whoami

About

# profile

Offensive Security Engineer specializing in Web, Mobile, and API security, with a focus on Red Team operations and local network assessments.

I apply the attacker’s perspective I developed during my time as a Cyber Threat Intelligence Analyst at SOCRadar to professional offensive security engagements and adversary simulations.

Holding industry-leading certifications including OSCP+, OSWE, CRTO, eWPTXv2 and TSE, I actively contribute to the security community through vulnerability research and published CVEs. I am dedicated to uncovering security flaws and staying at the forefront of emerging exploit techniques to enhance defensive resilience.

# certifications

CRTO

Red Team Operator (CRTO)

2026

OSCP+

OffSec Certified Professional+ (OSCP+)

2026

OSWE

OffSec Web Expert (OSWE)

2024

TSE

Sertifikalı Sızma Testi Uzmanı

2026

eWPTXv2

eWPTXv2 (Web application Penetration Tester eXtreme)

2024

Bug Hunter

2024

Web Application Pentester

2024

# profiles

linkedin.com/in/ali-iltizar HackTheBox: 1500810 TryHackMe: iltosec github.com/iltosec medium.com/@alii76tt youtube.com/@alii76tt

# experience

Offensive Security Engineer

LoreSecurity

Jul 2025 — Present

Performed web, API, mobile & network pentests; AD and cloud (AWS/Azure) assessments.
Conducted full-scope red team ops including phishing campaigns and adversary simulations.
Delivered technical and executive-level reports with remediation recommendations.

Red Team Member

Synack Red Team

Feb 2025 — Present

Penetration Tester

LoreSecurity

Jan 2024 — Jul 2025

Executed black/grey-box web & API pentests; automated recon/exploitation with Python & Burp Suite
Collaborated with development teams to validate patches and retest fixed vulnerabilities

Cyber Threat Intelligence Analyst

SOCRadar® Cyber Intelligence Inc.

Oct 2022 — Dec 2023

Monitored dark web forums, leak sites and underground markets for threat actor activity
Tracked TTPs (MITRE ATT&CK), performed OSINT investigations and produced client intelligence reports

Cyber Threat Intelligence Intern

SOCRadar® Cyber Intelligence Inc.

Jul 2022 — Sep 2022

·Learned dark web OSINT methodologies and threat actor profiling techniques.

Cyber Security Specialist Intern

İsteCenter

Jul 2022 — Sep 2022

·Supported the development team in building a DLP (Data Loss Prevention) web application using Django, contributing to back-end logic and security controls.
·Collaborated with teammates on security feature implementation and vulnerability testing of the internal platform.

# vulnerability research

view all ›

CVEs
disclosed

CVE-2026-41209: Stored Cross-Site Scripting (XSS) in Online Payment Settings Medium / 4.8

The application is vulnerable to Stored Cross-Site Scripting (XSS) via the Stripe and PayPal configuration fields. Due to a lack of input sanitization and output encoding, an attacker can inject malicious JavaScript into the settings. This script is stored in the database and executed every time an administrator visits the Online Payment settings page, potentially leading to administrative session hijacking.

Advisory vendor patch

2026-09-25

CVE-2026-58409: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload in ChurchCRM Critical / 9.1

An authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. Because php is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI.

writeup Advisory vendor patch

2026-06-18

CVE-2026-53767: Missing File Extension Validation in `admin_update_upload()` Critical / 9.1

The admin_update_upload() handler overwrites an existing file with newly uploaded content without validating the uploaded file's type or extension against the upload whitelist. The upload_tester() helper only checks the PHP upload error code and the file size — it does not enforce an extension allowlist. Additionally, files in the current uploads_path directory can be listed and downloaded via the admin panel, exposing application internals when the path is redirected to a sensitive directory.

writeup Advisory fix commit vendor patch

2026-06-11

CVE-2026-53768: Incomplete Directory Blocklist in uploads_path Validation Allows Access to Sensitive Application Files High / 8.7

An authenticated administrator can set the uploads_path setting to a sensitive application directory (e.g. tools/) because the directory blocklist used to validate the path is incomplete. This allows the application's upload directory to be pointed at directories that contain executable PHP files.

writeup Advisory fix commit vendor patch

2026-06-11

CVE-2026-64690: Broken access control: media "read" permission grants full file write and delete Medium / 5.5

The elFinder connector endpoint backend/media/elfinderConnection is authorized with only the media "read" permission, but it processes every file operation (upload, rename, delete, mkdir, move) through the elFinder protocol. As a result, a user who was granted read-only access to the media library can create, rename, and delete files in the web-served public/media directory.

Advisory fix commit vendor patch

2026-06-10

CVE-2026-64689: Unsafe Reflection in dashboard widget `data_source` discloses all password hashes High / 8.8

The dashboard-widget feature stores a user-supplied data_source string and later executes it as new $class() followed by $obj->$method(), splitting the value on ::. The field is persisted from the request with no validation, so a low-privileged backend user who can manage widgets controls both the class that is instantiated and the (zero-argument) method that is invoked, and the return value is rendered back to them.

