$ ./overview --all
Web Pentesting · Network Security · OSINT · Active Directory . Bug Bounty
Experienced Penetration Tester and Bug Bounty Hunter with 2+ years in professional cybersecurity — identifying and mitigating vulnerabilities across web applications, APIs, and network and Active Directory infrastructure.
At Cyber Silo Pvt. Ltd. I run weekly grey-box and black-box tests and author PCI DSS-aligned reports, and hunt independently on HackerOne and Bugcrowd — with disclosed flaws at Cloudflare, Expedia Group, and more.
$ ls -la ./projects/
A structured dorking and OSINT checklist covering 14 categories across 12+ search engines — Google, Shodan, FOFA, Censys, GreyNoise, GitHub, and more. Built for bug bounty hunters and penetration testers who want systematic, reproducible passive recon.
Zero-dependency PowerShell incident-response triage toolkit for Windows — 87+ checks across 8 domains, MITRE ATT&CK-mapped, with a collapsible HTML dashboard.
Deterministic, rule-based CI/CD security gate that aggregates secret, dependency, and SAST scanners into one policy-driven pass/fail gate with a deduplicated remediation report. Runs locally and as a GitHub Action.
A native, lockout-aware, multi-protocol credential validation and access-mapping engine for authorized Active Directory penetration testing and red-team engagements.
$ ls -la ./reports/
Redacted, sanitized sample deliverables — the structure, methodology, and remediation detail I bring to every engagement. No real client data.
$ cat blog/recent.txt
Password spraying is only useful if you don't lock out the accounts you're testing. Here's the lockout math every internal pentester should know — thresholds, observation windows, and safe spray cadence — and how I bake it into ADValidate.
Real incident response rarely happens on a host with your tools pre-installed. Here's why I built NightOwl-IR to run on stock PowerShell, what it collects in the first 15 minutes, and how mapping findings to MITRE ATT&CK speeds up triage.
I found hundreds of Braze-hosted one-click unsubscribe URLs publicly indexed on urlscan.io — with encrypted tokens fully intact. Braze closed it as Informative. Here's why that's the wrong call.
$ cat ctf/recent.txt
Forest goes from an anonymous LDAP session to Domain Admin via AS-REP roasting and an ACL-abuse chain that ends in DCSync. A perfect walkthrough of why Active Directory attack paths are about permissions, not just passwords.
Active is a textbook AD box: an anonymously readable SYSVOL share leaks a GPP-encrypted service-account password, which is Kerberoasted into a full Domain Admin compromise. Two legacy misconfigurations, total takeover.
One of HackTheBox's original machines. A classic Samba usermap_script vulnerability leads to unauthenticated remote code execution and immediate root access — perfect for understanding how legacy services get exploited.
$ which --all tools
$ ssh contact@tayab.dev
Available for freelance penetration testing engagements, bug bounty collaborations, and security consulting. Response within 24–48 hours.