Security QA Engineer & Penetration Tester · Web, API & Business-Logic Security
I find the vulnerabilities that turn into account takeover, and make sure they get fixed.
LinkedIn • TryHackMe • Email • 📍 Alexandria, Egypt • 🟢 Open to remote contract / part-time
Security QA Engineer and Penetration Tester covering web and API products, with a focus on access control and business-logic flaws. I own both functional QA and offensive security testing, and deliver bilingual (Arabic/English) reports with CVSS/CWE mapping, proof-of-concept evidence and prioritized remediation. I also build custom Python tooling to automate discovery and extend manual coverage.
| 🔴 2 | independently confirmed CRITICAL account-takeover chains, tracked through remediation and retest |
| 🛠️ 9 | findings on one black-box engagement (broken access control, IDOR, user enumeration, missing rate-limiting) |
| 📉 ~80% / ~75% | CVSS-weighted risk reduction after fixes (payments platform / ride-hailing platform) |
| 📄 17 | public client-style pentest reports (pentest-writeups) |
| 🧰 15 | vulnerability scanners in my own tool, VulnScan-HEX |
Security QA Engineer & Penetration Tester — SmartWare Ltd (Jan 2025 – Jan 2026 · Full-time)
- Black-box assessments of web and API platforms; chained findings into 2 CRITICAL account-takeover paths, including unauthenticated Swagger/OpenAPI exposure of ~190 endpoints (CWE-200) and IDOR exposing PII (CWE-639).
- Found stored XSS (HIGH) and CSV formula injection (CWE-1236); rate-limit and brute-force testing exposed a server capacity collapse and a Redis misconfiguration.
- Cut the CVSS-weighted risk score by ~80% (payments platform) and ~75% (ride-hailing platform) after remediation.
- Owned manual QA across 9 modules: test plans, module-level test cases, regression and retesting.
Freelance Security Engineer (2024 – 2025)
- VulnScan AI — co-designed and owned a scanner that verifies every finding against the live target before reporting; in one real test, 38 raw results were filtered to 7 confirmed.
- AqarMap — independent OWASP Top 10 web application pentest with a findings report and remediation guidance.
|
17 client-style pentest reports — AD domain compromises (Dead Drop, Silent Monitor), host/web exploitation, cloud SSRF→IMDS, LLM pentesting & methodology. Executive summary → attack chain → remediation. |
Custom Python tooling: Dagger (password-reset auditor), VerboseLogin_UserEnum, IDOR Tester, loc-tracker, and a recon script suite. | Structured Arabic knowledge base — 16 modules on web attacks, SQLi/XSS/CSRF, API security, Active Directory & testing frameworks. |
✍️ Writing: VulnScan-HEX — a scanner that proves, not guesses · Small findings. Critical impact. · Is QA a good first step into pentesting? · SSRF to cloud metadata: the chain
- VulnScan-HEX — modular web vulnerability scanner in Python built on Hexagonal Architecture (Ports & Adapters). The core only judges evidence (request/response), so findings are verified rather than pattern-matched; 15 scanners aligned with OWASP Top 10:2025 (SQLi, XSS, SSRF, SSTI, RCE, JWT, GraphQL), local AI reporting via Ollama, 30 unit tests.
- Dagger — authentication and rate-limit testing platform; its password-reset auditor: detects tokens leaked in API responses, scores token entropy to flag brute-forceable values, checks user enumeration & rate-limiting, and emits ready-to-run
crunch/ffuf/hydrarecipes. - VerboseLogin_UserEnum — discovers valid accounts by diffing login error responses (auto-baseline + marker modes), producing spray-ready output.
| Domain | Focus |
|---|---|
| Web Application | SQL Injection (Union/Blind/Time) · XSS (Reflected/Stored/DOM) · IDOR · CSRF · SSRF · LFI/RFI · Broken Authentication · Security Misconfigurations |
| Advanced Web Attacks | JWT Algorithm Confusion (RS256→HS256) & token forgery · HTTP Request Smuggling (CL.TE / TE.CL) · OAuth CSRF · Race Conditions |
| Active Directory | Enumeration · Kerberos abuse (AS-REP / S4U2Self / constrained delegation) · Lateral Movement (PtH, WinRM, PsExec) · Credential Harvesting · DCSync → Domain Admin |
| API & Auth Testing | REST API assessment · authentication & token-flow analysis · BOLA · Mass Assignment · rate-limiting abuse |
| Network & Recon | Nmap (NSE) · Wireshark · ARP/DNS spoofing · HTTPS downgrade · session hijacking · WiFi (WEP/WPA2, Evil Twin) · OSINT |
| Post-Exploitation | Privilege escalation (Linux/Windows) · pivoting & tunneling · hash cracking (hashcat/john) |
Practice engagements documented as full client-style reports. Click any name for the report.
| Engagement | Type | Key techniques | Outcome |
|---|---|---|---|
| Dead Drop | Web → AD | SQLi auth bypass → Node require() RCE → leaked creds → hardcoded domain creds in APK → AD ACL abuse (nested Domain Admins) |
🔴 Domain Admin |
| Silent Monitor | Web → Host | SQLi + command injection → SSH foothold → cracked KeePass (KDBX4) vault → privesc | 🔴 Root |
| Intro to AD Lateral Movement | Active Directory | PsExec / WinRM · Pass-the-Hash · local-admin reuse · SOCKS pivot to DC | 🔴 Domain Admin (5/5 flags) |
| Jump | Linux Host | Anonymous FTP recon → PATH hijack → sudo deploy.sh → sudo less GTFOBin |
🔴 Root (5/5 flags) |
| Tomcat CVE-2024-50379 | Web Server | TOCTOU race-condition RCE on Apache Tomcat 10.1.x → reverse shell | 🔴 RCE |
| Cloud Security Fundamentals | Cloud | SSRF → IMDS credential theft → role assumption → production secrets | 🔴 Cloud creds |
📄 Full report library → pentest-writeups
- TryHackMe — Junior Penetration Tester (Top 2% globally · 164 rooms · Level 12)
- CompTIA Security+ — training completed; exam in preparation
- Additional: Network Penetration Testing (WiFi & Wired) · Social Engineering awareness · Advanced C Programming
Offensive security for defense — authorized testing only.