Exhibit L · 04 Sept 2026
FiledSQL Injection
PortSwigger Web Security Academy notes on detecting and exploiting SQL injection, from UNION attacks to blind and out-of-band techniques
Personnel file / Offensive securityClassification: Public
Subject
m0rgxn
Top 5 · HTB Tunisia
Junior penetration tester breaking Active Directory, web apps, and Azure for a living
↑ Hover the bars to declassify↑ Tap the bars to declassify
I'm Marouan, an engineering student @ ENIT specializing in offensive security. Currently ranked Top 5 nationally on HackTheBox, I enjoy tearing apart complex systems and turning what I find into practical offensive tooling.
- Role
- Junior Penetration Tester
- Base
- Tunis
- Languages
- English / French / Arabic
- Status
- Active
08GarfieldHTB Garfield walkthrough covering scriptPath logon-script abuse, ForceChangePassword, RBCD, and RODC credential-caching to Domain Admin.07HerculesHTB Hercules walkthrough covering advanced web exploitation, ADCS abuse, DACL, Kerberos RBCD, and shadow credentials.06VulnNetTryHackMe VulnNet Active Directory room walkthrough with enumeration and privilege escalation.05OverwatchHTB Overwatch walkthrough covering ADIDNS spoofing, MSSQL linked servers, and WCF command injection.04Puppet ProLabHTB Puppet ProLab walkthrough covering Sliver C2, PrintNightmare, and Puppet manifest injection.
Exhibit K · 18 Aug 2026 · Azure Security
FiledModeling Managed-Identity Privilege Escalation as an Attack Graph
A framework for treating Azure managed-identity abuse in hybrid Entra ID environments as a graph-reachability problem. I define the node and edge types, ground each edge in Azure RBAC semantics, show how my tool Fenrir uses the model to answer one question conservatively, and work through a case study in my own lab. Framework and systematization, not an empirical study.
Exhibit J · 15 Aug 2026 · Azure Security
FiledBuilding Fenrir: Automating the Azure Managed Identity Attack Path
A walkthrough of Fenrir, a Python CLI I built during a red-team internship that automates the Azure identity attack chain: tenant recon, an exploit-readiness verdict, managed-identity token theft through compute hosts, and tenant-wide post-exploitation.
The rest is in the personnel file.
Continued