BIG$HA
Nehoray Shaul · Offensive Security Practitioner
PNPT & PJPT certified Offensive Security practitioner with an enterprise IT background. I investigate attack paths across Active Directory, cloud identity, and web applications — and document the evidence and reasoning behind each finding.
Featured CTF Writeups
31 published writeups across HackSmarter and EntraGoat.
Wordplay
SSH, Apache serving WordPress 6.9.4, and an exposed NFS share.
- Nmap
- NFS client (showmount, mount)
- Gobuster
- WPScan
- +5 more
Assume
Two custom roles stood out against the AWS-managed service-linked ones: cg-debug-role-lab and cg-lambdaManager-role-lab. Checked who's allowed to assume each.
- AWS CLI
- boto3 (Lambda function code)
Beanstalk
The app's own description says "insecure secrets scenario" — worth taking literally. elasticbeanstalk:Describe* was granted, so I kept going down that path instead of the dead-end IAM one.
- AWS CLI
Featured Project
PathForge
Private projectBuilt to address a practical challenge in penetration testing: keeping raw evidence, technical findings, and attack-path reasoning connected throughout an investigation. PathForge is an independent Linux desktop project under active development and is not publicly released.
Read more about PathForge →Technical Focus Areas
Active Directory Security
Authentication weaknesses, privilege escalation paths, ADCS, and full attack-path analysis across enterprise AD environments.
Microsoft Entra ID & Azure
Identity security, application permissions, administrative privilege models, and common misconfigurations in Microsoft cloud environments.
Web Application Security
Authentication/authorization flaws, input validation issues, XSS, SQL injection, and vulnerabilities across the OWASP Top 10.
Investigation Tooling
Building evidence-driven tooling (PathForge) to keep findings traceable from raw output to conclusion.
Certifications & Training
Details →Practical Network Penetration Tester
TCM Security
Practical Junior Penetration Tester
TCM Security
TDX Arena Penetration Tester
ThriveDX / TDX Arena
Certified Cyber & Security – Ethical Hacking
The Israeli Chamber of Information Technology (ICIT)
Cyber Security Ethical Hacking Program
HackerU / ThriveDX