Identity: unverified

IT SpecialistWeb-App Penetration Tester

Zhir Awrahman

Breaking in, with permission.

Authorized web-application pentests for SaaS clients. Microsoft 365, identity and network security in my day job. An M.Sc. in Artificial Intelligence in progress.

Download CVView findings

There's a flag hidden in this site.

Base
Erbil, Iraq
Coords
36.19° N, 44.01° E
Local time
UTC+3

Press and hold to scan the fingerprint, or just scroll down.

Skip

Three areas. Real hands-on work in each.

I'm an IT Specialist based in Erbil, Iraq. Day to day I administer Microsoft 365, identity and endpoints, and multi-site networks for a multi-branch school organization. Alongside that I'm studying for an M.Sc. in Artificial Intelligence at the University of Kurdistan Hewlêr.

  1. 01 Offensive security Authorized web-app pentests for freelance clients, each delivered with a written disclosure report.
  2. 02 Applied AI / ML A co-authored, peer-reviewed deepfake-detection paper where I wrote the model code. AI/ML engineering is where I'm growing next.
  3. 03 Systems & networks My day job, plus freelance network, CCTV and smart-home deployments.

01 / Security

Recon. Exploit. Report.

01 / Security

Find the way in. Write the fix.

Three authorized web-application security assessments for independent SaaS clients (Sep 2026). Each was delivered as a full written report: scope, methodology, findings, proof-of-concept and prioritized remediation.

Client names are withheld, as is standard for security-disclosure work.

Authorized engagements
03
Written reports delivered
03
Client names disclosed
00

assessment_01

Firebase-backed Next.js SaaS platform

  • Exposed credential
  • Broken access control
  • Recon against the public site and its client-side JavaScript bundles.
  • Found a credential hardcoded in a public-facing debug page, which gave authenticated access as a staff/admin account (no MFA in place).
  • Identified broken access control on an administrative API that allowed unauthorized privileged actions.
  • Reported with reproduction steps, business impact and a prioritized fix list: rotate credentials, enforce MFA, add server-side authorization checks.

assessment_02

Supabase-backed Next.js SaaS platform

  • Critical · IDOR
  • Secrets in client bundle
  • Enumerated the API schema and tested authentication flows and access control end-to-end.
  • Found a critical broken-access-control (IDOR) flaw in a backend database function that let an authenticated user set their own account balance to any value.
  • Found hardcoded API keys and internal webhook URLs shipped in the public client bundle.
  • Delivered root-cause analysis, proof-of-concept and example remediation code: a server-side authorization function, key rotation, secret hygiene.

assessment_03

Multi-tenant white-label SaaS (multiple linked products)

  • Unauthenticated admin endpoints
  • Cross-tenant auth boundaries
  • Found production credentials and access tokens committed to public source-control repositories.
  • Identified unauthenticated administrative endpoints allowing unauthorized account-balance manipulation across multiple tenant platforms.
  • Documented weaknesses in cross-tenant session and authorization boundaries.
  • Delivered a full report with a prioritized remediation checklist for the platform owner.

How an engagement runs

  1. 01ReconPublic site and public source-control repos.
  2. 02Source & bundle analysisClient-side JS, leaked keys, debug routes.
  3. 03AuthenticationLogin flows, sessions, JWT handling.
  4. 04Access controlIDOR / BOLA across APIs and DB functions.
  5. 05ReportPoC, business impact, prioritized fixes.

Stacks reviewed: Firebase · Supabase / PostgREST · Next.js / Vercel · JWT · Stripe integrations

Blue side, at work

  • Investigate Microsoft Defender XDR / Sentinel incidents and alerts.
  • Incident response on real events: device isolation and credential resets.
  • Enforce Conditional Access and MFA policies across the tenant.

Completed

AI Red Teamer track — Hack The Box

Adversarial ML and LLM security: prompt injection and jailbreaks. It's where the security work meets the AI chapter.

Try it yourself

This site has a flag hidden in it.

Three small stages: recon, a leaked token and an access-control flaw — the same classes of issue from the assessments above, in a safe, fake setting.