Advisory vendor patch

2026-06-09

CVE-2026-64687: Stored XSS to Admin Account Takeover via Pages Cover Image URL Field High / 8.0

A stored Cross-Site Scripting (XSS) vulnerability exists in the back-office Cover Image URL field (pageimg) of the Pages module. The server-side validation only blocks the chara...

Advisory fix commit vendor patch

2026-06-08

CVE-2026-64688: Remote Code Execution via template-function parsing in page content Critical / 10.0

A PHP code-injection flaw in App\Libraries\CommonLibrary::parseInTextFunctions() lets a backend user who can edit page content turn that content into an arbitrary PHP static-method call. Because the parsed page body is rendered on every public page view, the call is triggered by any visitor (no authentication required). By targeting the static method elFinder::procExec() (autoloadable via the bundled studio-42/elfinder Composer classmap, which passes its first argument straight to proc_open()), an attacker achieves Remote Code Execution as the web-server user. No source-code modification is required to exploit this.

Advisory vendor patch

2026-06-08

CVE-2026-54597: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter High / 8.3

The share_generate_link handler inserts the expires GET parameter directly into a MySQL INTERVAL expression without quoting it. sanitizeInput() escapes quote characters via mysqli_real_escape_string(), which is only effective in string contexts. The INTERVAL unit position is a raw SQL expression context where no quoting occurs, so the escape is bypassed entirely. Any authenticated user with module_support write permission can perform time-based blind SQL injection to read any data from the database.

writeup Advisory fix commit vendor patch

2026-06-06

CVE-2026-54596: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration High / 8.1

An SQL injection vulnerability in ITFlow's recurring invoice creation endpoint allows any authenticated user with the Technician role to exfiltrate arbitrary data from the database. A Technician who has access to at least one client invoice can extract admin password hashes, SMTP credentials, and all user account data in a single HTTP request -without any admin interaction.

writeup Advisory fix commit vendor patch

2026-06-06

CVE-2026-48493: Privilege Escalation via Insufficient Permission Validation in User Update API - Snipe-IT Medium / 5.5

Snipe-IT's user update API endpoint (PATCH /api/v1/users/{id}) does not sufficiently validate the permissions payload submitted by authenticated users. The PreserveUnauthorizedPrivilegedPermissionsAction class only strips superuser and admin flags from incoming requests; all other module-level permissions (e.g., assets.delete, licenses.keys, users.delete) pass through without any restriction or ownership ceiling validation. This allows an authenticated attacker with limited privileges (such as users.edit) to escalate their privileges vertically and perform unauthorized actions across the system.

writeup Advisory fix commit vendor patch

2026-05-28

CVE-2026-48492: User Account Enumeration by Authenticated Users with No Permissions - Snipe-IT Low / 3.3

The GET /api/v1/users/selectlist endpoint is missing the view.selectlists authorization check present in all other selectlist controllers. Any authenticated user with zero permissions can enumerate all user accounts, harvest usernames, full names, employee numbers, and perform indirect email enumeration via the search parameter.

writeup Advisory fix commit vendor patch

2026-05-21

CVE-2026-55476: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter - Snipe-IT Medium / 6.5

The route POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.

writeup Advisory vendor patch

2026-05-21

CVE-2026-55464: Stored XSS via Markdown custom field - Snipe-IT Medium / 6.4

CommonMark is configured with html_input => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.

Advisory vendor patch

2026-05-21

CVE-2024-11406: Stored XSS Vulnerability in Django CMS 3.0.0 (Attributes Fields) Medium / 6.9

The vulnerability resides in the Django CMS admin panel under the Page Editing interface, specifically when utilizing the "Add plugin to placeholder 'Page Content'" feature. Malicious payloads can be injected into the "Attributes" field of plugins like "card" or "badge," leading to Stored XSS attacks.

Advisory fix commit vendor patch

2024-11-20

CVE-2024-11404 - File Upload Bypass Vulnerability in Django Filer 3.2.3 Medium / 5.5

The vulnerabilities were identified in django-filer 3.2.3, a file management application commonly used with django CMS. These issues allow attackers to bypass upload restrictions for HTML and SVG files, potentially uploading malicious files containing scripts that execute on the client side.

writeup Advisory vendor patch

2024-11-20

CVE-2024-11319: Stored XSS Vulnerability in Django CMS 4.1.3 Medium / 4.8

Django CMS version 4.1.3 is affected by a stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject arbitrary JavaScript code that is executed in the context of the web application, potentially compromising the safety of all users visiting the affected page.

writeup Advisory fix commit vendor patch

2024-11-18

# education

Akdeniz University

Management Information Systems

2019 — 2023