lankySep 2026 — present
Cyber Security Specialist
Northrop Grumman Australia
Operational cyber security and GRC support for Defence-aligned sustainment, including risk, control validation, governance and technical advice.
$ whoami
@Lanky
Cyber Security Specialist. Bridging operational, defensive and offensive security.
Australia · Ex-military · Structured · Methodical · Mission focused
Cyber Security Specialist at Northrop Grumman Australia supporting Defence-aligned sustainment work across operational cyber security and GRC. My experience covers technical cyber advice, security design, vulnerability and STIG compliance management, continuous monitoring, security logging, DLP, audit and incident support. I hold the HTB Certified Penetration Testing Specialist (CPTS) and Certified Defensive Security Analyst (CDSA) certifications and use offensive training to understand adversary behaviour and strengthen defensive controls.
Professional experience
Cyber security delivery in Defence-aligned environments
My experience combines operational security, assurance, infrastructure support and practical offensive testing. Public summaries are deliberately sanitised; detailed role evidence, dates, qualifications and referee-supported examples are prepared for professional assessment.
Previous role
Cyber Security Analyst
BAE Systems Australia
Security design input, vulnerability and STIG compliance management, monitoring, DLP, audit support, incident support and security reporting.
Earlier experience
Systems administration and ICT support
Enterprise and military environments
Microsoft 365 messaging, infrastructure and operational support, backed by Australian Army service and a mission-focused approach to delivery.
▚ HACK THE BOX#AU
Lanky
◆ Master · Season 11 Ruby Tier
Master
HTB Rank
69
Level
18
Machines
#794
Overall HTB Rank
#2327
S11 Rank
430
S11 Pts
6/6
S11 User/System
#210
S12 Overall · 25 Oct
#3
S12 Australia · 25 Oct
◆ TRYHACKMEAU
LankyLuke
[0x8] Hacker · Top 15% globally
Top 15%
Rank
16
Rooms
4
Badges
Top Interests
ForensicsSecurity OperationsThreat Intelligence
HTB Skills
Group MembershipMisconfigurationAnalysis of Logs
Network SniffingEvent Log Analysis
Toolstack & Languages
SplunkMetasploitBurp SuiteNmap
PythonBashPowerShellStructured Text
Badges
Verified achievements across Credly, HTB Academy, TryHackMe and HTB Labs.
✓ Credly verified · syncing public badges
Public credentials issued and independently verifiable through Credly.
▚ HTB Academy · 53 badges
Path completion badges
The Vigilant Sentinel
SOC Analyst path completed
Stand above all
Local Privilege Escalation path completed
NEW
The protector of security
Penetration Tester path completed · CPTS course complete
Certification exam badges
HTB Certified Penetration Testing Specialist
CPTS certification obtained
HTB Certified Defensive Security Analyst
CDSA certification obtained
Offensive / Pentest modules · 30
Your first battle
Getting Started
The eye that sees all
Network Enum w/ Nmap
You need to trace before you can hunt
Footprinting
Information is not knowledge, or is it?
Info Gathering — Web
Light in the dark
Vulnerability Assessment
Airborne delivery
File Transfers
Ghost in the shell
Shells & Payloads
Dive into requests
Using Web Proxies
Fuzzing is power
Web Apps w/ ffuf
Crude but effective
Login Brute Forcing
Playing with the mess
JavaScript Deobfuscation
Scan and execute
Attacking Common Services
Grab the keys and move laterally
Password Attacks
Enumerate & Attack!
