Career Portfolio
Cybersecurity
Exploring offensive security and ethical hacking with a focus on web application penetration testing. I approach security from a builder's perspective — understanding how applications are constructed helps identify where they can break.
Penetration Testing
Hands-on offensive security · CTF labs · structured methodology
Web Application Penetration Testing
2024 — Present
Organizations commonly have web application vulnerabilities that automated scanners miss, requiring manual penetration testing expertise to uncover.
Identify and responsibly report security vulnerabilities in web applications through systematic reconnaissance, testing, and exploitation techniques.
Utilized Burp Suite for traffic interception and manipulation, wrote custom Python scripts for automated reconnaissance, and applied OWASP Top 10 methodologies for structured vulnerability assessment across authentication, injection, and access-control surfaces.
Earned Coursera Cybersecurity specialization and consistently applying learned techniques in structured lab environments and real-world programs.
CTF Competitions & Practice Labs
2023 — Present
Continuous skill development in offensive security requires hands-on practice beyond certifications and courses.
Regularly participate in Capture The Flag competitions and practice on platforms to sharpen reconnaissance, exploitation, and post-exploitation skills.
Practiced web exploitation challenges focused on XSS, SQL injection, SSRF, IDOR, and authentication bypasses. Used tools like Nmap, Gobuster, FFuf, and custom Python scripts in TryHackMe and HackTheBox environments.
Built a growing offensive security skill set with practical understanding of common vulnerability patterns and their remediation strategies.
Bug Bounty
Responsible disclosure · real-world targets · PoC write-ups
Responsible Disclosure Programs
2024 — Present
Companies running public responsible disclosure or bug bounty programs have large attack surfaces that benefit from community security researchers.
Systematically test in-scope web targets for real-world vulnerabilities following program rules; document and report findings professionally.
Performed black-box web application testing covering IDOR, broken access control, authentication flaws, and business logic bugs. Documented every finding with PoC steps, impact assessment, and CVSS scoring. Submitted reports through HackerOne and direct disclosure channels.
Actively building a responsible disclosure track record; write-up documents attached for each submitted finding.
Write-up Reports
3 reportsIDOR — Unauthorized Access to User Data
Broken Access Control — Admin Endpoint Exposure
Stored XSS — Persistent Script Injection
Program names redacted per responsible disclosure guidelines