About Me#
Hello, my name is Ian Simons, and I am currently a Security Analyst with experience in security operations, detection engineering, and incident response. My professional interests span the full spectrum of cybersecurity, from security operations and threat detection to adversary emulation and security research.
In my current position, I serve as the primary administrator for our XDR software across 875 endpoints, where I am responsible for endpoint monitoring, alert triage, incident response, and security operations. I investigate and remediate security alerts, develop custom detections, and build SOAR playbooks to improve response efficiency and consistency. My role also includes identifying and remediating security weaknesses, hardening systems, and supporting firewall and network operations. My resume can be downloaded here
My technical background includes Linux and Windows administration, networking, scripting and programming, cloud technologies, and security operations. Through both my professional experience and personal projects, I have developed a strong interest in understanding how attackers identify and exploit weaknesses in systems and networks, and how organizations defend against these threats. This combination of defensive expertise and offensive-minded research has given me a well-rounded perspective on cybersecurity and reinforced my interest in helping organizations improve their overall security posture through both proactive and reactive security practices.
I currently hold the CompTIA Cybersecurity Analyst+ (CySA+), CompTIA Security+, Cisco Certified Network Associate (CCNA), and Microsoft Azure Fundamentals (AZ-900) certifications. Beyond certifications, I believe hands-on experience is one of the most effective ways to develop technical skills. As a result, I spend much of my free time working through Hack The Box machines, researching attack techniques, developing scripts and tools, and documenting my methodology, findings, and lessons learned.
This website serves as a record of that journey. Here you will find write-ups, technical projects, and notes from the labs and challenges I have completed. My goal is not only to demonstrate my growth as a security professional, but also to share practical knowledge that others can learn from. Whether you are a fellow practitioner, recruiter, or hiring manager, I hope my work can provide insight into my technical skills, problem-solving approach, and commitment to continuous learning within the cybersecurity field.
Posts#
Difficulty: Medium
OS: Windows
Date Completed: 2026-10-26
Write-up Authored by: Ian Simons
Lab Created by: Ian Simons
Core Competencies:
Defense in Depth
Least Privilege
Active Directory Hardening
Group Policy Hardening
Overview Recently I created an Active Directory lab where I successfully went from a low privileged user to a Domain Admin using attacks such as Kerberoasting and Pass-the-Hash (previous lab can be found here). This week I thought it would be a good exercise to take that lab and harden it as best I can to prevent this attack from succeeding again. I really enjoyed it. There is something special about attacking and then defending your own machine which is hard to put into words.
...
Difficulty: Easy
OS: Windows
Date Completed: 2026-10-19
Write-up Authored by: Ian Simons
Lab Created by: Ian Simons
Core Competencies:
Active Directory Enumeration
LDAP Enumeration
Kerberos Authentication
Password Cracking
Pass the Hash
Overview Recently I completed a Hack the Box lab called Active. This Box was a lot of fun and showed me that Active Directory is not some overly complex inherently hardened system. After that I decided that I wanted to learn more about attacking Active Directory on my own. I set up this lab to better understand and learn to run the Pass-the-Hash attack. There was a lot of learning involved, but I came away with a solid lab, and a much better understanding of the technique.
...
Difficulty: Easy
OS: Windows
Date Completed: 2026-10-13
Write-up Authored by: Ian Simons
Challenge Created by: eks & mrb3n8132
Core Competencies:
Active Directory Enumeration
LDAP Enumeration
Kerberos Authentication
Password Cracking
Overview This machine was discovered completely by accident. I had originally planned to complete a different box but accidentally scanned the wrong IP. After spending longer than I would care to admit attacking a web server I was convinced was an Active Directory Domain Controller, I decided to do Active instead. I am really glad I did. It helped break down the perceived complexity I had associated with Active Directory Machines, and demonstrated that successful domain compromise often results from methodical enumeration and chaining of realistic misconfigurations rather than highly complex exploitation techniques.
...
Difficulty: Easy
OS: Linux
Date Completed: 2026-09-25
Write-up Authored by: Ian Simons
Challenge Created by: Arrexel
Core Competencies:
Web application enumeration
Post-exploitation Enumeration
Linux Privilege Escalation
Overview This Machine was completed as a complement to my training in the Hack The Box Academy Penetration Tester Job-Role Path. This box was chosen to further improve my manual enumeration and exploitation skills, and build confidence in my existing skill set. Note: Flags documented in Appendix B.
...
Difficulty: Easy
OS: Linux
Date Completed: 2026-09-19
Write-up Authored by: Ian Simons
Challenge Created by: InfoSecJack
Core Competencies:
Network Reconnaissance and Service Enumeration Web Application Enumeration Insecure Direct Object Reference (IDOR) Identification and Exploitation Packet Analysis Linux System Enumeration Linux Capability Abuse Overview This machine was completed as part of my training in the Hack The Box Academy Penetration Tester Job-Role Path. While not a required module, I selected this target to gain additional practice with manual exploitation. Note: Flags documented in Appendix B
...
Introduction Recently I made a python tool to automate my write-up templates, start filling out some simple sections (ie nmap output, open ports etc), and perform a few additional Web Enumeration tasks such as grabbing html comments and the robots.txt file if it exists. I built it because I wanted to learn basic nmap output parsing, and save time during my weekly write-ups.This tool should save me time creating a skeleton of the write-up. It should also prevent accidentally leaving old data in new write-ups, and standardize my formatting for every write-up.
...
Difficulty: Easy
OS: Linux
Date Completed: 2026-09-02
Write-up Authored by: Ian Simons
Challenge Created by: mrb3n8132
Core Competencies:
Network Enumeration with Nmap Manual Web Enumeration Web Enumeration with Gobuster Vulnerability Research Initial Access with Metasploit Privilege Enumeration Privilege Escalation Overview This Box was completed as part of the Hack the Box Academy Job Role Path “Penetration Tester” in the “Getting Started” Module. The purpose of completing this box is to build familiarity with the Hack the Box platform. While the Academy module walks the user through this Box, I opted to complete it on my own using my existing, albeit limited, skillset. Additionally, this was another opportunity to sharpen my Metasploit fundamentals. Note: Flags documented in Appendix B
...
Difficulty: Easy
OS: Windows
Date Completed: 2026-08-30
Write-up Authored by: Ian Simons
Challenge Created by: mrh4sh
Core Competencies:
Network Enumeration with Nmap Vulnerability Research Brute Forcing with Metasploit Exploitation with Metasploit Web Enumeration with gobuster Overview This box was recommended by the Hack the Box Academy Job Role Path “Penetration Tester” in the “Getting Started” Module. The purpose of completing this box is to build familiarity with Metasploit. As we will see, it did just that. Note: Flags documented in Appendix B
...
Difficulty: Easy
OS: Windows
Date Completed: 2026-08-27
Write-up Authored by: Ian Simons
Challenge Created by: ch4p
Core Competencies:
Network Enumeration with Nmap Vulnerability Research Initial Access with Metasploit Vulnerability Scanning with Metasploit Privilege Escalation with Metasploit Overview This Box was recommended by the Hack the Box Academy Job Role Path “Penetration Tester” in the “Getting Started” Module. The purpose of completing this box is to build familiarity with Metasploit. As we will see it did just that. Note: Flags documented in Appendix B
...