βTrust nothing. Verify everything. Break systems to build them stronger.β
βββ(xpl01tγΏred-team)-[~]
ββ$ whoamiI am Mr z3ro, a cybersecurity student and offensive security enthusiast from Bangladesh.
My primary interests include:
- Red Team Operations
- Web Application Security
- Bug Bounty Hunting
- Penetration Testing
- Vulnerability Research
- OSINT and Reconnaissance
- Custom Payload Development
My objective is to discover security weaknesses, simulate realistic attack scenarios, and help organizations build stronger and more resilient systems.
β οΈ All security research and testing activities are performed only on systems where I have explicit authorization.
[+] Advanced web exploitation
[+] Vulnerability discovery and responsible disclosure
[+] Reconnaissance automation
[+] Custom payload and tooling development
[+] Active Directory attack-path analysis
[+] Red Team tradecraft and adversary simulation
| Platform / Event | Achievement |
|---|---|
| HTB Cyber Apocalypse CTF '26 | 35th Global Rank β Team Mutex19 |
| HTB Cyber Apocalypse CTF '26 | 69,425 points β 136/136 challenges solved |
| HTB Global Benchmark '26 | 148th Global Rank |
| HTB Global Benchmark '26 | 52,325 points β 95/126 challenges solved |
| Hack The Box | Skilled β Level 36 |
| TryHackMe | Top 3% β Level 10 WIZARD |
| TryHackMe | 132 rooms completed β 13 badges |
| HTB Activity | 11-week active streak |
-
Arena Web Certified Professional (AWCP)
- Cyber Security & Ethical Hacking
- Issued by Arena Web Security
- Issued: 2 October 2026
- Verification No:
A61W0724S018
-
Wiz Bug Bounty Masterclass
- Advanced vulnerability hunting and bug bounty methodology
-
BCI Cyber Security Boot Camp
- Ethical hacking and penetration testing fundamentals
-
TryHackMe Hacker Holidays
- Byte Lotus Summer Breach Engagement
| Domain | Focus Areas |
|---|---|
| π Web Security | OWASP Top 10, API testing, SQLi, XSS, LFI/RFI |
| π Authentication | Authentication bypasses, session flaws, privilege issues |
| 𧩠Access Control | IDOR, privilege escalation, business logic vulnerabilities |
| π File Security | Path traversal, unsafe file uploads, LFI/RFI |
| π₯οΈ Network Security | Port scanning, service enumeration, pivoting |
| π’ Active Directory | Kerberoasting, AS-REP Roasting, BloodHound |
| π§ Linux Security | SUID, capabilities, cron jobs, kernel misconfigurations |
| πͺ Windows Security | Token abuse, services, registry, scheduled tasks |
| π OSINT & Recon | Asset discovery, subdomain enumeration, attack-surface mapping |
SQL Injection Authentication Bypass
Cross-Site Scripting Information Disclosure
Path Traversal / LFI Business Logic Flaws
OS Command Injection Unsafe File Uploads[1]
Access Control Vulnerabilities
#!/bin/bash
echo "[+] Initializing offensive security workflow..."
reconnaissance
subdomain_enumeration
port_scanning
service_enumeration
technology_fingerprinting
vulnerability_assessment
manual_validation
controlled_exploitation
privilege_escalation
report_and_remediate
echo "[+] Assessment completed responsibly."Add your best tools, write-ups, automation scripts, and research projects here.
| Project | Description |
|---|---|
| π Recon Automation | Automated reconnaissance and asset-discovery toolkit |
| π§ͺ Web Security Lab | Vulnerable applications and exploitation notes |
| βοΈ Security Scripts | Python and Bash utilities for penetration testing |
| π CTF Write-ups | Technical notes from HTB and TryHackMe challenges |
[x] Web Application Security
[x] Linux Privilege Escalation
[x] Network Enumeration
[x] Bug Bounty Fundamentals
[x] Active Directory Basics
[ ] Advanced Red Team Operations
[ ] Cloud Security
[ ] Malware Analysis
[ ] Exploit Development
GitHub β’ TryHackMe β’ Hack The Box β’ LinkedIn β’ X β’ About.me
ββββββββββββββββββββββββββββββββββββββββββββββ
β Stay curious. Think like an attacker. β
β Build like a defender. β
ββββββββββββββββββββββββββββββββββββββββββββββ