I break into banks for a living — then write the report that gets it fixed.
hashar@munich:~$ cat about.md
Role : Penetration Testing Engineer @ Trillium Information Security Systems
Based in : Munich, Germany
Focus : Web · API · Mobile (Android/iOS) · Network · Active Directory
Also : Android malware analysis · Reverse engineering · Threat intelligence
Languages : English (C1) · German (A1 → B1 in progress)I spend my days finding the ways into systems that were supposed to be closed, and my evenings turning that into write-ups other people can learn from.
At Trillium I run security engagements for 10+ banks and financial institutions. I've reported 85 High/Critical vulnerabilities across 350 findings spanning 67 CWE classes. The one I'm proudest of isn't a finding — it's that every Critical and High issue got remediated and verified on retest.
Before that, at Pligence, I built the tooling instead of just using it: an Android dynamic analysis engine on a custom AOSP sandbox with Frida runtime instrumentation, hitting a 92% malware detection rate at 3% false positives, plus a joint ML classifier at 89% accuracy on features reverse engineered out of native .so libraries with Ghidra and Jadx.
| What | Number |
|---|---|
| High/Critical vulnerabilities reported | 85 of 350 findings |
| CWE classes covered | 67 |
| Financial institutions secured | 10+ |
| Android malware detection rate | 92% @ 3% false positives |
| ML classification accuracy | 89% |
| Technical blog write-ups | 30+ · 72k reads · 750+ followers |
| PentesterLab labs completed | 300+ |
| HackTheBox global rank | #280 · country #1 |
Offensive Security
Languages
Frameworks & Tooling
The Arsenal
Burp Suite Pro · Frida · Objection · Jadx · Ghidra · Radare2 · Nessus · OpenVAS · Havoc · Wireshark · YARA · Wazuh · Sigma · BloodHound · Impacket · NetExec · Threat Dragon
Standards
OWASP Top 10 · OWASP WSTG · OWASP MASTG · CVSS v3.1 · NIST · ISO 27001 · STRIDE · MITRE ATT&CK
🔬 TELESPYBlended spyware proof-of-concept with advanced evasion, built as my BSc thesis to study how modern Android malware stays hidden. Automation for PortSwigger Web Security Academy labs — because solving the same class of bug 200 times should be scripted. Anki-style Android flashcard app with spaced repetition, audio and placement testing, backed by a hand-built 5,684-word CEFR A1–C2 dataset. |
Turns a bare Ubuntu cloud box into a full pentest environment in one command. ⛓️ HashDexOpen-source exchange for the Stellar network with unconventional trading mechanics. Practical Python tooling for offensive security use cases. |
Penetration Testing Engineer — Trillium Information Security Systems
01/2026 – Present
Security Researcher / Penetration Tester — Pligence
12/2023 – 12/2025
BSc Information Technology — The Islamia University Bahawalpur
2019 – 2023 · Final grade 1.4 (German scale)
Certifications — CPTS · Mobile App Pentesting (TCM) · Practical API Hacking (TCM) · CompTIA Security+ · API Penetration Testing (APISec) · IBM Cybersecurity Analyst
30+ technical write-ups on Active Directory, network, web and API exploitation — practical attack chains and the defensive guidance that follows.
→ Read the blog · → Portfolio & CV · → HackTheBox profile
Open to security research conversations, collaboration, and roles in offensive security across the DACH region.
Munich, Germany · English C1 · German A1 → B1 (target 03/2027)