · T1558 Kerberoasting · T1110 Brute Force
LATERAL MOVEMENT   T1550  Pass-the-Hash · T1021 Remote Services · T1563 Remote Session Hijacking
IMPACT             T1485  Data Destruction · T1490 Inhibit System Recovery

◈ Lab & Continuous Development

$ cat /ops/current_focus.log

[ACTIVE]  Active Directory attack path deepening
          └─ Kerberoasting, AS-REP Roasting, Golden/Silver Ticket, DCSync

[ACTIVE]  PortSwigger Web Security Academy
          └─ 50+ labs completed: SQLi, XSS, CSRF, SSRF, JWT, API security

[ACTIVE]  VulnHub / HackTheBox
          └─ 20+ machines rooted across Windows & Linux environments

[ACTIVE]  TryHackMe
          └─ Junior Penetration Tester & Red Teaming paths completed

[BUILDING] Reverse-Engineering-In-Mobile-Application (InsecureBankv2 assessment)
[BUILDING] Lab rebuild automation scripts (clean pentesting environments)
[BUILDING] Secure-by-default SaaS architecture research

◈ Contribution Activity

◈ Let's Connect


	`kitsanathuekoh@gmail.com`
	linkedin.com/in/kitsana-thuekoh
	github.com/vetementsvmnts
	Johannesburg, South Africa — Open to Remote

Penetration Tester · Offensive Security Researcher · NASA VDP Recognized

Navigation Menu