class SecurityResearcher:
def __init__(self):
self.name = "Muhammad Zaid"
self.alias = "Sudo-Zaid"
self.role = "Red Team · Web & API Penetration Tester"
self.education = "BS Computer Science — University of the Punjab"
self.certifications = ["CRTA", "APIsec Certified Practitioner (ACP)", "Google Cybersecurity",
"Cisco Ethical Hacker", "CEH (PMYDP)"]
self.ctf = ["CyberChess 2026 — 2nd International", "DayZer0 2026 — 1st Individual",
"HTB Cyber Apocalypse 2026 — 385th of 6,744"]
self.leadership = "Team Lead — IEEE CS Global Student Challenge 2026"
self.team = "Team WarGaye 🐐 (one-man CTF team)"
self.tools_built = 9 # open-source security tools
self.frameworks = ["OWASP Web/API Top 10", "MITRE ATT&CK", "PTES"]
self.open_to = "Junior Penetration Tester & security internships"
def mission(self):
return "Find and prove the bugs that matter — then build the tools to catch them."| Credential | Issuer |
|---|---|
| Certified Red Team Analyst (CRTA) | CyberWarFare Labs |
| APIsec Certified Practitioner (ACP) | APIsec University |
| API Penetration Testing | APIsec University |
| Google Cybersecurity Professional Certificate | Google (Coursera) |
| Ethical Hacker | Cisco Networking Academy |
| Certified Ethical Hacker (CEH) | PMYDP — Govt. of Pakistan |
| Program | Provider |
|---|---|
| Web Security Academy — 18/18 SQL Injection · 30 XSS labs | PortSwigger |
| CodeRed — SQLi · Android Bug Bounty · Cloud · Dark Web | EC-Council |
| Introduction to Cybersecurity | Cisco Networking Academy |
| Tool | What it does |
|---|---|
| advanced-api-attack-toolkit | Active API exploitation — GraphQL abuse, injection fuzzing (SQLi/NoSQLi/cmd/SSTI), mass assignment, data exposure |
| api-authz-fuzzer | High-speed access-matrix fuzzer for BOLA / BFLA and broken authentication |
| jwt-weakness-scanner | JWT auditor + attack-token forge (alg:none, weak-secret crack, RS256→HS256) |
| blindshot | Out-of-band payload generator for blind XSS, SSRF and XXE |
| cve-triage | Ranks vulnerabilities by exploitation evidence — CISA KEV + FIRST EPSS + your own asset inventory, not CVSS severity |
| redteam-report-generator | Turns a JSON or YAML engagement file into Markdown, HTML or PDF reports |
➡️ All 9 tools → github.com/Sudo-Zaid?tab=repositories
Web & API
Recon & Network
Red Team & AD
Passwords
Mobile
All results earned without teammates. Team WarGaye 🐐 is my one-man team.
| CTF | Result | Proof |
|---|---|---|
| CyberChess EA CTF 2026 | 🥈 2nd International · 4th of 96 overall · 49/49 · 3 first bloods | Writeups |
| DayZer0 / NCFA Freshers CTF 2026 | 🥇 1st Individual (4,125 pts) · 3rd overall | Writeups |
| HTB Cyber Apocalypse 2026 | 385th of 6,744 · 74/136 · 36,650 pts | Writeups |
| UND CyberHawks National CTF 2026 (Qualifiers) | 17th of 217 teams | Writeups |
| LITCTF 2026 | Global Top 30 | Writeups |
| HTB × Google Cold Room 2026 | 18/18 full clear · 351st of 1,716 | Writeups |
- 🐛 Intigriti 0926 Challenge — report accepted (writeup)
- 🐛 YesWeHack Dojo #55 — report accepted
- 🥇 TryHackMe — Top 2% globally
- 🧑💻 IEEE Global Student Challenge 2026 — Team Lead; taint-flow analyzer for GitHub Actions code-injection
