_
Offensive Security Engineer · Full Stack Developer · Bug Bounty Hunter
Security-focused Software Engineer with strong offensive security background. I specialize in Web Application Penetration Testing, API Security Testing, and Secure Laravel Development. I build applications — and I break them professionally.
Latest Posts
LABx_Docs - Complete Setup Guide
A simple guide to set up your web security training environment
Read more →
Web Security Labs Part III
Walkthrough For Web Security Category In Cyber Talents Part 3
Read more →
Attacktive Directory | THM
99% of Corporate networks run off Active Directory. From this machine you will have a basic understanding on how to exploit such an environment.
Read more →Latest Research
SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Discovered a SQL injection vulnerability in the backend filter widget's numberrange scope. The numbersFromAjax parameter was not properly sanitized, allowing an attacker to inject arbitrary SQL queries through the filter mechanism.
Privilege Escalation: Content Editor to Administrator via Stored XSS
Found a stored cross-site scripting vulnerability that allows a content editor to escalate privileges to administrator. Malicious JavaScript injected through content fields executes in the context of an admin session, enabling full account takeover.
Incomplete Twig sandbox patch (CVE-202X-XXXXX bypass) allows data modification, exfiltration, and RCE via unblocked Model and Builder methods
Identified an incomplete patch for a prior Twig sandbox escape CVE. Unblocked Model and Builder methods remained accessible within the sandbox, enabling data modification, data exfiltration, and remote code execution.
Projects
ReservaHub
Production-ready, multi-tenant restaurant booking & management platform with GPS discovery, real-time reservations, PayPal payments, analytics, and support tickets.
View Project →
Zadx Tracking Gym
Enterprise-grade multi-branch gym management system with role-based access control, real-time member tracking, training progress monitoring, and comprehensive audit compliance.
View Project →Interested in working together?
Whether you have a security concern, a collaboration idea, or just want to talk cybersecurity — I'm always open to connecting.