78+Vulnerabilities researched
Research tally shared by the researcher CYBERSECURITY · WEB APPLICATION & API SECURITY EGYPT
Hello, I’m
Abdallah
Mahmoud Hafez_
Cybersecurity Researcher
I investigate web application and API security, explore how systems fail at their trust boundaries, and build practical workflows for vulnerability discovery, validation, and responsible reporting.
VULNEX / RESEARCH PROFILE01 — 06
V
research.profile
const researcher = {
focus: "Web & API Security",
method: "Research → Validate",
approach: "Responsible Disclosure"
}; APPSEC / API
RECON · ANALYSIS · REPORTING
INDEPENDENT SECURITY RESEARCH ALWAYS LEARNING
SCROLL TO EXPLORE↓
51Unique subdomains
Observed in one authorized recon runWEB + APISecurity focus
Application testing and authorizationEND-TO-ENDResearch workflow
Reconnaissance to responsible reporting01 / PROFILECuriosity, method,
Curiosity, method,
and practical security.
A researcher’s mindset, an engineer’s foundation, and a commitment to learning by doing.
I’m Abdallah Mahmoud Hafez, a Computer and Artificial Intelligence undergraduate at Sohag University, focused on web application and API security.
As an independent bug bounty researcher, I spend my time understanding application behavior, examining authentication and authorization boundaries, and investigating vulnerabilities that can affect users, data, and business workflows.
My approach combines reconnaissance, manual HTTP/API analysis, technical validation, impact assessment, and clear, reproducible reporting. Alongside research, I build scripts and practical workflows with Python, Bash, and Linux to make repetitive security tasks more structured.
Explore my professional journey ↗abdallah@vulnex: ~/profile— □ ×
$ whoami
- NAME
- Abdallah Mahmoud Hafez
- ROLE
- Security Researcher
- FOCUS
- Web & API Security
- EDUCATION
- Computer & AI Engineering
- LOCATION
- Egypt
- STATUS
- Always learning_
$ build · test · report █
↗
Open to relevant opportunities
Cybersecurity roles, research collaboration, and technical learning environments.
02 / TECHNICAL EXPERTISEHow I approach
How I approach
security problems.
Core capabilities and working areas, based on my practical research and technical learning.
0101 / 04
Web Application Security
Testing application behavior, trust boundaries, access-control decisions, and workflow logic.
- Authentication & authorization
- Broken Access Control / IDOR
- Cross-tenant isolation
- Business logic testing
0202 / 04
API Security
Reviewing API requests and responses to understand data exposure, validation, and permission boundaries.
- Endpoint behavior analysis
- HTTP request/response review
- Parameter & input testing
- Authorization checks
0303 / 04
Reconnaissance
Mapping assets and application surfaces before deeper manual testing.
- Passive & active reconnaissance
- Subdomain enumeration
- Endpoint & URL discovery
- Filtering and deduplication
0404 / 04
Security Automation
Using scripting and command-line tools to structure research and reduce repetitive work.
- Python & Bash scripting
- Linux-based workflows
- Tool orchestration
- Evidence and report preparation
TOOLS & TECHNOLOGIES
Select a category to exploreMy working toolkit
Burp SuiteOWASPNmapSQLMapXSStrikeDalfoxTruffleHogmantra
03 / SECURITY RESEARCHInvestigate the edge cases.
Investigate the edge cases.
Understand the impact.
A selection of vulnerability classes and research areas I work with. Target identities and sensitive technical details remain private.
RESEARCH FOCUS / 78+Vulnerability research
Vulnerability research
across the application stack.
Exploring security weaknesses in web applications and APIs through scoped testing, manual verification, and responsible disclosure.
Explore research areas ↗Discover
Map assets, identify entry points, and build a picture of the application surface.
Understand
Establish normal behavior through baseline requests, roles, and expected workflows.
Test
Examine parameters, permissions, trust boundaries, and unusual application states.
Validate
Reproduce the issue safely and assess practical security impact.
Report
Document evidence and remediation context for responsible disclosure.
Want more context on my methodology and research domains?
Go to security research ↗04 / SELECTED PROJECTS & LABSPractical work.
Practical work.
Clear methodology.
Selected automation work and structured security labs that demonstrate hands-on learning.
ROOTSUBAPIWWWDEV
$ amass enum -d target.tld$ subfinder -d target.tld$ httpx -l hosts.txt→ 51 unique subdomains
BASH / RECONNAISSANCE / AUTHORIZED TESTING
Automated Reconnaissance Workflow
Created a repeatable workflow for subdomain discovery, URL collection, filtering, deduplication, and asset organization using Amass, Subfinder, httpx, and waymore.
51unique subdomains from one authorized run
cap-lab / terminal
$ nmap -sC -sV target → enumerate open ports $ inspect services → map the attack surface $ document findings
HTB
CAP
CAP
NMAP / LINUX / TEAM EXERCISE
Hack The Box — Cap Lab
A guided team exercise involving network scanning and reconnaissance, identifying open ports and running services, and analyzing a security snapshot and URL structure.
MORE CODE & ACTIVITY
Open GitHub ↗Explore my GitHub profile.
Browse my public repositories, technical experiments, and development activity.
See more detail about the work and practical labs.
Explore all projects ↗05 / EDUCATION & CREDENTIALSLearning with
Learning with
a practical foundation.
Academic study, completed training, technical courses, and self-directed learning.
ACADEMIC BACKGROUNDEG / SOHAG
SU
Sohag University
Computer and Artificial Intelligence
Undergraduate student with academic focus in programming fundamentals, computer networks, databases, and cybersecurity practice.
CCEP
Certified Cybersecurity Educator Professional
Red Team Leaders · Program requirements completed and examination passed.
CA
Cybersecurity Academy — Undergraduate Level 2026
Penetration Testing & Application Security · 60 technical hours + 12 freelance hours.
IBM
AI Fundamentals with Capstone Project
IBM SkillsBuild · Guided learning and capstone project completed.
C
Ethical Hacking Course
Cisco Networking Academy · Course completion certificate.
IT
Backend Web Development Training
CREATIVA Sohag / ITIDA / TIEC · Completed.
WD
Web Design Training
CREATIVA Sohag · Completed.
NET
Computer Network Fundamentals
Mahara-Tech · Course completion certificate.
LEARNING TRACKS
eJPT and WPTX course preparation through self-study. These are learning tracks, not claimed as earned certifications.
06 / EXPERIENCE & ACTIVITIESBuilding experience
Building experience
through practice.
Independent research, structured learning, internship selections, and hands-on activities that shape my path in cybersecurity.
View the full journey ↗Independent Bug Bounty Research
Testing web applications and APIs within program scope, focusing on authorization, tenant isolation, endpoint behavior, and business logic.
ONGOING RESEARCHCodeAlpha — Cyber Security Internship
Selected for the Cyber Security Internship Program; selection/offer confirmation received.
SELECTEDTips Hindawi — Cyber Security Internship
Accepted into the program, with acceptance confirmation and orientation details received.
ACCEPTED INTO PROGRAMAI Hackathon 2026
Accepted participant — CREATIVA Innovation Hubs, ITIDA, TIEC, Orange Digital Center, and INSTANT Software Solutions.
PARTICIPANT07 / CONTINUOUS PRACTICE
Learning by doing.
Practicing web security concepts through structured labs and authorized environments.
08 / CONTACTLet’s talk about
Let’s talk about
security and opportunity.
For cybersecurity roles, collaboration, responsible disclosure, or professional opportunities, send me a message. I’ll be glad to hear from you.
Open to relevant opportunities