AD Enumeration & Attacks
Combine the modules
Metasploit Framework
Explore deep space
Pivoting & Tunneling
Tactical
Penetration Testing Process
Academician
Introduction to Academy
NEW
DROP your weapon
SQL Injection Fundamentals
NEW
JOIN the adventure
SQLMap Essentials
NEW
Included in every report
Cross-Site Scripting (XSS)
NEW
Every road leads back to root
File Inclusion
NEW
Prepare your payload and up you go
File Upload Attacks
NEW
Inject with caution
Command Injections
NEW
Arachnoid
Web Attacks
Defensive / SOC modules · 15
NEW
All systems activated
Attacking Enterprise Networks module completed
AD Security Captain
Windows Attacks & Defense
Panoptic
Incident Handling Process
Anticipate the next attack
Security Monitoring & SIEM
Predict the next move
Threat Hunting w/ Elastic
Log keeper
Windows Event Logs
SPL Witchcraft
Log Sources & Splunk
Packet carver
Working with IDS/IPS
Infection detected
Intro to Malware Analysis
Lurk in the packets
Network Traffic Analysis
The packet protector
Intermediate Traffic Analysis
APT slayer
Detecting Win Attacks w/ Splunk
Flare guardian
YARA & Sigma for SOC
Chronicle champion
Security Incident Reporting
Code blue
Intro to Digital Forensics
Milestones
Unwavering User
first weekly streak
Constant Champion
4 weekly streaks in a row
Cyber Rookie 365
1 year at HTB Academy
Binary Duo Explorer
2 years at HTB Academy
Additional Academy achievements · 5
Stairway to Heaven
HTB Academy achievement
Reach new (permission) heights
HTB Academy achievement
Attack from the outside
HTB Academy achievement
Time-consuming but important
HTB Academy achievement
Loyal Leader
HTB Academy milestone
◆ TryHackMe · 4 badges
Webbed
web fundamentals · common 23.5%
Metasploitable
Metasploit · rare 9.2%
Blue
EternalBlue · common 10.7%
Wireshark
packet analysis · rare 3.9%
▚ HTB Labs · 4 badges
Script Kiddie
Reached Script Kiddie rank
Hacker NEW
Reached Hacker rank
Is There Anybody Out There? NEW
Owned 5 machines
Just Another Brick in the Wall NEW
Owned 10 machines
Certifications
Completed credentials, active HTB pathways and planned certification goals. Progress was reviewed on 20 October 2026 and is updated manually from HTB Academy.
HTB CERTIFICATIONS IN PROGRESS
HACK THE BOX · CWES
Certified Web Exploitation Specialist
Web Penetration Tester path completed. Exam is pending and will be scheduled once a clear study week is available.
HACK THE BOX · COAE
Certified Offensive AI Expert
Currently working through the 12-module AI Red Teamer path while preparing a clear study window for the CWES exam.
HACK THE BOX · CDEP
Certified Detection Engineering Principal
Planned soon, focused on advanced detection engineering and low-level defender tradecraft. I have not purchased access yet and am awaiting work funding.
HACK THE BOX · CJCA
Certified Junior Cybersecurity Associate
Hybrid offensive and defensive foundations: vulnerability assessment, exploitation, SIEM monitoring, traffic and log analysis.
HACK THE BOX · CAPE
Certified Active Directory Pentesting Expert
Advanced Active Directory attack paths, Kerberos and NTLM abuse, ADCS, trusts, C2 and post-exploitation operations.
COMPLETED QUALIFICATIONS & CERTIFICATIONS
HACK THE BOX · CPTS
HTB Certified Penetration Testing Specialist
Penetration testing, web and Active Directory attack paths, privilege escalation, pivoting and professional reporting.
TAFE NSW
Certificate IV in Cyber Security
Certificate IV qualification covering practical cyber security operations and defensive fundamentals.
TAFE NSW
Certificate IV in Information Technology Networking
Certificate IV qualification in information technology networking.
CROWDSTRIKE
FALCON 202: Investigating and Querying Event Data With Falcon
Endpoint detection and response, event querying, threat hunting and incident analysis with Falcon.
HACK THE BOX · CDSA
HTB Certified Defensive Security Analyst
SOC operations, threat hunting, SIEM, DFIR, attack detection, malware analysis and incident reporting.
