// OFFENSIVE SECURITY · PARIS

Hamza
Terir

Security Expert / Penetration Tester & Offensive Security Researcher · OSCP · CRTP

I break systems most testers never touch, from the web to Active Directory, from medical firmware to LLMs, and prove it with working PoCs.

Currently available: CDI pentester · Freelance/contract · Immediate availability
  • OSCP · CRTPcertifications
  • 79findings · 2026
  • 14critical findings · 2026
  • 35+companies · SMBs to large groups
  • 6documented 2025 groups

Paris · FR / EN / ES / DE · Web · AD · IoT/OT · Medical · AI/LLM · Red Team

View selected work↓ Download CV (PDF)Get in touch
01 · PENTEST
web · AD · IoT/OT · medical
Manual-first intrusion testing, foothold to impact, black/grey/white-box.
02 · REVERSE ENGINEERING
firmware · binaries · protocols
Ghidra, x86-64, symbol/type recovery, exploit-primitive development.
03 · COMPLIANCE
CRA · EN 18031 · IEC 62443
Product & industrial cybersecurity, regulatory gap analysis.
04 · RED TEAM
maldev · EDR evasion · C2
Adversary emulation with purple-team debriefs.
scroll ↓   switch expertise block
OSCP · CRTP

Professional certifications

0

Client findings 2026

0

Critical findings · 2026

0+

Companies served · SMBs to large groups

// PROFILE

Breadth is the differentiator.

I specialize in critical-infrastructure security assessments under IEC 62443, EN 18031, and CRA compliance regimes. Web, Active Directory, OT/SCADA, medical devices and LLM attack surfaces: 79 findings across 2026 (14 critical), all with working PoCs. Certified OSCP/CRTP, ANSSI CSPN-qualified evaluator.

Hiring / Engagement Preferences

  • CDI: pentester (web, infra, AD, red team), Paris/hybrid
  • Contract/B2B: pentest web/infra/AD, red team ops, RF/WiFi/wireless
  • Red team engagement: authorized scope, proof-of-concept focus
  • Type preferred: infrastructure-critical, regulatory-grade targets
  • Availability: Immediate

Regulated Assessment Experience

  • ANSSI CSPN product evaluations
  • EN 18031 / CRA readiness assessments
  • IEC 62443 IACS/SCADA security (SIL 2–3)
  • FDA medical device audits (ISO 14971, IEC 62304)

// ATTACK SURFACE

What I attack

Web & AppSec

Manual-first testing of web apps and APIs: auth/session/OAuth flows, injection chains (SQLi, SSTI, XXE, SSRF), access-control and business-logic abuse. Black/grey/white-box, incl. source and dependency audits.

  • Burp Suite Pro
  • OWASP WSTG
  • Nuclei

Active Directory

From foothold to domain dominance: Kerberos abuse, ACL misconfiguration chains, credential relay and coercion, then CIS-based hardening to close the paths.

  • BloodHound
  • Rubeus
  • Impacket
  • PingCastle

IoT / OT / ICS & Embedded

Black/grey/white-box assessments of OT/SCADA gateways and connected products. UART, I2C, RS232, USB, interception, fuzzing, frame injection; firmware reverse engineering and U-Boot/HAB exploitation.

  • IEC 62443
  • Ghidra
  • UART/I2C/JTAG
  • U-Boot

Medical Devices

Security audits under regulatory constraints (FDA): RS232 interface audit of a patient monitor, firmware RE, gap analysis against ISO 14971 / IEC 62304 / IEC 81001-5-1.

  • FDA
  • ISO 14971
  • IEC 62304

AI & LLM Security

Attacking chatbots per OWASP LLM/GenAI: prompt injection, guardrail bypass, system-prompt leakage, MCP protocol security. Local LLM lab for fine-tuning and evaluation harnesses.

  • OWASP LLM
  • Prompt Injection
  • MCP

Red Team & EDR Evasion

Malware development (Python / C# / ASM), indirect syscalls and process injection, EPP/EDR bypass research. Every tool ships with a purple-team debrief so defenders can build detections.

