> For the complete documentation index, see [llms.txt](https://moaaz.gitbook.io/moaaz-afifi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moaaz.gitbook.io/moaaz-afifi/readme.md).

# Whoami

## 🙋‍♂️ Welcome to my Cyberspace

Where I learn, build, break (ethically), and document the journey.

***

## 👨‍💻 Moaaz Afifi

**Cybersecurity Engineer** | **Web & API Penetration Tester** | **Bug Bounty Hunter**

BSc in Computer Science & Engineering\
Faculty of Electronic Engineering, Menoufia University

***

## 🕵️ About Me

I’m **Moaaz Afifi**, a Cybersecurity Engineer focused on **offensive security**, **App Sec**, **web and API penetration testing**, and **real-world vulnerability research**.

I work on identifying, exploiting, and reporting security issues across modern applications, combining an attacker mindset with a developer background to uncover impactful vulnerabilities.

Currently, I operate as a **Application Security Engineer**, delivering security assessments and remediation-focused reports for clients across the GCC.

This blog is my digital lab — a place where I share writeups, tools, methodologies, and lessons learned from real-world testing, CTFs, and security research.

***

## What I Do

* **Web & API Penetration Testing** — Finding real-world vulnerabilities in modern applications
* **Bug Bounty Hunting** — Reporting impactful issues across global programs
* **Security Research** — Exploring attack techniques, recon workflows, and exploitation strategies
* **Offensive Tooling** — Building automation for reconnaissance and vulnerability discovery
* **loading more..**

***

## Core Strengths

* Deep understanding of **OWASP Top 10** (IDOR, SSRF, XSS, CSRF, CORS, Auth flaws)
* Strong experience in **reconnaissance automation**, **endpoint mapping**, and **vulnerability triage**
* Skilled in tools like **Burp Suite, Nmap, Nessus, Acunetix, Invicti, ffuf, dirsearch, SQLMap, Amass, Subfinder, Chaos, Wireshark**
* Familiar with **Secure SDLC**, **DevSecOps practices**, and professional reporting

***

## Experience Highlights

* **Web/API Penetration Tester** — Security testing engagements across the GCC
* **Bug Bounty Hunter** — Reported vulnerabilities across programs like ByteDance, iHerb, StubHub, Fossil, and more
* **Application Security Engineer @ Robusta** — Worked on real-world AppSec testing and SAST/DAST workflows
* **loading more..**

***

## Projects

* **StealParser** — Parser & analyzer for info-stealer logs with data visualization
* **PressHawk** — WordPress plugin security scanner (Semgrep-based)
* **RecoGun** — Automated recon tool integrating APIs and OSINT workflows
* **NASA Mission Control** — Full-stack Node.js + MongoDB application
* **loading more..**

***

## Community & Leadership

* **Cybersecurity Core Member — IEEE MSB**
* Contributor to workshops and sessions on ethical hacking and web security
* Passionate about knowledge sharing and mentoring

***

## 📫 Let’s Connect

* 📧 Email: <imooaaz@gmail.com>
* 💼 LinkedIn: [linkedin.com/in/imooaaz](https://linkedin.com/in/imooaaz)
* 🐙 GitHub: [github.com/m0442](https://github.com/m0442)
* 📘 Blog: [moaaz.gitbook.io](https://moaaz.gitbook.io/)

***

> *"Think like an attacker. Build like a defender. and Free Palestine 𓂆 🇵🇸"*