ADDITIONAL QUALIFICATIONS
Certificate IV in Government Security - PSP40316
CLET Training · Issued Dec 2016 · ID PSP40316
Certificate IV in Government - PSP40116
CLET Training · Issued Dec 2016 · ID PSP40116
Certificate IV in Security & Risk Management - CPP40707
CLET Training · Issued Dec 2016 · ID CPP40707
Certificate III in Business Administration - BSB30415
CLET Training · Issued Dec 2016 · ID BSB30415
Certificate II In Auslan (Australian Sign Language)
Deaf Connect · Issued Dec 2017
Microsoft MS-203T00 - Microsoft 365 Messaging
DDLS · Issued Mar 2023
Microsoft MS-700T00 - Managing Microsoft Teams
DDLS · Issued Apr 2023
WITHYOUWITHME TRAINING
Service Desk Analyst
WYWM Academy · Issued Nov 2021
Cyber Security Analyst
WYWM Academy · Issued Aug 2021
IT Fundamentals
WYWM Academy · Issued 2021
Linux Fundamentals October 2020 Edition
WYWM Academy · Issued 2021
Networking Fundamentals
WYWM Academy · Issued 2021
Formal qualifications and professional credentials cross-checked against LinkedIn Education ↗ and Licenses & Certifications ↗ on 20 October 2026.
Hacking Lab
18 Hack The Box machines and 16 TryHackMe rooms completed. Write-ups and video walkthroughs are linked on each lab where available.
▚ Hack The Box — Machines
Season 12 - Rank Overall #210 Aus #3 25 Oct 2026
DutyBound
Machine rank #251Boarding-pass audit SQL injection → PostgreSQL command execution → kiosk X11 pivot → root through the duty-rate importer.
Autopilot
Machine rank #520Grommunio Files SSRF → Redis mailer poisoning → Postfix root → IMAP NTLM relay to WS02 → embedded Domain Admin credential → DC01.
Stream
Machine rank #643Heap dump credentials → ClickHouse AIDX pipeline → XXE file disclosure → SSH foothold → Kopia log recovery → root DLQ formatter.
Touch
Machine rank #256Season 12, Week 2 · Easy Windows machine.
Layover
Machine rank #112Airport Wi-Fi capture → Craft CMS authenticated RCE → application-secret decryption → CUPS 2.4.16 root file overwrite.
Season 11 - Rank Overall #2327 Aus #39 Final
All 13 Season 11 releases are listed. Completed machines link to writeups where available.
Reactor
Machine rank #11520Next.js React Server Components RCE → root via an exposed Node.js inspector.
DevHub
Season 11, Week 2 · Medium Linux machine.
Connected
Machine rank #8168FreePBX CVE-2025-57819 → root via an incron / sysadmin signed-hook chain.
Checkpoint
Machine rank #4004AD chain: tombstone revival → VS Code extension supply-chain → patched-BadSuccessor dMSA → memory-image looting → domain admin via password reuse.
Nimbus
Season 11, Week 5 · Hard Linux machine.
Enigma
Season 11, Week 6 · Easy Linux machine.
MakeSense
Machine rank #3146Access-control gap in a custom app → file write into a root-owned path.
Paperwork
Machine rank #4399LPD command injection → PJL traversal → SSH key injection → root via a leaked privileged file descriptor.
Bedside
Machine rank #1024pdfminer pickle RCE → container pivot → root via a sudo-run PyTorch checkpoint.
DarkZeroReturns
Machine rank #799Handlebars AST type-confusion RCE (CVE-2026-33940) → Linux-to-AD pivot across two domains → Kerberos-principal-to-root → cross-domain pass-the-hash.
Cohort
Machine rank #406SSRF blocklist bypass → internal marimo pre-auth WebSocket RCE (CVE-2026-39987) → root via a held, vulnerable PackageKit package (CVE-2026-41651).
DanglingTree
Machine rank #793Five-identity AD chain: WAC RCE (CVE-2026-26119) → unauth SmarterMail reset → mailbox domain-swap → SAMR reset → a dangling ADCS template (ESC1) → Domain Admin.
BlockSynergy
Machine rank #835Forged blockchain reward → SSRF via 0.0.0.0 → command injection in the admin node pinger → smart-contract path traversal → restore-archive TOCTOU race → SUID root.
