Skip to content
View xaferima's full-sized avatar
🎯
Focusing
🎯
Focusing
4 followers · 1 following

Achievements

Achievement: Starstruck

Achievements

Achievement: Starstruck

Block or report xaferima

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
xaferima/README.md
xaferima@kali terminal Typing SVG divider

🪪 Offensive Security Expert | Ex-CERN Security Engineer | MSc Cyber Security (Distinction), University of Birmingham

10+ years breaking web, API, mobile & cloud ☁️🔓 Business logic flaws, authN/authZ weaknesses & high-risk flows 🔍 KYC / biometric security research 🧬 Turning findings into remediation that engineering teams actually ship 🛠️

🌐 Find me on

LinkedIn Twitter Medium Email

Website Security Reports

divider

🎤 Speaking

🎤 Event Talk Location Year
🔴 DEF CON 34 Your APP Thinks I'm You: A Complete Kill Chain Against Mobile App Security Las Vegas, USA 2026
🔴 BSides Colombia Your Brain > Your Toolkit: Real Bugs, Zero Code, Zero Tools Colombia 2026
🔴 PWN OR DIE Frustration Kill Chain: un framework para depurar rechazo en seguridad ofensiva Ecuador 2026
🔴 PWN OR DIE When Your Mind Becomes the Exploit: No Code, No Tools Ecuador 2025
divider

🔒 CVEs

CVE / GHSA Project CVSS CWE Status
CVE-2026-105080 C4illin/ConvertX v0.18.0 9.9 CRITICAL CWE-94: Improper Control of Generation of Code ("Code Injection") ✅ Fixed in v0.19.0
GHSA-h2cv-65fq-jgrp · CVE pending mikefarah/yq ≤4.54.1 7.8 HIGH CWE-78: OS Command Injection ✅ Fixed in v4.54.2
GHSA-w2hj-54mc-76r4 · CVE pending pdfcpu/pdfcpu v0.15.0 7.5 HIGH CWE-190: Integer Overflow or Wraparound ✅ Fixed in v0.16.0
GHSA-9c7h-xjrp-8gh3 · CVE pending snapotter-hq/SnapOtter ≤ 2.2.0 7.1 HIGH CWE-79: Cross-site Scripting (XSS) ✅ Fixed in v2.3.0
GHSA-fjh6-rrhv-4g63 · CVE pending pdfcpu/pdfcpu v0.15.0 6.5 MEDIUM CWE-770: Allocation of Resources Without Limits or Throttling ✅ Fixed in v0.16.0
GHSA-6524-w46v-6399 · CVE pending pdfcpu/pdfcpu v0.15.0 6.5 MEDIUM CWE-129: Improper Validation of Array Index ✅ Fixed in v0.16.1
GHSA-g766-88fx-58h8 · CVE pending pdfcpu/pdfcpu v0.15.0 5.9 MEDIUM CWE-190: Integer Overflow or Wraparound ✅ Fixed in v0.16.0

6 GHSA advisories published; CVE assignment pending. Technical writeups →

divider

🏆 Certifications

CEH Master eJPT CAPIPEN CMPen-Android CRTeamer

divider

💻 Tech Stack

Offensive Security
Burp Suite Frida Nmap Metasploit SQLmap

Mobile & RE
Android JADX MobSF

Cloud & Scripting
AWS Python Bash

Environment
Linux Kali Linux Docker

AI-Augmented Security
Ollama Strix OWASP LLM Top 10

divider profile views

Pinned Loading

  1. API-Pentesting-Checklist API-Pentesting-Checklist Public

    API-Pentesting-Checklist

    33 11

  2. Mobile-App-KYC-Pentesting-Checklist Mobile-App-KYC-Pentesting-Checklist Public

    Mobile application (Android & iOS) — Facial Liveness & Biometric Identity Verification

    11 1

  3. Certified-Ethical-Hacking-Practical-Tools Certified-Ethical-Hacking-Practical-Tools Public

    Certified Ethical Hacker Tools for Practical

    5 4

  4. C-APIPEN-NOTES C-APIPEN-NOTES Public

    Repository of technical notes, research, and findings focused on API security analysis within the C-APIPEN context.

    Python