class AbdelkarimeAlHannachi:
role = ["Pentester", "AppSec Engineer"]
focus = ["Web Application Security", "Code Review", "Secure Development"]
methodology = "Manual pentesting → Code review → Secure fix → Semgrep detection"
currently = "Completing all PortSwigger labs (zero extensions, 100% manual)"
tools = ["Burp Suite", "Semgrep", "pip-audit", "npm audit"]
languages = ["Python", "Java", "C#", ".NET", "JavaScript"]
mindset = "Think like an attacker. Build like a defender."PortSwigger Web Security Academy ████████████░░░ All labs — manual, zero extensions
AppSec Code Review ████████░░░░░░░ Python + Java vulnerable patterns
HackTheBox ██████░░░░░░░░░ Active machines
Bug Bounty ████░░░░░░░░░░░ Starting soon
Pentesting
AppSec
Languages
Platforms
| Repository | Description |
|---|---|
| 🔐 portswigger-access-control-appsec | Reversing PortSwigger Access Control labs — vulnerable code, secure fixes in Python & Java, Semgrep rules |
| 🔴 portswigger-sqli-appsec (coming soon) | SQL Injection labs reversed — from exploitation to secure parameterized queries |
| 🔴 portswigger-xss-appsec (coming soon) | XSS labs reversed — DOM, reflected, stored — vulnerable patterns and fixes |
| 🔴 portswigger-auth-appsec (coming soon) | Authentication labs reversed — broken auth patterns and secure implementations |
┌─────────────────────────────────────────────────────────────┐
│ │
│ 1. PENTEST → exploit the vulnerability manually │
│ 2. REVERSE → find the vulnerable code behind it │
│ 3. ANALYZE → understand the developer's mistake │
│ 4. FIX → write the secure version │
│ 5. DETECT → write a Semgrep rule to find it again │
│ │
│ "Think like an attacker. Build like a defender." │
│ │
└─────────────────────────────────────────────────────────────┘
# Every vulnerability I find comes down to this:
# ❌ Wrong: authorization based on CLIENT-CONTROLLED data
# ✅ Right: authorization based on SERVER-SIDE data
# The attacker controls headers, parameters, and cookies.
# The server controls the session store and the database.
# Never confuse the two.// currently hacking something on PortSwigger...