02 / Artificial intelligence

Train. Test. Detect.

02 / Artificial intelligence

Teaching machines to spot the fake.

M.Sc. in Artificial Intelligence at the University of Kurdistan Hewlêr (Sep 2025 – present), building on a B.Sc. in Computer Engineering. AI/ML engineering is the direction I'm growing into next.

Peer-reviewed publication · 2024

Enhanced Detection of Diffusion Model-Generated Deepfakes Using CNN Feature Maps and Forgery Traces

Awrahman, B. J., Awrahman, Z. J., & Aziz, C. F. (2024). Journal of Al-Qadisiyah for Computer Science and Mathematics, 16(4).

A hybrid detection framework that combines ResNet-50 spatial features with FFT frequency-domain analysis to identify synthetic faces from both GANs and diffusion models (DDPM, PNDM, LDM).

My part I wrote the model code — the ResNet-50 + FFT hybrid implementation. Dataset preparation, the experiments and the paper text were my co-authors' work (first author Banan Jamil Awrahman, with Chya Fatah Aziz).

98.42% AUC

Reported result, outperforming the benchmarks compared against.

face image ResNet-50 feature mapsFFT forgery traces real / generated

What I build with

  • PyTorch
  • TensorFlow / Keras
  • scikit-learn
  • Hugging Face
  • CNNs
  • Fine-tuning
  • Reinforcement learning
  • LLM APIs
  • RAG · embeddings + vector DB
  • LangChain / LlamaIndex
  • Multi-agent / A2A
  • MCP servers & Claude Code skills

03 / Infrastructure

Identity. Endpoints. Networks.

03 / Infrastructure

The network is the day job.

Identity, endpoints and multi-site networks for a multi-branch school organization, plus freelance network, CCTV and smart-home deployments.

  1. Sep 2025Present

    IT Specialist — Microsoft 365 & Infrastructure

    Stirling Schools Head Office · Erbil, Iraq

    • Administer the Microsoft 365 Education tenant (Exchange Online, SharePoint, OneDrive, Teams governance and security policies) across several school branches.
    • Manage the Entra ID identity lifecycle: provisioning, licensing, access control, Conditional Access and MFA.
    • Endpoint compliance and patching with Intune; investigate and respond to Defender for Endpoint / XDR alerts.
    • Design, deploy and maintain MikroTik- and Cisco-based networks: VLAN segmentation, firewall rules, Wi-Fi and VPNs across the head office and branches.
    • Operate VPS environments, including surveillance-system uptime and firmware management.
    • Build Power Automate flows that pull data from Power BI datasets with SQL queries, and use Python to analyse system usage for capacity, access and policy decisions.
  2. Jul 2025Aug 2025

    Smart Systems Engineer

    Jir Home · Erbil, Iraq

    • Deployed and configured IoT smart-home systems on-site: smart locks, lighting, sensors.
    • Integrated devices across protocols, including MQTT and Zigbee.
    • Applied access-control rules, encrypted protocols and firewall protections to connected devices.
  3. Jun 2024Aug 2024

    IT Intern

    Informatics · Sulaymaniyah, Iraq

    • Assisted senior engineers with uptime monitoring and basic incident log review.
    • Supported network access-control provisioning and general IT support.

Freelance deployments

Business client

Network infrastructure design & deployment

Wired and wireless network for IP cameras and business-critical endpoints on Ubiquiti UniFi routing, TP-Link switching and Xiaomi access points. QoS / port prioritization, link aggregation, secured SSH remote administration, log-driven troubleshooting and hardening.

Residential client

CCTV, network & smart automation

Network infrastructure for CCTV and home automation, camera installation and integration, smart locks, lighting, curtains and windows. Designed for security, reliability, remote management and scalability.

Residential client

Smart home, CCTV & network automation

CCTV, smart-home and IoT systems on a purpose-built network: smart locks, lighting, curtains, windows, smart TVs and audio, all under Amazon Alexa voice control. Secured and maintained over time.

