---

> whoami

Red teamer, pentester, bug bounty hunter and reverse engineer.
I don't just find vulns - I tear them apart to understand their core,
then automate the boring part and teach how they tick.

Wired differently (ASD Lvl 1) → the hyperfocus that dismantles complex
threats and turns them into writeups anyone can follow.

• 🔩 Break → Understand → Automate → Teach. Offensive technique, binary reversing and AppSec, always from the attacker's seat.
• 🎯 Always hunting. HTB / THM boxes, research on Bugcrowd · HackerOne · Intigriti · YesWeHack, sharpening on pwn.college, Crackmes.one, MalwareBazaar & DEFCON.
• 🧪 Real environments only. Isolated labs, working PoCs, detailed exploits - logs on the console, concrete proof, zero bullshit.

---

> disclosures --list

Real findings, real impact. The ledger:

CVE / ID	Target	Class	Severity
CVE-2025-10230	Samba	OS Command Injection (13 yrs hidden)	CVSS 10.0 🔴
CVE-2026-23722	WeGIA	Stored XSS → RCE / UI redressing	CVSS 9.1 🔴
CVE-2025-67503	WeGIA	Reflected XSS	CVSS 8.2 🟠
NCUA VDP	🇺🇸 U.S. Gov	Unauthenticated OS Command Injection	P1 🔴
Digital Flanders	🇧🇪 Belgium Gov	Blind XXE → Internal SSRF (Tomcat Manager)	High 🟠
Samba CTDB	Samba	Buffer Overflow (InfiniBand wrapper)	Memory Corruption 🟠

---

> hof --recognition

6× U.S. Government Hall of Fame  ·  15 valid vulns  ·  93.75% accuracy

🇺🇸 Agency	Program
🚀 NASA	National Aeronautics and Space Administration
🏛️ U.S. Dept. of Commerce	Vulnerability Disclosure Program
🎖️ Dept. of Veterans Affairs	Vulnerability Disclosure Program
💳 NCUA	National Credit Union Administration
♻️ EPA	Environmental Protection Agency
🦅 U.S. Fish & Wildlife Service	Vulnerability Disclosure Program

_{+ 🇧🇪 Digital Flanders (Belgium Gov) · achievements: Submission Shogun L3 · Bounty Bee L4 · Collaboration Crusader L1}

_{Full trophy cabinet → bugcrowd.com/h/Tr0p}

---

> cat arsenal.txt

[recon]        nmap · naabu · nuclei · ffuf · amass · httpx · subfinder
[exploitation] Burp Suite Pro · pwntools · Metasploit · sqlmap · mitmproxy
[reversing]    IDA Pro · Ghidra · Radare2/Rizin · x64dbg · Frida · gdb-pwndbg
[ad / redteam] BloodHound · Impacket · CrackMapExec · Certipy · Rubeus · Havoc · Cobalt Strike
[cloud]        AWS · Azure · GCP · Terraform · Docker · Kubernetes
[analysis]     Semgrep · CodeQL · advanced regex · custom tooling

Languages of choice

Python for everything · Bash & PowerShell for speed · C when I need to get close to the metal · JS to run everywhere. If it can be scripted, I automate it.

---

> ls ~/playground

Red Teaming & APT Emulation  •  Exploit Dev & Reverse Engineering  •  Malware Analysis  •  AI/ML in Offensive Security  •  Advanced AppSec & DevSecOps  •  Cloud Security & Secure Architecture

---

> git log --stat

---

> nc -connect

_{PS C:\Users\Tr0p> exit  # thanks for reading... now go own something! (with authorization).}