Passionate about hands-on cyber defense, vulnerability assessments, bug bounty hunting, Active Directory security, and building tools and training platforms.
A hands-on cybersecurity training platform covering all 10 OWASP Top 10 (2021) vulnerability categories — Broken Access Control, Injection, Cryptographic Failures, and more. Self-contained step-by-step labs in a HackTheBox-style interface with authentication, a leaderboard, and server-side flag verification via Postgres functions on Supabase.
A Python-based Telegram bot built to test and sharpen cybersecurity awareness through interactive quizzes. Uses the Telegram Bot API — Python automation, API integration, and user engagement in one small tool.
Vertical privilege escalation via permission wildcard injection — a low-privileged account's authentication response was modified so its permissions[] array became a wildcard, unlocking administrative functionality client never should have trusted.
Local file inclusion via origin IP disclosure and Cloudflare WAF bypass — passive recon exposed the origin server behind Cloudflare, leading to a media endpoint that leaked /etc/passwd once requests bypassed the WAF entirely.