Penetration Tester · Security Consultant · Lebanon · Remote
What you don't see is what gets used against you.
Most Lebanese businesses are already exposed.
They just haven't been told yet.
That gap doesn't close by itself.
About
Breaches don't start with sophistication. They start with something nobody checked — a misconfigured service, an API returning more than it should, an access control nobody thought to question. The exposure exists before anyone exploits it. The question is always who finds it first.
Penetration testing, vulnerability assessments, and OSINT investigations across web applications, APIs, and networks. Not to generate compliance reports — but to show exactly how an attacker would move through your environment, in plain terms that lead to real decisions.
Every finding on this page was discovered on a live, production system — not a lab. Actively engaged in bug bounty programs on HackerOne and Bugcrowd.
The approach
Services
Every engagement starts with understanding what's actually there. From a focused vulnerability assessment to a full penetration test — the scope is defined by your environment and your risk, not by a preset package.
Field Work
These findings were discovered on live, production systems through authorized testing and responsible disclosure. Not simulations. Not labs.
Insecure Direct Object Reference · IDOR
Multi-tenant application. One parameter changed. No elevated access, no special tooling — just a value that wasn't yours. Every organization on the platform was reachable the same way.
High · Broken Access ControlAuthentication Bypass
Authentication logic that permitted access under conditions the application never intended. The entry point looked protected. The enforcement behind it wasn't. Discovered and reported through responsible disclosure.
High · Authentication BypassExcessive Data Exposure
Every authenticated session had access to the full dataset — names, IDs, personal records belonging to every employee in the system. The front end filtered the view. The back end didn't.
Medium · Excessive Data ExposureUsername Enumeration
Distinct server responses before a single password was tried. Existing accounts confirmed, non-existing ones rejected — differently. A quiet detail that turns a blind attack into a targeted one.
Low · Information DisclosureExposed Attack Surface · Passive Reconnaissance
Passive reconnaissance only. No credentials, no probing, no contact with any system. Publicly indexed devices running unpatched firmware with known critical vulnerabilities — visible to anyone with the right query. The question was never whether the exposure existed. It was whether anyone would find it.
Contact
No two situations are the same. The conversation starts with yours — what you have, what's at risk, and where the gaps are. The work follows from there.