Offensive Security Certified Professional+
OffSec · 2026
The flagship hands-on pentest cert — a 24-hour practical exam compromising real machines end-to-end, backed by a professional report.
verify credential┌─[ visitor@fletcher ]─[ ~ ]
└─$ whoami
fletcher
Cybersecurity Graduate Student · CTF player · offensive security
>
155
rooms completed
79
writeups
4
certifications
01.
profiles
/ live stats pulled from TryHackMe & Hack The Box 02.
writeups
/ latest 6 of 79 — type `cd writeups` or open the archive
Wallpaperhub
Proving Grounds
A Linux box running a Flask-based wallpaper-sharing app — testing a filename path-traversal LFI to read application source, credential recovery from leaked backend code, a sudo-permitted Node.js scraper binary, and a real-world script-injection vulnerability in the happy-dom library for the path to root.
BitForge
Proving Grounds
A Linux box exposing a leaked .git repository alongside a public-facing SOPlanning instance — testing git-history mining for plaintext database credentials, direct database manipulation to reset an application login, a real-world authenticated RCE, cron-exposed credential reuse, and a writable Flask app run with elevated sudo permissions for the path to root.
Mantis
Proving Grounds
A Linux box running MantisBT bug tracker — testing exploitation of a rogue-MySQL-server arbitrary file-read CVE to steal application database credentials, offline hash cracking for admin access, an authenticated configuration-based RCE technique, and cron-job credential exposure combined with unrestricted sudo for the path to root.
SPX
Proving Grounds
A Linux box running Tiny File Manager instrumented with the PHP-SPX profiler — testing discovery of a low-profile CVE via a leaked phpinfo page, a path-traversal read of application source to recover and crack login hashes, and a sudo-permitted make install target for the path to root.
Scrutiny
Proving Grounds
A Linux box running JetBrains TeamCity behind a marketing site — testing exploitation of a real-world authentication-bypass CVE to enable debug-mode command execution, mining git commit history for a removed SSH key, offline key/password cracking, a chain of leaked credentials across several users, and a GTFOBins sudo escape for the path to root.
Zipper
Proving Grounds
A Linux box running a file-zipping web app — testing a PHP filter-wrapper LFI to read source code, a `zip://` PHP-wrapper technique to execute an uploaded archive as code for a foothold, and a root-owned backup cron job whose password-protected archive leaks the root password for the path to root.
03.
projects
contextTutor
AI tutoring wrapper that learns from a SKILL.md and your lecture transcripts to tutor in your professor's style, citing the source material.
HTMLJavaScriptDockerfile
EzRotate
★ 3PowerShell tool that auto-rotates local Windows account passwords on a schedule for NIST 800-63B compliance.
PowerShell
My-CTF-Challenges
Capture-the-flag challenges I've authored — sources, configs, and solution notes.
CTFDocker
04.
certifications
eLearnSecurity Junior Penetration Tester
INE Security · 2025
Hands-on entry pentest cert — host/network enumeration, exploitation, and pivoting in a live lab exam.
verify credential
CompTIA Security+
CompTIA · 2025
Foundational security cert covering threats, cryptography, IAM, and risk — the industry baseline.
verify credential
AWS Certified Cloud Practitioner
Amazon Web Services · 2026
Cloud fundamentals — core AWS services, the shared-responsibility model, billing, and security basics.
verify credential 05.
activity
/ latest from LinkedIn [2026-09-22] After hundreds of hours of focused studying, 100+ OSCP-Like boxes rooted (with over 75 of the PG/HTB boxes writeups published on https://lnkd.in/ere9ZMmb), and one failed exam attempt, I am proud to finally say that I have passed the OSCP exam. I scored 80/100 points, fully compromising 5 of the… └─ read on linkedin [2026-05-10] AI has changed the way people study. But most students are only scratching the surface of what's possible.The common workflow: record a lecture, paste the topic into an AI, get a generic summary. It works. Until you realize the AI's version… └─ read on linkedin [2026-04-14] Another top 500 finish in the National Cyber League Spring 2026 Individual Game! 🏆Placed 299th out of 6,976 competitors this season and I'm proud of the progress. Scored 2,740 out of 3,000 points, up ~150 from my last competition, with 95.… └─ read on linkedin
06.
about & contact
Security enthusiast who goes by the handle fletcher.
Graduate cybersecurity student who spends entirely too much time on Hack The Box. I write up the machines I root, build tooling when a workflow gets repetitive, and chase the next certification. Mostly offensive security, with forensics and incident response close behind.