ABDALLAH MAHMOUD HAFEZ
LinkedIn · GitHub · Previous portfolio · VULNEX · Facebook
Professional Profile
Computer and Artificial Intelligence undergraduate at Sohag University focused on web application and API security. Independent bug bounty researcher with practical vulnerability research activity, particularly in Broken Access Control and authorization testing. Experienced in reconnaissance, manual HTTP/API analysis, vulnerability validation, impact assessment, and clear, reproducible reporting. Builds practical security and networking workflows using Python, Bash, Linux, and industry-standard testing utilities.
Research activity: 78+ vulnerability research cases, as a researcher-provided activity total. This figure is not an acceptance or bounty count.
Core Technical Competencies
- Web and API Security: Web application penetration testing, API security testing, authentication and authorization testing, Broken Access Control (BAC), IDOR, cross-tenant isolation, and business logic testing.
- Vulnerability Classes: Reflected, Stored, and DOM XSS; SQL Injection; SSRF; CSRF; HTML Injection; information disclosure; and improper access control.
- Methodology: Passive and active reconnaissance, asset and endpoint discovery, subdomain enumeration, URL collection, HTTP request/response analysis, parameter testing, vulnerability validation, impact assessment, and report writing.
- Tools and Technologies: Burp Suite, Nmap, Amass, Subfinder, httpx, Katana, waymore, waybackurls, uro, kxss, XSStrike, Dalfox, mantra, TruffleHog, and Scapy.
- Programming and Systems: Python, Bash, C++, SQL fundamentals, Git, Linux/Ubuntu, Windows, and WSL.
Security Research & Practical Experience
Test web applications and APIs within program scope, focusing on authentication and authorization controls, tenant isolation, access-control boundaries, endpoint behavior, and business logic. Validate findings, assess security impact, and submit reproducible vulnerability reports through program triage.
Conduct passive and active asset discovery, endpoint enumeration, baseline request/response analysis, parameter testing, and manual verification. Apply scope checks and responsible disclosure practices throughout testing.
Broken Access Control, IDOR, cross-tenant data isolation, authentication and authorization issues, SSRF, XSS, SQL Injection, CSRF, HTML Injection, information disclosure, and business logic weaknesses. Program names, target identities, and sensitive technical details remain confidential.
Selected Projects & Practical Labs
Created a workflow for subdomain discovery, URL collection, filtering, deduplication, and asset organization. One authorized run produced 51 unique subdomains.
Performed network scanning and reconnaissance, identified open ports and running services, and analyzed a security snapshot and URL structure in a guided practical team exercise.
Education
Sohag University | Computer and Artificial Intelligence
Undergraduate student. Relevant academic focus includes programming fundamentals, computer networks, databases, and cybersecurity practice.
Certifications & Technical Training
- Certified Cybersecurity Educator Professional (CCEP) | Red Team Leaders | 11 Apr 2026 — Completed program requirements and passed the CCEP examination.
- Cybersecurity Academy — Undergraduate Level 2026 | Penetration Testing & Application Security — Completed 60 technical hours plus 12 freelance hours. The certificate lists MCIT, NTI, EG-CERT, and NTRA participation.
- Artificial Intelligence Fundamentals with Capstone Project | IBM SkillsBuild | 19 Jan 2026 — Completed guided learning and capstone project.
- Ethical Hacking Course | Cisco Networking Academy — Course completion certificate.
- Web Development (Backend) Training | CREATIVA Sohag / ITIDA / TIEC | Aug 2026 — Completed training.
- Web Design Training | CREATIVA Sohag | Jul 2026 — Completed training.
- Computer Network Fundamentals | Mahara-Tech | 28 Nov 2025 — Course completion certificate.
- eJPT and WPTX Learning Tracks | Self-study / Course Preparation — Studied course material; these are not presented as earned certifications.
Internship Selections & Professional Opportunities
- CodeAlpha: Selected for the Cyber Security Internship Program; selection/offer confirmation received. Not represented as a completed internship.
- Tips Hindawi: Accepted into the Cyber Security Internship Program; acceptance confirmation and orientation details received. Not represented as completed internship experience.
- AI Hackathon 2026: Accepted participant | CREATIVA Innovation Hubs, ITIDA, TIEC, Orange Digital Center, and INSTANT Software Solutions. No win or award is claimed.
Practice Platforms
PortSwigger Web Security Academy | TryHackMe | Hack The Box | Authorized bug bounty programs