feras.me / 0xfk
// Offensive Security0xFK
0xFK is the handle I publish offensive security work under. It is the same person as the rest of this site — Feras Kanaan, CISSP, 29 years in enterprise and OT security — just the other terminal window. Everything here is lab work, public capture-the-flag platforms, and independent research.
- Handle
- 0xFK
- Real name
- Feras Kanaan
- YouTube
- @0xfk244 — 14 videos
- Medium
- 0xfk.medium.com
- Docs
- 0xfk.github.io/offensive-security
- Focus
- Active Directory attack paths, Windows privilege escalation, Linux enumeration
Why a security architect plays attacker
The honest answer is that defensive architecture built without recent attacker experience drifts steadily toward theory. You start reasoning about controls as they are documented rather than as they behave. Working machines hands-on is the cheapest available correction.
What it consistently reinforces is that real intrusions are chains of unremarkable misconfigurations, not single dramatic exploits. A readable share, a service account with a weak password, a token that was never scoped down. Each one individually would fail a risk assessment on the grounds of low severity. Chained, they are domain admin. That pattern is obvious from the attacker's seat and almost invisible from a control matrix — which is precisely why the exercise is worth the hours.
Published writeups
| Writeup | Platform | Topic |
|---|---|---|
| WhatsApp Zero DNA Policy | Research | Messaging platform privacy and data handling |
| Breaching Active Directory | TryHackMe | Initial AD access, credential harvesting |
| Lame | HackTheBox | Linux · legacy service exploitation |
| Explore | HackTheBox | Android · ADB exploitation |
| Bounty Hunter | HackTheBox | Linux · XXE to privilege escalation |
Video walkthroughs
BountyHunter — HackTheBox
Full walkthrough from enumeration through XXE injection to root, narrated end to end including the dead ends.
TryHackMe — Windows Privilege Escalation
Service misconfiguration, unquoted service paths, and token abuse on Windows targets.
Lame — HackTheBox
A classic beginner box, worked through for the methodology rather than the flag.
Offensive security training
Completed OffSec skill paths, most recently in November 2025:
- Enumeration — systematic target discovery and service mapping
- Windows Attacks — Windows-specific exploitation and post-exploitation
- MITRE ATT&CK: Lateral Movement — movement techniques mapped to the framework
- Antivirus Evasion — understanding detection boundaries from the defensive side
Alongside CVSSv3 certification from FIRST and Cisco Cyber Ops 210-250. The full credential list — 20 certifications spanning 1999 to 2025 — is on the main site.
Scope and ethics
Everything published under 0xFK is performed against deliberately vulnerable lab targets on public training platforms — HackTheBox, TryHackMe, and OffSec labs — or is independent research conducted responsibly. No content here describes work against systems I was not explicitly authorised to test.
This matters beyond the disclaimer. The value of a writeup is the methodology it demonstrates, and methodology transfers cleanly to authorised engagements. The specific box does not.
Frequently asked
Who is 0xFK?
0xFK is the offensive security handle of Feras Kanaan, a CISSP-certified digital and security architect based in Abu Dhabi with 29+ years in enterprise infrastructure and OT security. The handle covers HackTheBox and TryHackMe writeups on Medium and GitHub Pages, plus video walkthroughs on YouTube at @0xfk244.
Why does a CISO do capture the flag exercises?
Because defensive architecture built without recent attacker experience drifts toward theory. Hands-on work keeps the gap honest between what a control is supposed to stop and what it actually stops. It also reinforces that real intrusions chain several unremarkable misconfigurations rather than exploiting one dramatic vulnerability — a pattern much easier to see from the attacker's side.
What is the WhatsApp Zero DNA Policy?
Original security research published under the 0xFK handle on Medium, examining messaging platform privacy and data handling. It is independent research rather than a lab writeup, and sits apart from the capture-the-flag material.
Related
- OT & enterprise security architecture — the defensive practice this informs
- Private LLMs and AI agents in regulated industry
- Full career timeline and certifications