Chowdhury
Faizal Ahammed
Senior Cloud IAM Engineer at Synchrony Financial.
Building secure systems by knowing exactly how they break.
About Me
Breaking things to make them stronger
I'm a 24-year-old security enthusiast who's been breaking things since my teens. With 7+ years in offensive security, I've evolved from curious script kiddie to a seasoned penetration tester and cloud security architect.
Currently serving as a Senior Cloud IAM Engineer at Synchrony Financial, I architect enterprise-scale identity and access management solutions while maintaining my offensive edge through red teaming and bug bounty hunting.
I hold multiple CVEs across SSRF, RCE, IDOR, and XSS vulnerability classes, and I've competed in CTFs at both national and international levels. My unique blend of offensive security and cloud engineering gives me an attacker's perspective on defense — I build secure systems because I know exactly how they break.
CVE Discoveries
Vulnerabilities responsibly disclosed across SSRF, RCE, IDOR, and XSS classes
Cross-Site Scripting vulnerability due to improper sanitization of plugin settings. Allows high-privilege users to inject malicious scripts even when unfiltered_html is disabled. Affects versions before 1.0.4.
View AdvisoryAuthenticated Remote Code Execution vulnerability in PluXml CMS version 5.8.22. Allows administrators to inject malicious PHP webshells into theme files such as home.php via improper neutralization of special elements.
View AdvisoryAuthenticated RCE through Twig Server-Side Template Injection (SSTI) in Craft CMS. Exploitable via the Twig map filter in text fields under Settings or through the System Messages utility. Requires admin access and allowAdminChanges enabled.
View AdvisoryRemote Code Execution vulnerability in Craft CMS via the assembleLayoutFromPost() function in Fields.php. Fails to sanitize user-supplied configuration data before passing to Craft::createObject(), allowing authenticated administrators to inject malicious Yii2 behavior configurations for arbitrary command execution.
View AdvisoryServer-Side Request Forgery protection bypass in Craft CMS GraphQL Asset mutation. The SSRF validation uses gethostbyname() which only resolves IPv4. Hostnames with only AAAA (IPv6) records return the hostname itself, bypassing the blocklist completely.
View AdvisoryTime-of-Check-Time-of-Use (TOCTOU) vulnerability enabling DNS rebinding attacks. Allows attackers to bypass SSRF protections by returning different IP addresses during validation vs actual request. Bypasses CVE-2025-68437 fix, granting access to all blocked IPs.
View AdvisoryUnauthenticated users can access the actionSendActivationEmail() endpoint without permission checks for pending users. Attackers can trigger activation emails for any pending user account by knowing/guessing a user ID, potentially leading to unauthorized account activation.
View AdvisoryRemote Code Execution vulnerability via the Twig map filter in text fields accepting Twig input. Exploitable through Settings in Craft control panel or the System Messages utility. Requires admin access with allowAdminChanges enabled, or non-admin access to System Messages.
View AdvisoryInsecure Direct Object Reference (IDOR) vulnerability in Craft Commerce's cart functionality. Allows users to hijack any shopping cart by knowing or guessing its 32-character number, enabling takeover of shopping sessions and potential PII exposure. No ownership validation is performed - the CartController only checks if the order exists and is incomplete.
View AdvisoryCertifications
Validated offensive security expertise
CTF Achievements
National and international competition wins
Arsenal
Languages, tools, and techniques in the toolkit
Open Source
Security tools built and released for the community
ADCSDumper
Active Directory Certificate Services enumeration and exploitation tool for red team operations.
catrole
AWS IAM role enumeration and privilege escalation discovery tool for cloud security assessments.
tfswitch
Terraform version manager for seamless switching between Terraform versions in your workflow.