Retired / non-season machines
Support
Machine rank #12220Anon SMB → decompiled binary → LDAP → RBCD → SYSTEM.
CCTV
Machine rank #10401Default creds → creds in shell history → forged auth signature.
Nexus
Machine rank #169Retired · Linux.
◆ TryHackMe — Rooms
Documented · writeup + video
Relevant
SMB webshell → SeImpersonate → SYSTEM.
Jurassic Park
Manual union-based SQL injection.
Kenobi
ProFTPd mod_copy + NFS → SUID path hijack.
Blue
EternalBlue (MS17-010) → SYSTEM.
Also completed
Vulnversity
Easy · Web
Game Zone
Easy · SQLi
Steel Mountain
Easy · Windows
Alfred
Easy · Jenkins
OWASP Juice Shop
Easy · Web
Network Services
Easy · Networking
Network Services 2
Easy · Networking
Introductory Networking
Easy · Networking
What the Shell?
Easy · Shells
Wireshark 101
Easy · Traffic
Nessus
Easy · Vuln Scan
Sakura Room
Easy · OSINT
▶ Technique & Tutorial Videos
Non-lab-specific demos from my channel, Lanky's Networking.
Projects
Systems I have designed, built and run, from security tooling to infrastructure.
Message Minder
Android · message-to-calendar assistant
An Android app that turns actionable messages into calendar events and reminders. It recognises appointments, tasks, plans, changes and cancellations from SMS, email and supported notification previews, then applies conservative rules before asking for review or writing to a selected calendar.
The current documented candidate is installed on a Pixel 8. Its conversation-aware invitation flow, privacy controls, conflict checks and durable calendar retries are covered by 214 JVM tests, both lint variants and isolated device workflows. Public release and remaining live-provider tests are still in progress.
▸ Full detailsCyber Deck
deck.lankyonline.org ↗
A self-hosted threat-intelligence dashboard that tracks security events as they break. It aggregates new CVEs, data-breach reports, threat-actor activity and general infosec news alongside social feeds from Mastodon, Bluesky and Reddit into a single continuously updating board.
I built it to stay current with emerging threats and to feed that context into my defensive work: threat hunting, vulnerability management and detection engineering.
▸ Open Cyber Deck ↗ ▸ Full detailsSplunk and Tenable Vulnerability Dashboard
Self-hosted SIEM · vulnerability management
A Splunk Enterprise deployment that ingests Tenable vulnerability and hardening scan data and turns it into an operational security picture. The dashboard gives an OS-filtered drill-down, per-host compliance trends and high-risk finding tracking across a rolling twelve months.
It follows the same workflow as a production vulnerability-management programme: export findings from Tenable, index them in Splunk, then report on remediation progress and hardening posture.
▸ Full detailsFamily-Safe Internet Filtering
Pi-hole · WireGuard · Cloudflare for Families
Giving my child's device the same filtered internet at home and away. On the home network, a Pi-hole with a family-safe upstream resolver blocks ads, trackers, malware and adult content for every device. Off the network, an always-on WireGuard tunnel routes the device back home so it keeps the same protection on mobile data.
Step 1 is complete: a self-healing route home, combining a WireGuard server with an automated dynamic-DNS updater so the tunnel survives the ISP changing our public IP.
▸ Full detailsAutonomous Agent Operations Team
Self-hosted · LLM automation
A multi-agent system that monitors and self-heals my home lab around the clock. Eight specialist agents cover security, DNS, networking, containers, backups, updates, media and storage, each on its own schedule under a supervising manager agent, with a WhatsApp service desk for alerts and requests.
They run health checks, catch configuration drift, remediate common failures automatically and log every change. The structure mirrors a real L1 to L3 IT support model.
▸ Full detailsSelf-Hosted Home Lab
Ubuntu · Docker · 35+ containers
A self-hosted server running over 35 Docker containers across a dozen compose stacks on Ubuntu. It sits behind Nginx Proxy Manager for TLS, uses Cloudflare Tunnels so no inbound ports are open, provides WireGuard for remote access, and runs Pi-hole for network-wide DNS filtering.
