Profile · Hussein Ali
Black-box testing.
Bug Bounty. Evidence first.
My strongest experience is in Black-box penetration testing and Bug Bounty. I investigate web applications and APIs from the outside, validate vulnerabilities through their observable behavior, and build reproducible evidence of impact.
Hands-on across web applications, APIs, and networks — identifying, exploiting, and validating vulnerabilities rather than trusting scanner output. The focus is deliberately narrow: trust boundaries, authorization, and business logic.
Thirteen certifications, among them eWPTX, CAPen, and CWSE. First place at Hackviser Iraq 2025, seventh worldwide, and sixth in the Iraq National Cybersecurity CTF finals.
Cybersecurity Projects Manager. CTF author and organizer for nationwide competitions across Iraq, and author of the challenges for the first CTF held at the university.
White-box source code review complements this work. When source is available, I read the application logic to pinpoint the failing security condition and explain why a vulnerability occurs.