Offensive security engineer focused on web and browser exploitation. Passionate about uncovering, reproducing, and tinkering with intricate bugs in high-impact, widely used software.

Work Experience

LEET Solutions — Morocco — 2024–Present — Core Pentester

Performed penetration testing on tens of web applications spanning diverse tech stacks and AI-powered solutions for high-profile Moroccan clients, including the “Marhaba operation”, OCP Group (Fortune 500 Arabia), and other big Moroccan companies.
Findings from engagements led to multiple CVEs in widely-used open-source projects (see Security Advisories), as well as community-recognized security research: “Revisiting ReDoS Attacks” and “Reading your files is two flags away”.

Security Advisories

CVE-2026-24486: python-multipart, used by FastAPI (~tens of millions of downloads) — Arbitrary file write via a non-default configuration.
CVE-2026-22256: Salvo web framework — Reflected XSS allowing arbitrary JavaScript execution in victims’ browsers.
CVE-2026-22257: Salvo web framework — Stored XSS via malicious file uploads, enabling persistent code execution.
CVE-2025-58362: Hono web framework (~27M monthly downloads) — Path confusion flaw allowing bypass of proxy-level access controls (e.g. Nginx).
CVE-2025-59139: Hono web framework (~27M monthly downloads) — HTTP header parsing violation allowing bypass of body size limits.
CVE-2025-53535: Better-Auth library (~2.8M monthly downloads) — Open redirect affecting authentication flows across multiple routes.
GHSA-hq75-xg7r-rx6c: Better-Call framework (~2.7M monthly downloads) — Routing flaw leading to cache deception attacks.

Bug Bounty Reported 4 critical bugs

Account takeover via XSS in a multi-million-user website, reported through a private program ($4,500 bounty).
Web2/XSS in require_payment function in x402.fastapi.middleware Python package can lead to ATO or funds stealing in Coinbase’s x402 protocol ($2,000 bounty).
Web2/XSS in the basic HTML paywall in @x402/express, @x402/hono, @x402/next packages can lead to ATO or funds stealing in Coinbase’s x402 protocol ($200).
NULL pointer dereference in a blockchain library allowing full denial of service ($400).

CTF Experience (Awards)

Cyber Odyssey 2024: Secured first place in Cyber Odyssey 2024, the biggest CTF competition in Morocco, winning a total of 80,000 DH with my team FC2MK, focused on Web challenges.
MCSC National CTF 2024: Secured second place with my team FC2MK, winning a total of 10,000 DH, focused on Web challenges.
NULL Hat Morocco 2025: Secured second place with my team FC2MK focusing on Web challenges.
The International Days of Ethical Hacking (IDEH) v7 CTF: Secured the third place with my team FC2MK, winning a total of 3,000 DH, focusing on Web challenges.

Browser Exploitation Research

CVE-2025-10891: Reproduced and exploited Issue 443765373, an integer truncation in Ignition — V8’s interpreter — that leads to arbitrary bytecode execution ultimately leading to sandbox renderer process RCE.
CVE-2023-6702: Reproduced Issue 40941600, a type confusion vulnerability in V8 leading to memory corruption and RCE eventually.

Education

1337 Coding School - University Mohammed VI Polytechnic — Khouribga, Morocco — 2023–2025 Software Engineering — Completed 42’s project-based curriculum focused on systems, algorithms, and practical engineering fundamentals.

N.B.

All external resources mentioned in all of my writings are included solely for their technical content; the views, backgrounds, or actions of the creators do not reflect my endorsement.

Public PGP key