cat role.txt
cat status.txt
Breaking things responsibly since 2022.
Finding what shouldn’t exist.
Most of what I find never gets a logo. The names on this page are the organisations reputable enough to say it publicly — the rest of the work stays quiet. None of the bugs were exotic. Nobody had looked.
read the long versionls ./sections
Choose
where to
dive in.
Seven directories. Each one opens where it lives on the page.
- 01/07~/recognitionRecognitionWHO · UNESCO · UNICEF · U.S. DoE · Sheffield · York→
- 02/07~/projectsProjects & toolsGhostJS · React2Shell · OopsCrawler→
- 03/07~/ctfCTF & competitionsBCS ICT Fest 2026 · BDSec 2026 · Bugcrowd Cup→
- 04/07~/certsCertificationsAPIsec University · SecOps Group · The XSS Rat→
- 05/07~/experienceExperienceDIU Cyber Security Centre · independent research→
- 06/07~/ethicsEthicsDisclosure practice, and the discipline of stopping→
- 07/07~/case-001The WildcardCritical MQTT authorisation flaw · first 4-digit bounty→
recognition/projects/ctf/certs/experience/ethics/case-001/
cat status.txt
Breaking
things
responsibly.
since 2022
Security researcher working on web application security and real-world vulnerability discovery. I report what I find to the organisations that own it — UNESCO, the World Health Organization, UNICEF, Adyen, the U.S. Department of Education, the University of York, the University of Sheffield and Utrecht University among them.
Day to day that means penetration testing, security research and vulnerability assessment, concentrated on web-based attack vectors: authentication flaws, broken access control, misconfiguration and business logic. I write findings the way I would want to receive them — reproducible, clearly scoped, and with remediation an engineer can act on.
- Penetration testing
- Vulnerability assessment
- Security research
- Responsible disclosure
- Bug bounty
- CTF player
cat skills.txt
The
toolkit.
What I reach for on an engagement, and what I am reading when nothing is breaking.
- 0108
Security tools
Burp SuiteMetasploitNucleiNmapWiresharkOWASP ZAPffufGobuster
- 0207
Web security
XSSSQL injectionSSRFAuth bypassBroken access controlBusiness logicAPI hacking
- 0308
Active / passive recon
SubfinderAmassHttpxShodanAssetfinderCensysGitHub reconWayback Machine
- 0406
Core
Web fundamentalsLinuxJavaScriptPythonOSI modelBash
Recognised
by the
Top organisations.
These are the ones that put their name to it. Others received the report without a published recognition. Open any entry to see the acknowledgement itself.
And many more
545
teams at BDSec CTF 2026
placed 2nd
06
CTF & competition results
03
tools built and released
08
certifications
ls -la ~/bin
Built
to look
closer.
- 01
GhostJS
JavaScript recon at scale
Crawls domains for JavaScript files and pulls out API keys, secrets and hardcoded URLs using pattern matching and entropy analysis. Modern apps leak infrastructure inside bundles; GhostJS makes that leak legible.
- --python
- --regex
- --entropy
- --automation
- 02
React2Shell
CVE-2025-55182 validation
A proof-of-concept scanner and exploit tool for the React Server Components RCE. Verifies real impact across large deployments with multi-threaded, localised command testing.
- --python
- --exploit-dev
- CVE-2025-55182
- 03
OopsCrawler
Recursive link validation
Recursively crawls a site for broken links, blocked paths and HTTP errors, then reports only what is actually broken as CSV. Built for maintaining high availability on large estates.
- --python
- --requests
- --beautifulsoup
Released on GitHub. Source available on request where a tool targets a live CVE.
Measured
against the
field.
Six results across national and international events, plus one event I built rather than entered.
- 2026BCS ICT Fest CTF15thTeam position worldwide
- 2026BDSec CTF2nd Runner-up545 teams worldwide
- 2026HackerOne Bug HuntFinalistTop 20
- 2025Technonext Cyber InvasionFinalistTop 20
- 2025DIU CyberCon National CTFFinalistTop 10 individual
- 2023Bugcrowd Hacker Cup 3Top 20Worldwide team position
2026 · Organiser & Problem Setter
CSAD CSC CyberWar
Authored original challenges in web security, cryptography and real-world attack scenarios. Managed challenge deployment, infrastructure and live participant support.
ls ~/certs
Certified.
Still reading
source.
Eight credentials across application security, network security and API testing. Open any entry to see the certificate.
cat experience.log
Where
I’ve been.
Jul 2026 — Sep 2026
Pentest Engineer (Contractual)
Cyber Security Centre, Daffodil International University
- Conducted penetration testing and vulnerability assessments across web applications, APIs and network environments.
- Identified, validated and documented vulnerabilities with impact analysis and actionable remediation guidance.
2022 — Present
Security Researcher & Bug Bounty Hunter
Independent
- Discovered and responsibly reported web security vulnerabilities to leading organisations, receiving recognition from UNESCO, WHO, UNICEF, Adyen, the University of York, the University of Sheffield and the U.S. Department of Education.
- Specialised in authentication flaws, broken access control, misconfigurations and insecure implementations.
2022 — 2026
B.Sc. Software Engineering
Daffodil International University · Major in Cyber Security
cat ethics.md
Proof,
not possession.
The proof of a vulnerability is that it exists — not that you kept a copy of what you found.
“I stopped once the flaw was proven. Everything past that point was someone else’s data.”
I report, I retest the fix, and I delete what I do not need. Every organisation listed above received the same process: a reproducible finding, a plain impact statement, and no data beyond what was required to demonstrate the flaw.
CASE 001 / 2026
How I Hacked a Live Chatbot.
One + in an MQTT topic string.
- received
- 88messages
- not mine
- 10sessions
- before I stopped
- 03minutes
- Target
- Live customer support chatbot
- Program
- Private HackerOne program
- Severity
- Critical
- Outcome
- First 4-digit bounty
Responsible disclosure. No customer data retained. The vendor took the service offline until the fix was verified.
Have an attack
surface worth
testing?
mahbuburrahmansoraf@gmail.com↗Available for penetration testing, security research and responsible disclosure work. Based in Dhaka — working remotely.
Elsewhere
- Location
- Dhaka, Bangladesh