Nicholas Heitman

Penetration Tester

About

................☕️ Conquering the digital realm with one hotkey and one hot cup of coffee at a time. ☕️............... ...........................................💎Cyber really is a melting pot of knowledge and skill 💎.................................................... ..................................................................👇👇👇👇👇👇👇👇👇👇👇👇👇................................................................. 𝙏𝙚𝙘𝙝𝙣𝙞𝙘𝙖𝙡 𝙎𝙠𝙞𝙡𝙡𝙨: 💻 • Network traffic analysis, Network security, IDS and IPS, Wireshark, Snort, Firewall Configuration. • Vulnerability Scanning, Exploitation, Penetration testing, Nessus, Metasploit, Burp Suite, ...Hydra, John the Ripper OWASP, Nmap, • Cyber Threat Intelligence, Incident Response Playbook, OSINT, MITRE ATT&CK, • IAM, User Provisioning, Role-Based Access Control, Single Sign-On, Auth0, Microsoft Active Directory • Linux, CLI, PowerShell, SSH, GitHub, VirtualBox, Hyper-V • Python, Bash, Yara, CVE scripts • File analysis, Hex editors. 𝘾𝙏𝙁 𝘾𝙤𝙢𝙥𝙚𝙩𝙞𝙩𝙞𝙤𝙣: 🚩 • As a Scrum Master, led teams in creating Capture-The-Flag competitions featuring 4 game-like puzzles. • Developed simple HTML and JavaScript websites prone to exploitation. • Projects enabled linear progression from easy to advanced level. • Project Participants engaged in a spectrum of cybersecurity disciplines including Digital Forensics, File Analysis, Network Analysis, use of research in MITRE framework, Initial Access, Privilege Escalation, Passive Reconnaissance, and Web App Directory Traversal. • All tools that were used in the competition involved manipulating data to determine username and password credentials, interpreting bytes to detect anomalies, identifying web application vulnerabilities through source code inspection, using network traffic filters to find artifacts in PCAP files, uncovering the presence of steganography to extract files, inspecting metadata for clues, scanning networks for initial access, and the use of OSINT to locate relevant CVE scripts for specific discovered vulnerabilities in victim machines. • Engineering of one such CTF involved capturing network traffic with Wireshark and modifying bytes to import flags to incorporate the mandatory use of Wireshark filters to finish the competition. 𝙈𝙮 𝙈𝙤𝙩𝙩𝙤: 🤝 "You can only go as far as what you know exists,... therefore research, discovery, and exposure are crucial for your growth."

Country

United States

City

Nampa

Industry

Food Production

Skill

Cybersecurity, Identity and Access Management (IAM), Wireshark, Display Filters, Protocol Analysis, Initial Access, Directory Traversal, John the Ripper, Hydra, HTML, Apache, Secure Shell (SSH), Linux Kernel, Privilege Escalation, Software Development Security, Threat & Vulnerability Management, Cryptography, Disaster Recovery, Physical Security, Cloud Security

Experience

Penetration Tester

(CTF) Red Teaming

2024-7 - Present · 2 yrs 2 mos

...............................(Check it out)..........................🚩𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗖𝗧𝗙🚩............................(Check it out)................................... ...................................🔽🔽🔽..........................................................................................................🔽🔽🔽........................................ Here is the Link to the CTF: (Copy and Pate) 🔽 https://github.com/Nicholas-Heitman/Portfolio/blob/main/CTF%20Competitions/Root%20Flag/README.md 𝘼𝙗𝙤𝙪𝙩 - The engineering of this CTF involved designing an exploitable Linux VM vulnerable to "initial access" and "privilege escalation" through modifying the Kernel to an earlier Version and having an ill configured Apache server. - Comes included with an awesome story and theme to enhance the experience. - Participants are required to be resourceful in their ability to research and identify exploitable vulnerabilities in order to move forward through the CTF.

Network Analyst

(CTF) Network Engineer

2024 - Present · 2 yrs

...............................(Check it out)..........................🚩𝗪𝗶𝗿𝗲𝘀𝗵𝗮𝗿𝗸 𝗖𝗧𝗙 🚩............................(Check it out)................................... ...................................🔽🔽🔽..........................................................................................................🔽🔽🔽........................................ Here is the Link to the CTF: (Copy and Pate) 🔽 https://github.com/Nicholas-Heitman/Portfolio/tree/c02dd517e9c63f9e44e8a27c185f936f6b4e78ef/CTF%20Competitions/Hard%20Flag 𝘼𝙗𝙤𝙪𝙩 - The engineering of this CTF involved capturing network traffic with Wireshark and modifying bytes to import flags (or strings of text) to incorporate the mandatory use of Wireshark filters to finish the competition. - Comes included with an awesome story, theme, hints, and clues to enhance the experience. - Participants are required to use their problem solving skills to brainstorm and crack the puzzle.

CTF Competition

2015 - Present · 11 yrs

...............................(Check it out)..........................🚩𝐂𝐓𝐅 𝐂𝐨𝐦𝐩𝐞𝐭𝐢𝐭𝐢𝐨𝐧 🚩.......................(Check it out)............................. ...................................🔽🔽🔽......https://github.com/Nicholas-Heitman/Portfolio.......🔽🔽🔽................................ 𝙎𝙘𝙧𝙪𝙢 𝙈𝙖𝙨𝙩𝙚𝙧 𝙇𝙚𝙖𝙙𝙚𝙧𝙨𝙝𝙞𝙥: - Led teams in creating Capture-The-Flag competitions featuring 4 game-like puzzles. - Projects enabled linear progression from easy to advanced levels. 𝘾𝙮𝙗𝙚𝙧𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝘿𝙞𝙨𝙘𝙞𝙥𝙡𝙞𝙣𝙚𝙨: Project Participants engaged in a spectrum of cybersecurity disciplines, including: - Digital Forensics - File Analysis - Network Analysis - Use of research in MITRE framework - Initial Access - Privilege Escalation - Passive Reconnaissance - Web App Directory Traversal. 𝙏𝙤𝙤𝙡𝙨 𝙖𝙣𝙙 𝙏𝙚𝙘𝙝𝙣𝙞𝙦𝙪𝙚𝙨 𝙐𝙨𝙚𝙙: All tools used in the competition involved: - Manipulating data to determine username and password credentials - Interpreting bytes to detect anomalies - Identifying web application vulnerabilities through source code inspection - Using network traffic filters to find artifacts in PCAP files - Uncovering the presence of steganography to extract files - Inspecting metadata for clues - Scanning networks for initial access - Using OSINT to locate relevant CVE scripts for specific discovered vulnerabilities in victim machines 𝙀𝙣𝙜𝙞𝙣𝙚𝙚𝙧𝙞𝙣𝙜 𝙖𝙣𝙙 𝙏𝙚𝙘𝙝𝙣𝙞𝙘𝙖𝙡 𝘿𝙚𝙩𝙖𝙞𝙡𝙨: Engineering of one such Capture-The-Flag competition involved: - Developed simple HTML and JavaScript websites prone to exploitation. - Capturing network traffic with Wireshark - Modifying bytes to import flags - Incorporating mandatory use of Wireshark filters to finish the competition