This is where I get hands-on with Linux administration, containerisation, networking and defensive hardening: reverse proxies, segmentation, secrets handling, NAS backups and monitoring.
▸ Full detailsPrivate LLM Stack
Ollama · Open WebUI
A self-hosted AI stack running Ollama on a GPU with Open WebUI as the front end. No data leaves the network, which makes it a private environment for running models, testing prompts and providing inference to the automation behind my agent team.
▸ Full detailsHome Assistant Smart Home
Home Assistant · Matter · Zigbee
A locally controlled smart-home platform built on Home Assistant, bridging Matter, Zigbee and MQTT devices through a Mosquitto broker. Automations, dashboards and app control all stay on the network rather than depending on vendor clouds.
▸ Full detailsJellyfin Media Server
Jellyfin · Jellyseerr
A self-hosted media streaming platform built on Jellyfin. My own library is transcoded on the GPU and streamed to any device on the network, with Jellyseerr providing a request front end for the household. It replaces a commercial streaming subscription and runs entirely on my own hardware.
▸ Full detailsAustralian Homestead
australianhomestead.com ↗
A self-hosted WordPress site on a containerised stack: WordPress on PHP 8.3 behind an Nginx front end with a MariaDB backend. It is deployed with Docker Compose and published through the same reverse proxy and tunnel setup as the rest of the lab.
▸ Visit australianhomestead.com ↗ ▸ Full detailsThis Portfolio
lankylukeaus.github.io ↗
The site you are reading: a hand-built static portfolio with no dependencies or build step, hosted on GitHub Pages. It documents my Hack The Box and TryHackMe machines, HTB Academy progress, certifications and video walkthroughs.
⌥ GitHubAutomation & Scripts
43 scripts that run my home lab, covering security scanning, self-healing, an autonomous agent framework and general operations. Click a linked script name to read its sanitised source. These are the real running scripts, with secrets such as tokens, IDs and phone numbers replaced by placeholders.
When to use the scripts
Purpose: this section is the quick-training reference for people and AI agents: what each script is for, the best time to use it, who must approve it, and what verification follows. The live server catalogue is execution authority; a filename is never permission to run it.
Every morning
Review the latest system, admin, NAS and Docker status reports. Run a fresh approved health check when the report is stale, missing, or Luke asks for one.
When an issue is noticed
Start with the narrowest read-only health/status script for the affected service. Capture evidence under one ticket before considering a restart or repair.
Continuously (managed services only)
Alert monitors, Telegram routing, DDNS and ARR synchronisation run through their existing services/timers. Agents inspect their status and logs; they do not launch duplicate daemons or pollers.
Saturday night maintenance window
With Luke's approval: take the Docker configuration backup, run
run-tonight-updates.sh to sequence OS and container updates, then perform a fresh health check and review failures or reboot requirements.Weekly / monthly review
Review hardening, suspicious-login, storage-capacity, duplicate and media-quality reports. Broad AV/CVE scans should run in an approved low-impact window; cleanup remains a separate owner-approved action.
Incident or change only
Watchdogs, mount repair, device repair, notifications, OAuth setup, recycling, cleanup and update scripts are approval-gated. Internal router, handoff, sandbox and manager scripts are called only by their managed workflow.
Security & hardening 9
Blue-team automation: scanning, auditing and fail-safe controls.
Hardening audit that walks SSH config, sudo, firewall and kernel settings and prints a
[PASS]/[FAIL] per control.Runs Trivy against every running Docker image to surface known CVEs: report-only, against live vulnerability databases.
cyber-av-scan.shbash
Scoped ClamAV malware scans (quick / docker-config / nas-media / home) with single-instance locking.
cyber-watch.shbash
Reads the auth journal for SSH brute-force candidates and other suspicious activity, producing a windowed security report.
cyber-handoff.pypython
Packages the cyber agent's findings into a structured handoff for escalation.
cyber-notify.pypython
Delivers security alerts out to the notification channel.
