Why Im Building This in Public

I go by kkt2w in competitions, Cybergirl876 on GitHub, and Missy pretty much everywhere else. This is the place where all three of those overlap.

I’ve spent the last 3 years in Desktop support and IT Technical support roles, and it taught me something useful: I like breaking things a lot more than I like watching a dashboard for someone else to break them. Every time I’ve built an attack chain for a lab and then flipped over to figure out how to detect it, the part that actually got me leaning forward was the attack half. This blog is me leaning into that, in public, instead of leaving it in a folder of private notes nobody sees.

So here’s what’s coming.

The core of it is a lab series called “Attack, Detect, Document.” I run a full attack chain in my homelab which includes Kali, Metasploit, and a Windows target. Then work out what it looks like from the defender’s side, and write up both. The offense is the point; the detection write-up is there because knowing exactly what you’re being hunted for makes you better at the first half, I like to know what’s on both side of the fence, instead of assuming the grass is greener. First one up is Mimikatz credential dumping. Six of these are planned, and they’re the flagship of this whole project.

Alongside that, I’m doing authorized recon as apart of WiCyS’s live Vulnerability Disclosure Program. Real scope, real rules of engagement, real MITRE ATT&CK mapping, reconnaissance against an actual live target, not a CTF sandbox. This is the closest thing I have right now to real offensive work, and I’ll post on it when there’s a finding worth writing up, not on a schedule.

The homelab itself gets its own build-log thread I got two dead OptiPlexes turned into an actual two-node setup, so I have somewhere to run all of this that isn’t a single VM I’m terrified of breaking.

I’m also working through PortSwigger Academy and PentesterLabs, with TCM Security’s PWPA and a first bug bounty submission on Intigriti planned once my capstone wraps.

The differentiator, and the one I’m most excited about, is my capstone: framing an AI-assisted attack scenario against OT/water infrastructure. That gets its own deep-dive posts, once it’s been completed and submitted. This is the highlight of my educational journey at WGU, so I think it deserves it’s own room.

I am very new to this, I don’t have a fixed schedule. New post every two to three weeks, tied to an actual checkpoint such as a finished lab, a passed exam, or a recon milestone.

I’m also the Founding President of the WGU’s Girls Who Code College Loop; that side of things will show up here too, just not on any fixed schedule, maybe a one time posts if anything exciting happened in the loop.

If you’re reading this because you’re hiring for entry level offensive security or red team work; thank you for joining me on my journey into Offensive Security.

If you found this some other way - welcome. More soon :)