Zdeněk Ondra

Penetration tester, Brno

I break into systems for a living, to find out how someone else would. I work as a penetration tester at NÚKIB, the Czech national cyber security agency, and study Information Security at Brno University of Technology.

I enjoy internal networks and Active Directory most, where one ordinary account can often lead to the whole domain. After that, hardware and web applications. In my spare time I'm building Revírník, a fishing app, with a friend.

What I test

Internal network & AD: What happens once an attacker gets in. Privilege escalation, lateral movement, Kerberos, delegation, segmentation.
Hardware: Firmware, embedded and IoT devices, physical access.
Web & API: Manual testing of logic, authentication and access control, not just an automated scan.

We agree on scope and rules in writing first. Critical issues get reported right away, not at the end. The report has a summary for management and technical detail for IT, and once things are fixed I check that the fix actually holds.

What a finding looks like

F-03 · High · Service account passwords crackable offline (Kerberoasting)

Impact. Any employee can request a ticket for svc_backup and crack its password offline. The account has rights on every server, so an attacker owns the domain within hours.

$ GetUserSPNs.py corp.local/j.novak -request
$ hashcat -m 13100 svc.hash rockyou.txt
[+] svc_backup : Zaloha2023!   (41 min)

Fix. Replace it with a gMSA, or set a random 30+ character password and limit its rights to the backup server.

Illustrative example, environment and data are fictional.

Projects

Revírník A fishing app for Czechia and Slovakia. Maps of fishing grounds, rules and a catch log that works without signal. 10,000+ users, 200–300 a day. Flutter, FastAPI, self-hosted.
HomeIsland A Raspberry Pi home server that keeps working when the Internet is gone. Local DNS, offline Wikipedia and maps, no cloud. Open source.
Jarvis A Czech voice assistant that runs entirely at home, no cloud. An agent with tools, but it won't do anything important without my confirmation. Work in progress.

Now

Pentests at work, Revírník in the evenings, HackTheBox at weekends. Otherwise running, biking, riding a motorcycle, and every September photographing the deer rut.

Contact

If you need a network, application or device tested, write to me with what it is and when you need it.