Web & API Security
Web application and API penetration testing, business-logic validation, authentication and authorization review.
- Burp Suite
- OWASP ZAP
- SAST / DAST
- Secure coding review
OPEN TO SECURITY ENGAGEMENTS
VAPT SPECIALIST · OFFENSIVE SECURITY · SECURITY ENGINEERING
Breaking attack paths. Strengthening real systems.
Cybersecurity professional focused on penetration testing, vulnerability analysis, network security, application security, Active Directory assessments, cloud security and actionable remediation.
security.showreel
01
SECURITY // SHOWREEL
live security visual
VAPT // OFFSEC
$ whoami
hasnain_abbasi
$ cat focus.txt
web · api · mobile · network · ad · cloud
$ status
Available for selective engagements
$
6+Years in security
150+Projects / assessments
7Security credentials
360°App → infra coverage
01 // ABOUT
Security work that ends with a fix — not just a finding.
I work across application and infrastructure security, from web, API and mobile assessments to internal/external networks, Active Directory, cloud environments and SCADA testing.
My approach combines attacker-minded validation with practical reporting: understand the attack surface, reproduce impact, communicate risk clearly, and help teams prioritize remediation.
02 // EXPERTISE
Attack surface coverage.
Assessment areas drawn from hands-on professional work across applications, networks, identity, cloud and industrial environments.
Mobile Security
Android and iOS application assessments covering client behavior, APIs, session flows and sensitive-data exposure.
- Android
- iOS
- API validation
- Remediation guidance
Network & Active Directory
Internal and external network testing, infrastructure review and Active Directory / Azure AD security assessment.
- Nmap
- Metasploit
- AD / Azure AD
- Attack simulation
Cloud & Edge Security
Cloud security assessments, identity configuration review, perimeter controls and Cloudflare WAF/rule implementation.
- Cloud assessment
- IAM review
- WAF rules
- Configuration review
Detection & Compromise Assessment
Threat simulation, compromise assessment, root-cause analysis and validation of XDR/EDR controls.
- XDR / EDR
- Threat modelling
- Root cause analysis
- Blue-team collaboration
SCADA & Infrastructure
Security review of infrastructure and industrial environments, including network devices and SCADA assessment work.
- SCADA testing
- Firewall review
- Routers / switches
- Gap assessment
03 // EXPERIENCE
Professional timeline.
From application testing to team leadership and enterprise security assessment programs.
MAR 2025 — PRESENT
CURRENT
VAPT Specialist
Inbox Business Technologies Limited · Pakistan · Onsite
Penetration testing across web, mobile, desktop, APIs and networks; cloud and Active Directory assessments; technical gap reviews; network-device configuration review; vulnerability analysis and remediation support.
AUG 2024 — MAR 2025
Team Lead — Cybersecurity Department
ACE Money Transfer · Pakistan · Onsite
Led penetration testing and red-team activity across applications, networks and Active Directory; GRC assessments; firewall-rule management; XDR/EDR operations; security simulations and cross-team defense improvements.
MAY 2022 — 2024
Team Lead — Offensive Security
Apprise Cyber PVT LTD · Pakistan · Onsite
Web, API and mobile testing; threat modelling; internal/external network penetration testing; incident-response collaboration; advanced assessment execution and developer-focused reporting.
2021 — 2022
Senior Penetration Tester
RS Softwire (SMC-Pvt) Ltd · Pakistan · Hybrid
Application and infrastructure testing, methodology development, tool selection/customization, firewall and access-control validation, and vulnerability research including common web attack classes.
2020 — 2021
Penetration Tester
Code Avenue · Pakistan · Remote
Targeted web and mobile assessments, security validation of mobile APIs, actionable reporting, and developer collaboration on secure coding practices.
JAN — MAY 2020
VDP Engineer & Penetration Tester
Whooing · Korea · Remote
Vulnerability disclosure program support, report validation, researcher coordination, penetration-testing methodology, exploitation and remediation collaboration.
2020 — 2023Independent Penetration Tester
Freelance security engagements across web, API and mobile applications using tools including Burp Suite, OWASP ZAP, Nmap and Metasploit.
2020 — PRESENTBug Bounty Hunter
Ongoing vulnerability research with reported critical, high and medium severity findings on major bug-bounty platforms.
04 // CREDENTIALS
Security certifications.
Professional certifications covering practical penetration testing, network security, application security, API security and information-security management.
Practical Network Penetration Tester
TCM Security
eLearnSecurity Junior Penetration Tester
INE Security
Certified Network Security Practitioner
The SecOps Group
Certified AppSec Practitioner
The SecOps Group
Ethical Hacking Essential
The SecOps Group
Certified API Penetration Tester
APIsec University
ISO 27001
Skill Front
05 // SELECTED ENGAGEMENTS
150+ national & international projects.
A selection of organizations and assessment types listed in my professional résumé.
Karachi Shipyard & Engineering Works
Internal & infrastructure penetration testing
National Telecommunication Center
Cybersecurity assessment engagement
AlAmthal Finance
Security assessment · Saudi Arabia
National Insurance Company
Internal portal penetration testing
Lucky Core Industries
Internal infrastructure & external testing
HABIBMETRO
External web application penetration testing
BYKEA / ABHI / QisstPay / Caary
Android and iOS application penetration testing
SNGPL
SCADA penetration testing
06 // CONTACT
Have an assessment in mind?
For professional security engagements, consulting discussions or collaboration, send a concise description of your scope and preferred contact method.