  • Microsoft 365
  • Entra ID
  • Conditional Access
  • Intune
  • Defender for Endpoint
  • PowerShell · Graph
  • MikroTik RouterOS
  • Cisco IOS
  • VLANs
  • Firewall & NAT
  • VPN
  • Docker
  • Kubernetes
  • Nginx
  • Linux over SSH
  • CCTV / NVR
  • MQTT / Zigbee
  • Power Automate

04 / Skills

ls -la ~/skills

Honest levels, not keyword soup. Strong: weekly at work, no help needed. Working: done for real and repeatable. Familiar: courses, labs or projects.

./security

  • Web-app penetration testing
  • Recon & JS-bundle analysis
  • API security · IDOR / BOLA
  • Authentication testing
  • Exposed-secret discovery
  • Disclosure report writing
  • Firebase · Supabase · Next.js · JWT · Stripe review
  • Defender XDR / Sentinel investigation
  • Incident response
  • Burp Suite · Nmap · Wireshark
  • Metasploit · Kali tooling
  • OSINT
  • AI red teaming
  • IDS / IPS concepts

./ai-ml

  • Agentic coding tools
  • PyTorch
  • TensorFlow / Keras
  • scikit-learn
  • Hugging Face
  • Deep learning / CNNs
  • Fine-tuning models
  • Reinforcement learning
  • LLM API integration
  • RAG · embeddings + vector DB
  • MCP servers & Claude Code skills
  • LangChain / LlamaIndex
  • Multi-agent / A2A systems
  • RLHF / post-training (DPO, PPO)

./m365-identity-endpoint

  • Microsoft 365 administration
  • Entra ID / Azure AD
  • Conditional Access & MFA
  • Microsoft Intune
  • Defender for Endpoint
  • PowerShell · Exchange Online · Graph
  • Power Automate
  • Power BI (viewing & extracting)

./networking

  • MikroTik RouterOS
  • Cisco IOS (switching & routing)
  • VLAN segmentation
  • Firewall & NAT rules
  • VPN setup
  • LAN / Wi-Fi design & troubleshooting
  • Ubiquiti UniFi · TP-Link · Xiaomi APs
  • QoS · link aggregation
  • SSH administration & log review
  • End-to-end network design

./systems-cloud

  • Linux command line (SSH)
  • VPS administration
  • Docker
  • Kubernetes
  • Nginx / reverse proxy
  • Hosting · DNS · SSL
  • CCTV / NVR systems & firmware
  • Google Cloud

./code-data

  • Python
  • SQL (hand-written queries)
  • Git / GitHub
  • Bash scripting
  • pandas · NumPy · Matplotlib
  • Web scraping
  • R
  • Flask / FastAPI

./iot-smart-home

  • Arduino · ESP32 · Raspberry Pi
  • MQTT / Zigbee
  • Smart-home deployment
  • Amazon Alexa automation
  • Multi-device IoT integration

./it-support

  • Multi-site on-site & remote support
  • Smart boards, printers, projectors

05 / Credentials

Degrees, certs, languages.

Education

  • Sep 2025 – Present

    M.Sc. Artificial Intelligence

    University of Kurdistan Hewlêr (UKH) · Erbil

  • Dec 2021 – May 2025

    B.Sc. Computer Engineering

    Komar University of Science and Technology · Sulaymaniyah

Certifications

  • doneInternet of Things (IoT) Professional Certification — Huawei ICT Center, 2024
  • doneAI Red Teamer track — Hack The Box

Preparing — not yet taken

  • prepHTB Certified Penetration Testing Specialist (CPTS) — Hack The Box · 10-day hands-on exam + report
  • prepOffSec Certified Professional (OSCP+) — OffSec · 24-hour hands-on exam + report

Languages

  • KurdishNative
  • EnglishProfessional · C1–C2
  • TurkishProfessional · B2–C1

Self-assessed on the CEFR scale.

06 / Contact

Your move.

06 / Contact

Hiring? Let's talk.

Recruiting for an IT, security or AI role? The CV has the full picture, or send me an email.

Download CV Email me

Prefer the command line? Press ` and type sudo hire-me.