Security research
I investigated vulnerability data and how applications collected, stored, and transmitted user information under the supervision of Dr. Mohammad Mannan and Dr. Amr Youssef.
The situation
Vulnerability records could be inconsistent, and application privacy claims needed to be checked against observable behaviour.
What I did
I analysed CVE records with Python and combined static analysis, traffic inspection, API fuzzing, and black-box testing in application assessments.
What changed
I documented affected data flows, privacy and security weaknesses, risk impact, and remediation guidance that others could investigate.
What I took forward
A useful finding needs evidence, clear limits, and a next action. The wording should reflect what the assessment actually demonstrated.
Selected contributions
- Curated and analysed CVE records with Python, Pandas, and text-analysis methods to investigate metadata quality, classification, disclosure consistency, recurring patterns, and remediation prioritisation.
- Assessed thick-client enterprise monitoring and property-management applications through black-box testing, API fuzzing, penetration testing, and OWASP-guided analysis.
- Investigated third-party GPT-based Android applications using static and dynamic analysis, traffic inspection, upstream-component review, and data-leakage checks.
- Recorded methodology, affected data, evidence, severity, and remediation guidance for technical and non-technical readers.
Tools and methods: Python, Pandas, Burp Suite, mitmproxy, jadx, MobSF, Sysinternals, Wireshark
Have a related challenge?
Discuss a project