Host admin snapshot: uptime, sessions and posture checks for a quick "is everything sane" read.
A sandbox wrapper that constrains which commands the autonomous agents are allowed to execute.
safe-recycle.pypython
Fail-safe deletion: moves files to a
@Recycle area with a JSON audit trail instead of ever hard-deleting.AI agent framework 6
The orchestration layer behind the agent ops team.
agent-manager.pypython
The L2 watchdog: performance review, gap analysis and job-description enforcement across the whole agent fleet.
request-router.pypython
Natural-language router that maps a chat phrase ("check jellyfin") to the correct approved action or script.
agent-ticket-router.pypython
Routes incoming tickets/requests to the agent that owns that domain.
agent-handoff.pypython
Structured handoff of work and context between agents.
l3-escalation.pypython
Encodes the issues only a human (L3) can decide, including the affected system, the reasoning and the proposed change.
docker-level2.pypython
The L2 Docker agent's logic. Use
status only for a full inventory; use problems when asked which containers are stopped/unhealthy and why. Restart remains approval-gated.Monitoring & self-healing 8
Detect → remediate → report, delivered to my phone.
healthcheck.shbash
Full server healthcheck (v2): services, mounts, containers, disk and GPU in one pass.
Detects stale NAS/CIFS mounts, stops affected containers, remounts, and only restarts once storage is readable again.
Watches for alert conditions and fires notifications when thresholds trip.
Runs a health check and delivers the result to WhatsApp.
Pushes a full health summary to the WhatsApp channel.
Sends only verified health results: guards against false-positive "all good" messages.
Rewrites raw technical output into a plain-English report a human actually wants to read.
Test harness for the WhatsApp health-agent pipeline.
Storage & NAS 7
Keeping a 21 TB NAS healthy and tidy.
NAS capacity check with threshold warnings.
Overall NAS health & availability report.
Finds and reports duplicate files across the NAS.
Removes duplicates safely (via
safe-recycle, never a hard delete).Clears junk / temp / leftover files to reclaim space.
nas-media-check.pypython
Audits the media library for integrity and metadata issues.
Generates a review of the media library for the media agent.
Media library 3
Quality checks for the Jellyfin library.
Flags media with missing or non-English audio/subtitle tracks.
arr-rss-sync.pypython
Managed ARR synchronisation job. Use through its scheduled service; inspect logs rather than launching a second run from chat.
arr-rejected-download-cleanup.pypython
Cleans rejected download records. Run only after Media Manager review and Luke's approval because it changes records.
Backups & updates 4
Reproducibility and staying patched.
docker-backup.shbash
Archives every stack's compose +
.env files to the NAS with retention: the "rebuild from scratch" safety net.update-all.shbash
Pulls and recreates Docker stacks. Use only in the approved Saturday-night window or an approved urgent patch.
update-os.shbash
Applies host OS updates. Use only in the approved Saturday-night window or for an approved urgent security patch.
Owner-approved Saturday-night runner that sequences OS and image updates; verify health and reboot requirements afterwards.
Notifications & bots 3
How the lab talks back to me.
telegram-bot.pypython
Unified Telegram channel for the agent team: a second control/notification surface alongside WhatsApp.
notify-admin.shbash
Central dispatcher for admin notifications.
google-oauth-setup.pypython
One-time Google OAuth setup granting Gmail + Calendar access for the assistant.
Infrastructure utilities 3
Small fixers that keep the plumbing working.
update_mounts.shbash
Ensures the media containers mount the shared storage path correctly after config changes.
Recovers Govee lighting by running a repair routine inside the Home Assistant container.
cloudflare-ddns.pypython
Managed DDNS updater. Use through its scheduled service when the public address changes; agents inspect status and logs rather than running it manually.
Presentations
Talks, demos and slide decks — explaining security work to both technical and non-technical audiences.
Talk
Research Findings — Cyber Security Cert IV
presentation · TAFE research project
Demo
Ethical Hacking (VU21989)
coursework · live demonstration
More on the way
More talks — conference, community and internal sessions — will be added here as slide decks and
recordings become available.