Abdelilah Elkhaoudari

Cybersecurity Researcher · Offensive Security · Penetration Testing · Marrakech, Morocco

Aspiring offensive security engineer with a foundation in IT infrastructure, network administration and penetration testing. My work covers pentest labs, CTF competitions, vulnerability research and security tooling.

My focus is web application penetration testing, API security, network security, infrastructure assessment and vulnerability research. I want to understand why systems fail, because that is how you build ones that stay secure. My goal is to run thorough security assessments, find vulnerabilities, build custom security tools and contribute to the community.

Featured Projects

RedBase

Web & API offensive security payload repository

A structured, evolving research project that centralizes, organizes, validates and documents offensive payloads and testing techniques. It organizes techniques by vulnerability category, documents Web and API attack vectors, and includes automated payload validation plus indexing and generation utilities.

Python, JSON, Git

Jigsaw CTF

CTF platform & security challenge development

An independent project to build a practical CTF environment with custom challenges that simulate real-world vulnerabilities: web exploitation, SQL injection, IDOR, local file inclusion and command injection. Challenges are Flask apps deployed in Docker containers.

Python, Flask, Docker, Linux, Next.js

ReconnaisSaW concept

Automated reconnaissance & OSINT platform

A project concept for a reconnaissance platform for researchers and pentesters: automated workflows, subdomain enumeration, HTTP service discovery, technology fingerprinting, endpoint collection, attack surface visualization and integration with existing recon tools.

Python, Linux, OSINT tools

Python Security Tools

Custom scripts for web security testing

An IDOR scanner for spotting insecure direct object references, an HTTP header testing tool that checks behavior under modified forwarding headers, an educational hash-cracking utility, and automation scripts for repetitive recon and assessment tasks.

Python, Requests, HTTP

CVE Research & PoC Development

Root causes, exploitation conditions, mitigations

Independent analysis of publicly documented vulnerabilities: reproducing them in controlled environments, writing Python proof-of-concepts, documenting the exploitation methodology and studying patches and mitigations.

Vulnerability research

Digital Forensics & Network Analysis

Hands-on forensic challenges

PCAP traffic investigation with Wireshark and TShark, memory analysis with Volatility, metadata extraction with ExifTool, audio forensics and network protocol analysis.

Wireshark, Volatility, ExifTool

Technical Expertise

Offensive security & penetration testing

Web application and API security assessment, authentication and authorization testing, SQL injection, XSS, SSRF, IDOR, local file inclusion, command injection, path traversal, security misconfiguration, vulnerability assessment, and basic Active Directory security testing.

Network & infrastructure security

TCP/IP networking, network enumeration, service discovery, Linux and Windows administration, SSH and remote server management, firewall configuration, traffic analysis, infrastructure hardening, virtualization and containers.

Security research & reconnaissance

Attack surface discovery, OSINT, subdomain enumeration, directory and endpoint discovery, technology fingerprinting, CVE analysis, HTTP request analysis and security testing automation.

Programming & scripting

Python for security automation and tooling, C / C++, PHP, Bash, SQL, and HTML / CSS / JavaScript fundamentals.

Tools

Penetration testing: Burp Suite Nmap Metasploit Gobuster FFUF Hydra SQLmap

Reconnaissance: Amass HTTPX GAU Waybackurls Shodan Nuclei

Forensics: Volatility Wireshark TShark ExifTool

Infrastructure: Linux Docker Podman WSL Nginx SSH Git

Development: Python Flask PHP MySQL Oracle Database Next.js

Certifications & Learning

CPTS

Hack The Box Certified Penetration Testing Specialist

A hands-on penetration testing certification covering the full engagement workflow, from enumeration and exploitation to post-exploitation and reporting.

CRTP

Certified Red Team Professional · Altered Security

A hands-on certification focused on attacking and enumerating Active Directory environments, including privilege escalation, lateral movement and trust abuse.

eJPT v2

eLearnSecurity Junior Penetration Tester

A practical certification covering network enumeration, host discovery, vulnerability identification, exploitation fundamentals, web application security and penetration testing methodology.

Cisco Networking Academy

Ethical Hacker · Networking Basics · Introduction to Cybersecurity
Ongoing practice
  • PortSwigger Web Security Academy: SQL injection and authentication labs
  • TryHackMe: hands-on pentesting and security challenges
  • Hack The Box: practical offensive security training
  • PicoCTF: security challenges and problem-solving
  • CVE analysis and independent security tool development

Education

École Marocaine des Sciences de l'Ingénieur (EMSI)

Engineering studies: Infrastructure Informatique et Réseaux (IIR)

Currently enrolled. Academic interests: computer networks, information systems, infrastructure architecture, cybersecurity, network administration and information security.

Expected graduation 2029

OFPPT: Digital Infrastructure

Technicien Spécialisé, Cybersecurity option

Foundations in network administration, Linux and system administration, network infrastructure, cybersecurity fundamentals and information technology.

Lab & Research

Technical environment

I run practical labs to experiment with infrastructure and security tooling. They include Ubuntu, Kali, Windows and Debian-based systems, Linux VPS administration over SSH, Nginx, Docker and Podman, virtual machines, intentionally vulnerable Dockerized applications, and custom Python security scripts alongside Burp Suite, Metasploit, Nmap and Wireshark.

Current research interests
  • Advanced web application penetration testing
  • API security and authorization mechanisms
  • Active Directory security
  • Vulnerability research, CVE analysis and bug bounty methodology
  • Automated attack surface discovery and offensive security automation
  • Linux and infrastructure security
  • Security tool development, digital forensics and incident investigation
Think like an attacker. Build like a defender.

Security takes curiosity, analytical thinking and persistence, not just tools. I understand how systems and protocols work, investigate weaknesses and their root causes, and build tools that automate the work and improve shared knowledge.

Contact

Open to collaboration on cybersecurity research, web application security, penetration testing, vulnerability research, open-source security projects and CTF challenge development.

github.com/elkhaoudari

Marrakech, Morocco