Application security · Penetration testing

Muhammad Faqih

I test web, API and mobile applications and help developers fix security issues.

I have 3+ years of application security experience across web, API and mobile testing. I’ve worked on DAST in banking, validated findings manually, and written reports that help developers reproduce and fix issues.

View CV View selected work

OSCP+ / OSCPeWPTXeMAPTPT1

Portfolio

Selected work

Two lab assessments and an open-source tool: what I tested, how I approached it, and what you can review.

01Lab assessment

crAPI

API security

Can a signed-in user access someone else’s data?

Approach: I tested access control, authentication and input validation, then documented the findings with requests, responses and screenshots.
Result: 19 test cases: 11 FAIL and 8 PASS. Includes 49 screenshots and any available test notes, plus reports in EN / ID.

View case study View report

crAPI lab interface: dashboard — Application interface · dashboard Example finding: Broken Object Level Authorization - Vehicle - Location Tracking

02Lab assessment

VulnBank

Web + API security

Can account or transaction rules be bypassed?

Approach: I tested authentication, sessions and transaction workflows through the web interface and API.
Result: 26 test cases: 21 FAIL and 5 PASS. Includes 81 screenshots and any available test notes, plus reports in EN / ID.

View case study View report

VulnBank lab interface: dashboard — Application interface · dashboard Example finding: Account Takeover - Password Reset - Reset PIN Disclosure

03Open-source tool

Burp-TCP

Rust + Java

How do I inspect desktop traffic outside an HTTP proxy?

Approach: I routed TCP connections through a Rust SOCKS5 relay, with controls provided by a Java extension in Burp Suite.
Result: Inspect captured bytes, pause traffic in either direction, and resend data from Burp Suite. Source code and automated tests are available on GitHub.

View case study Source code

Architecture

Desktop application
Rust SOCKS5 relay
TCP target

Java Burp extension · WebSocket + Protobuf

What an assessment includes

A clear scope, findings your team can verify, and practical advice on what to fix.

Scope and coverage

The applications, features and boundaries covered, with any testing limitations made clear.

Steps to reproduce

Requests, responses, screenshots and notes that help another engineer verify the issue.

Findings and fixes

An explanation of the issue, its impact and affected behavior, followed by practical recommendations.

Contact

Have a role or assessment in mind?

Tell me about the role, or the application and scope you need tested.

faqih@siberfaqih.com

View CV GitHub profile WhatsApp · +62 812-8472-3308 ↗

If we connected on Upwork, please keep pre-contract discussions there.