Faraz Ahmed @PakCyberbot

What I do

I simulate real-world attackers end to end — from external enumeration and initial access through privilege escalation, lateral movement and reporting. I work comfortably across Linux, Windows and cloud, and I care as much about a clear, reproducible report as about the exploit itself.

• Full-scope penetration testing and adversary simulation
• Privilege escalation and Active Directory / cloud attack paths
• Clear, reproducible reporting (the reason OffSec awarded me a free OSCP)

Proof & verification

• OSCP credential (OffSec)
• TryHackMe Profile
• HackTheBox profile
• How I earned the OSCP

What I do

I hunt for impactful vulnerabilities in web and cloud applications — auth flaws, access-control issues, injection, SSRF and misconfigurations — and write them up so they can be reproduced and fixed.

• Web and API security testing
• Cloud misconfiguration review
• Responsible disclosure and clear proof-of-concept write-ups

Proof & verification

• BugCrowd
• Hackerone
• YesWeHack
• HackTheBox profile
• TryHackMe profile
• Recognitions and CVEs are listed on the Achievements page.

What I do

I run open-source intelligence investigations — people and infrastructure footprinting, verification and evidence collection — and I have both competed in and judged Trace Labs Search Party CTFs that support real missing-persons cases.

• OSINT collection, correlation and verification
• Trace Labs Search Party CTF participant and judge
• Tooling for evidence gathering and documentation

Proof & verification

• Trace Labs participation
• YT Evidence Collector (my OSINT tool)
• Private Investigator — TryHackMe
• OSINT DOJO Winner

What I do

I design and review secure cloud architectures and hunt for cloud misconfigurations — IAM, storage, network exposure and logging — with a focus on Google Cloud, where I hold the Professional Cloud Security Engineer certification.

• Cloud security architecture and hardening
• IAM and misconfiguration review
• Cloud incident-investigation challenges (e.g. my HTB “MisCloud” Sherlock)

Proof & verification

• Google Professional Cloud Security Engineer
• Google Cloud Skills Boost profile

What I do

I create practical cybersecurity content that turns real-world security concepts, research, and hands-on experience into challenges, labs, tutorials, and educational resources.

My work spans both technical challenge development and public cybersecurity education, with content designed to help security professionals, students, and enthusiasts understand how vulnerabilities and security concepts work in practice.

• CTF challenge and lab design across web, forensics, OSINT, cloud, and other security domains
• Realistic scenarios with intentional vulnerabilities, infrastructure, objectives, and solution paths
• Cybersecurity tutorials, technical walkthroughs, and research-based content
• YouTube videos covering penetration testing, cybersecurity tools, techniques, research, and practical security concepts
• Technical articles and write-ups published on Medium and other platforms
• Educational content focused on practical, hands-on security learning
• Content creation for HackTheBox, TryHackMe, onsite events, and organizations

Platforms & Publications

• HackTheBox — CTF challenges and Sherlocks
• TryHackMe — Hands-on rooms and cybersecurity learning content
• YouTube — Cybersecurity tutorials, research, tools, walkthroughs, and educational content
• Medium — Technical articles, research, write-ups, and cybersecurity learning resources
• Onsite Events & Organizations — Custom challenges, labs, and security-focused educational content

Proof & Verification

• MisCloud — HackTheBox Sherlock
• Fishy HTTP — HackTheBox
• Private Investigator — TryHackMe
• YouTube — PakCyberbot
• Medium — PakCyberbot
• Full list of selected work on my Work page.

What I do

I build tooling and automation for offensive security and day-to-day work, mainly in Python with Bash and PowerShell for scripting, plus general programming across several languages.

• Security tooling and automation (Python, Bash, PowerShell)
• Open-source projects for red teaming and OSINT
• Comfortable across multiple languages

Proof & verification

• GitHub profile
• fuzzy-httpserver
• HackerRank profile BEFORE AI