About

I’m Lucian (0xLuk3), and I focus on offensive security, especially penetration testing and web application security. Alongside CTFs, I run a SOC home lab, so I practice both breaking systems and detecting attacks.

My bachelor’s thesis in cybersecurity explores critical infrastructure security: how False Data Injection attacks affect the IEC 61850 Sampled Values (SV) and GOOSE protocols in digital substations.

Before security, I spent five years as a virtual service advisor at Tesla, where I learned to explain complex technical problems clearly, troubleshoot, and perform log analysis. I hold a higher degree in networking and IT security.

Skills

Attack Lab Infrastructure
Building isolated, reproducible target environments with Docker, Kubernetes, VMware and Mininet.
Reporting & Technical Writing
Hands-on log analysis background from 5 years of remote diagnostics at Tesla.
Detection & Adversary Emulation
Mapping attacks to MITRE ATT&CK and checking what they leave behind in Splunk, and Wazuh in my home lab. Knowing the blue side helps me test detections and write findings that defenders can act on.
Offensive Scripting & Tooling
Python and Bash tools for automating recon, parsing scan output and building proof-of-concept exploits.
CTF
PicoCTF and TryHackMe. Write-ups are published here on the blog.
Bug Bounty & Vulnerability Research
Hunting web vulnerabilities on YesWeHack, Intigrity and following responsible disclosure. Mapping findings to CVEs and CVSS to judge real-world impact.
ICS/OT Security
Researching False Data Injection attacks on IEC 61850 Sampled Values (SV) and GOOSE in digital substations (SCADA), the focus of my bachelor’s thesis.
Active Directory Attacks
Kerberoasting, AS-REP roasting, BloodHound path analysis and lateral movement in lab environments.
Network & Infrastructure Pentesting
Recon, enumeration, exploitation and privilege escalation on Linux and Windows targets, using Nmap, Metasploit and manual techniques.
Web Application Pentesting
Testing for OWASP Top 10 flaws: broken access control, injection, auth and session weaknesses. Mostly in Burp Suite, with manual testing first and tools second.