  • Havoc
  • Covenant
  • Syscalls

Reverse & Firmware

Taking binaries and firmware apart: static analysis (Ghidra), symbol/type recovery, protocol reverse engineering and exploit-primitive development, backed by x86-64 assembly.

  • Ghidra
  • x86-64 ASM
  • binwalk

// FIELD NOTES · ANONYMIZED

Selected work

Real findings, sanitized for public disclosure. Detailed case studies and reports available on request. Browse the 2025-2026 findings summary.

Mobile secrets to full ATO chain

Critical

Sanitized 2026 client finding: mobile secrets, cloud access and weak backend authorization combined into a cross-system account takeover path.

  • 2026
  • Mobile
  • Firebase
  • ATO
Read the write-up

Cross-domain IDOR at scale

Critical

Authenticated API authorization failed across domains, exposing user, employee and document records through predictable object identifiers.

  • 2026
  • API
  • IDOR
  • BOLA
Read the write-up

Unsigned EVSE firmware

Critical

Charging-station firmware accepted an engineering-grade update path without a complete authenticity and integrity chain.

  • 2026
  • Embedded
  • Secure Boot
  • EN 18031
Read the write-up

Open JTAG and privileged control plane

Critical

Hardware debug access and unauthenticated control commands combined into a firmware reprogramming and device-control risk.

  • 2026
  • JTAG
  • Embedded
  • Protocol
Read the write-up

Medical kiosk boundary escape

Medium

A physical authenticated workflow escaped its kiosk boundary while a token parser processed data before signature verification.

  • 2026
  • Medical
  • Kiosk
  • Deserialization
Read the write-up

Unauthenticated DICOM parser DoS

Critical

2025 medical-device finding: unauthenticated DICOM processing accepted deeply nested sequences without an effective parser-depth limit.

  • 2025
  • Medical
  • DICOM
  • DoS
Read the write-up

AdminSDHolder persistence path

Critical

2025 Active Directory finding: excessive rights on a protected directory object created a persistence and domain-escalation path.

  • 2025
  • Active Directory
  • Persistence
Read the write-up

U-Boot / HAB bypass to RCE

High

Boot-process abuse on an embedded product: Secure Boot (HAB) verification bypassed via init override, leading to unauthenticated command execution. Fixed after coordinated disclosure.

  • Embedded
  • Secure Boot
  • RCE
Read the write-up

SAML replay to auth bypass

Critical

A replayed SAML assertion accepted by the IdP plugin defeats authentication entirely: full account takeover without credentials on a production SSO flow.

  • Web
  • SAML
  • Auth Bypass
Read the write-up

// SECTORS ASSESSED

Delivered across critical sectors

Client work from 2025–2026, anonymised: organisations are never named.

  • Energy & utilitiesCritical infrastructure · OT/SCADA
  • Banking & financeWeb, API and identity
  • Healthcare & medical devicesEmbedded · safety-critical
  • Industry & manufacturingICS · access control
  • Transport & mobilityConnected fleets · telemetry
  • Software & SaaSWeb, API · OWASP Top 10
  • IoT, embedded & RFFirmware · JTAG · wireless
  • Directory & cloudActive Directory · hybrid

Client engagements delivered under NDA — organisations are never named.

// HOW I WORK

Methodology

  1. 01

    Recon & surface

    Map the real attack surface before touching anything: assets, versions, trust boundaries.

  2. 02

    Prove with PoC

    Findings are demonstrated with working proof-of-concept, never speculation.

  3. 03

    Business impact

    Translate the bug into what it costs the target: data, access, money, downtime.

  4. 04

    Report

    Clear, reproducible reporting sized for both engineers and decision-makers.

  5. 05

    Detection handoff

    SIEM detection rules (Elastic/Kibana) and purple-team debrief so defenders can catch it next time.

// PRIVATE LAB

Research & lab

Offensive research built and tested inside controlled lab environments, never against third parties.

