console session — user: mentor404
Web application penetration tester and full-stack developer. I test production apps for real vulnerabilities, then build the software that fixes the class of bug I just found.
Manual testing on live bug bounty programs — GraphQL mutation abuse, IDOR/BOLA, JWT and session flaws, CSRF, rate-limit bypasses. Recon-first workflow with Burp Suite, ffuf, subfinder and Wappalyzer before a single request is sent with intent.
Deep familiarity with how WordPress/PHP stacks fail — SQLi, XSS, brute-force, unrestricted file uploads — from both the attacker and the defender's seat, which is exactly what shaped WP-Shield.
Ship real client sites and chatbots end-to-end — front end, back end, and the AI layer wired on top — for businesses that need working software, not a proof of concept.
Node backends, chatbot logic, and the DOM-level bugs that show up when a frontend trusts input it shouldn't.
Recon tooling, quick exploit scripts, and automating the parts of a pentest that don't need a human doing them by hand.
Where WP-Shield lives — and where most of the WordPress vulnerabilities I test for actually originate.
A WordPress security plugin that watches traffic in real time and explains what it sees.
Built to stop the exact bug classes bug-bounty recon keeps turning up on WordPress/PHP targets: SQL injection, XSS, brute-force login attempts, and unauthorized file uploads — caught by a three-layer detection system, not a single pattern list.
Core functionality complete · exploring CodeCanyon, Lemon Squeezy and SaaS-licensing paths to release it.
A running notebook, not a highlight reel — most testing ends in "not applicable," and that's fine.
Magento target — traced an email-change account-takeover vector, exposed API keys, internal hostnames leaking via CSP headers, and staff PII.
GraphQL UpdatePassword mutation testing through Burp Suite — probing
introspection and batching behaviour.
IDOR/BOLA testing across GraphQL mutations and Bugcrowd API responses returning private profile data.
React Router 7 + Express/Supabase stack — recon focused on git history secrets, Multer upload handling, and Supabase RLS misconfigurations.
Tested search and API endpoints under Bugcrowd's public VDP program.
Bezanjo Enterprises — bezanjoenterprisesll.com
Built and deployed the company's corporate website end-to-end — structure, styling, and deployment — as the client-facing front door for the business.
Gulf Enterprise — thegulfenterprise.com
Designed and integrated an AI chatbot into the business's site, handling visitor queries and routing leads without a human at the keyboard.
NUML Islamabad, BSCS
Designing and building a WordPress security plugin with a GPT-4o-powered admin dashboard, from proposal through interim submission.
Working through the Web App Pentester path — closing gaps around race conditions, insecure deserialization, HTTP request smuggling and SSRF.
A two-month self-study plan through the authentication, access-control and business-logic-flaw labs, paired directly with TryHackMe rooms.
Mapping a certification path forward from where the bug bounty work currently tops out.
Open to security testing engagements, WordPress security work, and full-stack builds.