About me
I'm a penetration tester with over 7 years of professional experience, with a proven track record of identifying critical vulnerabilities in Fortune 500 companies, government and banking applications, and, more recently, smart contracts. Skilled in both Web2 application security and Web3 smart contract auditing, with a continued focus on expanding expertise in both fields.
What i'm doing
-
Web2 Security Research
Identifying and responsibly disclosing vulnerabilities in web applications, APIs, and infrastructure for organizations worldwide.
-
Web3 Security Research
Auditing smart contracts and decentralized protocols to uncover vulnerabilities before they can be exploited on-chain.
What I've Dealt With
-
Python
Built custom security tooling for vulnerability discovery — including scanners, fuzzers, and automation scripts used across real-world engagements.
-
JavaScript
Developed client-side exploits covering XSS, CSRF, and related attack vectors, with a focus on understanding how browsers can be weaponized against users.
-
PHP
Built web applications in PHP and tested multiple PHP applications — uncovering critical vulnerabilities including RCE, SQLi, and logic flaws in real-world PHP-based targets.
-
Solidity
Audited smart contracts on Ethereum and EVM-compatible chains, identifying vulnerabilities such as reentrancy, access control issues, and logic flaws before deployment.
-
Java
Developed mobile applications and tested both mobile and web Java-based targets on real-world engagements, uncovering a range of vulnerabilities.
-
.NET
Tested multiple .NET applications in real-world engagements, consistently uncovering critical vulnerabilities.
-
Django
Built applications with Django and assessed Django-based targets, identifying misconfigurations, broken access controls, and logic flaws in real-world engagements.
-
WordPress
Developed websites with WordPress and tested real-world WordPress targets, uncovering a range of vulnerabilities including plugin flaws, misconfigurations, and authorization issues.
-
React
Built web applications using React and tested React-based frontends for client-side vulnerabilities including XSS, client-side path traversal and others.
-
Node.JS
Developed backend services with Node.js and tested real-world targets.
-
Apache
Used for personal projects and tested on real-world engagements, identifying misconfigurations and security vulnerabilities.
-
Nginx
Used Nginx in development as a web server and reverse proxy, and assessed it on live targets — uncovering misconfigurations, path traversal issues, and insecure proxy setups.
A Glimpse of My Targets
-
GitHub
A cloud-based platform for version control and code collaboration, used by millions of developers to host and manage repositories.
-
AWS
Amazon's cloud computing platform offering a vast range of infrastructure and services including hosting, storage, and computing power.
-
Salesforce
A leading cloud-based CRM platform used by businesses to manage customer relationships, sales pipelines, and marketing.
-
Hostinger
A web hosting provider offering affordable domain, hosting, and website building services to individuals and businesses worldwide.
-
Zendesk
A customer service and support platform that helps businesses manage customer interactions across multiple channels.
-
Spotify
A leading music and podcast streaming platform with hundreds of millions of users across the globe.
-
AT&T
One of the largest American telecommunications companies, providing phone, internet, and media services to consumers and businesses.
