Skip to content
View usama0x01's full-sized avatar
:octocat:
:octocat:
15 followers · 29 following

Achievements

Achievement: Arctic Code Vault Contributor

Achievements

Achievement: Arctic Code Vault Contributor

Highlights

  • Pro

Block or report usama0x01

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
usama0x01/README.md

Usama Arshad

Offensive Security Lead · Red Team · Fintech & Cloud · Riyadh, Saudi Arabia

OSCP-certified offensive security leader with 9+ years across red team, AppSec, and cloud. Currently leading the offensive security function at Tabby — MENA's largest BNPL fintech (14M+ users).

Website LinkedIn X Medium Profile views

~/whoami

  • 🛡️ Leading offensive security at Tabby — red team, AppSec, and cloud security across web, mobile, API, GCP & GKE for 14M+ users.
  • 🎯 80+ engagements delivered for Fortune 500 and SAMA-regulated financial institutions.
  • 🔬 8 published CVEs — headlined by an unauthenticated admin-account takeover (CVE-2026-18786, CheckView, CVSS 8.8) and an unauthenticated database export (CVE-2026-18789, Ezoic, 7.5), back to CVE-2024-3681.
  • 🐛 Active WordPress plugin research — 59+ vulnerabilities reported to WPScan, 8 now with assigned CVE IDs, 121+ queued; peaked at 13th on the WPScan researcher leaderboard. Full log: usamaarshad.me/research.
  • 🏆 3× national CTF champion (Pakistan, 2021–2023) and 2× BlackHat MEA CTF finalist (2023, 2024).
  • 🎖️ Hall of Fame — United Nations, Walmart, Achmea, The Sun (responsible disclosure).
  • 🔴 Synack Red Team member · Bugcrowd researcher.

~/toolkit

Burp Suite Kubernetes GCP AWS Python Go GitLab CI Frida Ghidra

Red teaming · MITRE ATT&CK · C2 (Cobalt Strike / Sliver / Mythic) · Web · Mobile · API · Active Directory · Cloud & container security · DevSecOps · source-code review.

GitHub stats GitHub streak
Security research is a reporting discipline as much as a technical one — the exploit only matters if the business understands it.

Pinned Loading

  1. TIC-TAC-TOE-DECISION-TREE-MINIMAX TIC-TAC-TOE-DECISION-TREE-MINIMAX Public

    TIC TAC TAAC AI IN JAVAFX WITH THREE DIFFICULTY MODE(EASY, GREEDY , PERFECTAI) USING DECITION TREE AND MINIMAX

    Java 1

  2. apkpure-bulk-dl apkpure-bulk-dl Public

    Download multiple Android APK packages from APKPure in parallel

    Python 5

  3. BlackHatMEA_CTF2023_Writeups BlackHatMEA_CTF2023_Writeups Public

    Warm me up

  4. LIBRARY-MANAGEMENT-SYSTEM LIBRARY-MANAGEMENT-SYSTEM Public

    SIMPLE LIBRARY MANAGEMENT SYSTEM CODED IN C LANGUAGE

    C