Dedsec

$ ./about#

Senior Offensive Security Consultant based in Egypt, focused on adversarial simulation and offensive research.

This blog documents engagements, techniques, and research from real-world penetration testing — primarily web, API, Active Directory, and red team operations, with ongoing work in reverse engineering and exploit development.

$ ./focus#

  • Web & API Security — application logic flaws, authentication and authorization bypasses, injection chains
  • Active Directory & Red Teaming — full kill chain operations, credential access, lateral movement, privilege escalation
  • Mobile Security — Android dynamic analysis, static analysis, runtime instrumentation
  • Reverse Engineering & Exploit Development — currently advancing through Ret2 Systems’ Software Exploitation curriculum

$ ./certifications

OSCP
Offensive Security Certified Professional
CRTO
Certified Red Team Operator
CRTP
Certified Red Team Professional
HTB CPTS
Hack The Box Certified Penetration Testing Specialist
CAPen
Certified AppSec Pentester · SecOps Group
CNPen
Certified Network Pentester · SecOps Group
eCPPTv2
eLearnSecurity Certified Professional Penetration Tester
PT1
TryHackMe Penetration Tester I
RastaLabs
Hack The Box ProLab

$ ./domains

Web Application Pentesting
  • OWASP Top 10
  • Business logic flaws
  • Authentication bypasses
  • Injection chains (SQLi, SSTI, SSRF)
  • Access control flaws
API Pentesting
  • REST and GraphQL testing
  • BOLA / IDOR exploitation
  • Mass assignment
  • JWT abuse
  • Rate limiting bypass
Active Directory & Red Teaming
  • Full kill chain operations
  • Kerberos attacks (Kerberoasting, ASREP)
  • NTDS.dit extraction
  • Lateral movement and pivoting
  • Cross-forest compromise
Network Pentesting
  • Internal infrastructure assessment
  • External perimeter testing
  • Service exploitation
  • SMB and LDAP abuse
  • Post-exploitation enumeration
Mobile Pentesting
  • Android dynamic analysis with Frida
  • Static analysis with Jadx and MobSF
  • Runtime instrumentation
  • IPC and intent abuse
  • Root detection bypass
Source Code Review
  • White-box web app assessment
  • API source review
  • Java, .NET, PHP, Node.js
  • Secure coding evaluation
  • SAST integration
Desktop Application Pentesting
  • Thick-client testing
  • .NET reverse engineering
  • Local privilege escalation
  • Insecure deserialization
  • IPC and DLL hijacking
Reverse Engineering
  • Binary analysis (Ghidra, IDA)
  • .NET decompilation (dnSpy)
  • Malware analysis basics
  • Protocol reverse engineering
  • Anti-debugging bypass
Exploit Development
  • Stack and heap overflows
  • ROP chain construction
  • Modern mitigation bypass
  • Ret2 Systems curriculum
  • Userland exploitation
Phishing & Social Engineering
  • Adversarial campaigns
  • Evilginx credential harvesting
  • Multi-stage payload delivery
  • Awareness assessments
  • Pretext development
Configuration Reviews
  • Firewall rule auditing
  • Router and switch hardening
  • Enterprise security solutions
  • CIS benchmarks
  • Network segmentation review
Vulnerability Assessment
  • Tenable Nessus scans
  • Nmap and service enumeration
  • Manual validation
  • Risk prioritization
  • Remediation guidance

$ ./experience#

  • Senior Offensive Security Consultant — CyberTeq · Jun 2025 – Present
  • Offensive Security Engineer — EFG Holding · Jan 2024 – May 2025
  • Cyber Security Researcher — Resecurity · 2023
  • Penetration Tester — DOMINFOSEC SOLUTIONS LLP · 2023

$ ./contact#

Currently exploring exploit development and offensive AI research. Open to collaboration on offensive security writeups and tooling.