Real-world security assessments and high-impact development projects.
Conducted authorized web and API penetration testing across multiple modules of enterprise SaaS platforms.
Specialized in broken access control, uncovering IDOR/BOLA, function-level authorization (BFLA), and multi-tenant isolation flaws across enterprise modules, each backed by reproducible proof-of-concept.
Tested for and demonstrated stored XSS, SSRF, XXE, CSRF, and insecure file-upload handling. Executed end-to-end exploit chains such as malicious-document delivery with fully working PoCs.
Automated testing workflows by scripting Burp Suite exports into findings-tracker conversions. Authored a reusable file-upload testing playbook and professional CVSS-scored reports with remediation guidance.
Full-stack development of a secure PWA with real-time AI clinical assistance.
Integrated Gemini 2.5 Flash-Lite for AI-driven symptom triage and built a live copilot that provides differential diagnosis hints during real-time consultations.
Engineered low-latency, secure video calling with Socket.io, including real-time speech-to-text transcription for automated doctor notes.
Deployed the entire infrastructure using Docker containers, ensuring scalable production environments and offline-first mobile performance.
Full-stack web application penetration test on a luxury product marketplace
Extracted hardcoded API key from client-side JavaScript. Dumped full database schema (28 tables) and exfiltrated product, store, and internal data directly via PostgREST API, bypassing the application entirely. CVSS 9.1.
Order tracking endpoint required no authentication. Sequential order numbers allowed enumeration of all customer orders and sensitive delivery information.
Authentication synchronization endpoint accepted role parameters from client requests, enabling potential escalation from customer to admin privileges.
Django admin panel, Swagger docs, and API schema publicly accessible. robots.txt disclosed 12+ sensitive internal paths.
CSP implemented via meta tag instead of HTTP header. Missing critical directives and unsafe-inline allowing potential XSS exploitation.
Gray box penetration test on a student management system handling sensitive academic data
Login endpoint directly concatenated user input into SQL query. Confirmed via syntax error triggering and comment injection. Enables full authentication bypass and database extraction.
Two-factor authentication OTP sent to email address from client request body instead of server session. Attacker can redirect OTP to their own email for full account takeover.
Session upgraded to "fully authenticated" immediately after first-factor login. Any arbitrary code accepted. Direct URL navigation bypasses 2FA entirely, providing zero security value.
Password reset OTP can be redirected to attacker-controlled email by modifying the request body. Total account takeover of any user.
Password reset functionality downgrades to plaintext HTTP. Credentials transmitted in cleartext, enabling network-based interception.
Appending ?role=admin to API requests returns admin-level data. URL params override
session data, exposing administrative functionality to low-privilege users.
After a previous security incident, all user passwords remained unchanged for 3+ months. Any stolen credentials from the prior attack remain valid.
Independent security research on an AI note-taking platform
Discovered that the platform's avatar upload accepted SVG files without sanitizing their contents. SVG files can embed JavaScript and HTML, enabling potential Stored XSS. While the impact was limited in this case (avatars weren't publicly displayed to other users), the lack of server-side validation represented a significant security gap. The vulnerability was subsequently patched by the vendor.
GRC Analyst engagement focusing on Information Security Management Systems (ISMS) and national policy alignment.
Aligned national cybersecurity policies with enterprise risk standards by utilizing the Pakistan Information Security Framework (PISF), ensuring robust regulatory compliance across critical infrastructure.
Drove Governance, Risk, and Compliance (GRC) initiatives by conducting thorough reviews of Information Security Management Systems, identifying procedural gaps and recommending actionable improvements.
Architected an autonomous hierarchical multi-agent system (Claude/LLMs) that maps attack surfaces and executes OWASP-based test matrices.
Designed an orchestrator that routes tasks to specialized sub-agents to perform cross-module attack-chain reasoning. This surfaced complex authorization flaws that single-scope automated scanning tools consistently missed.
Engineered a persistent memory module featuring per-endpoint and data-model changelogs, ensuring the AI agents accumulate context and systematically improve attack coverage across sequential runs.
Built comprehensive safety controls into the pipeline, including tiered permission levels, mandatory Human-in-the-Loop (HITL) approvals for destructive actions, and automated pre-execution verification hooks.
Built an automated Python security tooling suite dedicated to rigorous Server-Side Request Forgery (SSRF) regression testing.
Engineered a dynamic payload generation engine capable of 70+ specific bypass techniques across 12 distinct evasion classes, including DNS rebinding, cloud-metadata exfiltration, and protocol confusion attacks.
Coupled the payload engine with a live results dashboard for immediate feedback during network exposure tests, significantly streamlining the security assessment process and minimizing false positives.