About
I'm a cyber security student and red teamer based in Windhoek, Namibia, currently reading for a Bachelor of Artificial Intelligence (Honours) at the Namibia University of Science and Technology (NUST), after a Bachelor's in Computer Science, Cyber Security at NUST and time studying Computer Security & Forensics at Kabarak University, Kenya.
My focus is offensive security: network penetration testing, OWASP Top 10 exploitation, and digital forensics, with Active Directory attack chains and CTF competitions (TryHackMe, jeopardy-style events) as where most of my hands-on practice happens. I also spend time on bug bounty programs and building small defensive infrastructure (IDS stacks, hardened mail servers) to understand both sides of the fight.
For my honours research, I'm developing and evaluating an end-to-end multilingual speech-to-speech translation system for low-resource Namibian languages, aimed at digitizing and preserving indigenous languages such as Oshindonga, Oshikwanyama, Otjiherero, Ju|'hoansi, Khoekhoegowab, Silozi, and Rukwangali — languages that remain almost entirely absent from modern speech technology despite being spoken daily across the country. The system chains fine-tuned Automatic Speech Recognition (Whisper, wav2vec 2.0), Neural Machine Translation (NLLB-200), and Text-to-Speech (Coqui TTS) models on a multilingual corpus collected from native speakers, evaluated with both automatic metrics (WER, BLEU, COMET, BLASER) and human judgement (Mean Opinion Score). The goal is digital inclusion: giving underrepresented Namibian language communities a way into speech-based digital services that, right now, only exist in English.
Writeups
CTF and lab-box breakdowns, written up properly instead of left in scrollback.
A solo jeopardy run across pwn, web, crypto, forensics, and reverse engineering: a ROT13-disguised format string, DNS exfil hidden in ICS chatter, a WebAssembly cipher inverted by hand, a SQLite trigger hiding XOR in OR/AND/SUB arithmetic, and a running theme of challenges trying to prompt-inject the solver directly.
A full Active Directory box that falls in six acts: guest LDAP bind, Kerberoast, password reuse, BloodHound, targeted Kerberoast, and a hardcoded credential that turns out to be Domain Admin.
Guest SMB session, RID cycling for the full user list, a username-as-password spray, Kerberoasting, a backup share full of raw machine-account NTLM hashes, and pass-the-hash to root.
A WordPress "Bricks" theme RCE (CVE-2024-25600) chained through wpscan enumeration into a reverse shell, plus a cryptic Bitcoin-address puzzle at the end.
A registration form vulnerable to stored XSS used to hijack a session and pivot to a reverse shell.
A brutal high-port nmap sweep (2500-4500) followed by service enumeration across a deliberately awkward port range.
A mounted-share and file-carving challenge ending in a graveyard-themed flag.
A pwn challenge solved with a scripted exploit that repeatedly "vanquishes souls" until the binary hands over the flag.
sqlmap against a vulnerable album.php parameter to dump the backend database.
An anonymous FTP foothold opening into further enumeration on a Hack The Box target.
Active Directory Certificate Services abuse: enumerating vulnerable templates with Certipy and requesting a certificate to escalate.
Credential discovery leading into further enumeration on a TryHackMe box.
A disabled firewall exposes services that should have stayed internal, including an Emercoin RPC interface.
Decrypting Havoc C2 traffic captured from a compromised host.
DFIR case tracing an SMTP-delivered PowerShell one-liner through a staged .NET payload, with a Python script to extract and decompile it.
Packet-capture analysis of an AD compromise: HTTP auth headers, an AS-REP roastable account, and hashcat cracking the recovered hash.
A disk-image investigation combining EXIF metadata, an encrypted archive, and a hidden flag buried in a document.
A UNION-based SQLite injection used to enumerate schema and dump a flagged-events table during the MWR December 2025 internship.
Client-side price tampering in a cart workflow lets an attacker check out below the real price, then stack a coupon on top.
Local file inclusion and path traversal findings from the MWR December 2025 internship.
Contact
Open to opportunities in penetration testing, red teaming, and security research.