AI / LLM

Local LLM security lab

Large local-model lab covering inference engines, deployment, quantization, optimization, fine-tuning, benchmarking, evaluation harnesses and agent/tool workflows for AI vulnerability research.

AI / LLM

Kairos - decision model

Apache-2.0 decision fine-tune (0.3B, on Laya-multilingual): zero-generation decision scoring and semantic routing with dynamic criteria; cascade deployment accepts high-margin calls in ~8 ms and escalates ambiguous ones to larger models.

View the model ↗
Red Team

Offensive tooling (private lab)

C2 server & implants, Windows DLL injector, x86-64 shellcode packer/crypter, defense-evasion research.

ExploitDev

Public exploits

Exploit development for published CVEs, CVE-2025-52970 and CVE-2021-40444, released on GitHub.

Vulnerability Research

CVE-2026-86950 · Apple CoreGraphics Integer Overflow

Technical study of an integer-overflow issue affecting Apple iOS and macOS. The public advisory classifies the CVE impact as an out-of-bounds write.

Read the technical study →
Tooling

GitHarvest3r

Recon tooling for source and secret discovery, plus custom Nuclei templates derived from real findings.

Read the technical study →
Metasploit · Ruby · 2021

Microsoft Office Word MSHTML RCE (2021)

Ruby exploit for Metasploit targeting a Microsoft Office Word MSHTML remote-code-execution issue.

Read the technical study →
Bounty

Bug bounty

Continuous vulnerability-research methodology on HackerOne and YesWeHack.

AI Security

AI security research

Prompt and indirect injection, system-prompt leakage, guardrail bypass, unsafe tool use, data exfiltration and MCP/agent security studies.

Speaking

Talks & training

Internal/external talks: Android banking-malware RE, LLM pentesting, EN 18031 and the CRA transition.

// CAREER

Modern offensive security, built in the field.

From hands-on penetration testing to AI-augmented research: local models and reproducible evaluations extend the toolkit, while IEC 62443 grounds industrial OT/ICS work in the realities of control systems.

  1. Mar 2025 - Present

    BYCYB (ex CRYPTON.IT, filiale LNE)

    Security Expert / Penetration Tester · Industrial OT/ICS & IEC 62443 · Paris

    Modern offensive security across web/API, Active Directory, mobile, embedded and medical systems. Combine hands-on testing with local-LLM R&D: inference engines, model optimization, fine-tuning, benchmarking and repeatable evaluation of LLM, agent and MCP attack surfaces. Apply IEC 62443 expertise to IACS/OT/SCADA assessments alongside ANSSI CSPN and EN 18031 / CRA work.

  2. Mar 2025 - Jul 2025

    CRYPTON.IT

    Security Expert / Penetration Tester · Cybersecurity consulting · Paris

    Cybersecurity consulting across web/API, Active Directory and embedded systems: black/grey-box testing, custom Python exploit development and structured reporting. The team rebranded as BYCYB in August 2025.

  3. Sep 2021 - Jul 2024

    Département des Hautes-Alpes

    Apprentice Penetration Tester · Gap

    Built practical offensive-security foundations through web and Active Directory testing, custom exploit/tool development, internal vulnerability research, authorized physical red-team exercises, malware analysis and EDR validation.

  4. 2021 - 2024

    ESEE-IT (Paris)

    Cybersecurity Engineering & Management (Master's level)

    Preceded by a two-year degree (BTS) in Digital Systems, Electronics & Communications.

// CREDENTIALS

Certifications

Verify credential ↗View certificate image ↗

OSCP

Offensive Security Certified Professional - 2024

Verify credential ↗View certificate image ↗

CRTP

Certified Red Team Professional - 2025

Red Hat

System Administration II & III - 2022

PentesterLab

HTTP · Essential · White · Blue · Serialize - 2023

// SECURE CHANNEL

Hiring, an engagement, or research to compare notes on?

ContactRead the write-ups