Offensive Web Security Researcher
GitHub, GitLab, Python, Django, FastAPI(Starlette), Apache Airflow, Ruby, Ruby on Rails, Java Spring 보안 기여자

• DEF CON 33 CTF 결선 진출: 2016년부터 활동 중인 CTF 경쟁자(약 10년)

• 수상: 국방부 장관 표창(2024), 국가보안기술연구소장 표창(2022, 2021), 사이버작전사령관 표창(2019), 교육부 장관상(2018)

• Google, Naver 버그 바운티 명예의 전당 등재

• Web2 Infrastructure & Application Auditing

  • Conducted comprehensive security assessments on complex Web2 architectures, ranging from SaaS platforms to crypto-exchange infrastructures.

  • Performed manual source code review and grey-box testing to identify potential vulnerabilities (e.g., SQL Injection, Business Logic Flaws, Denial-of-service)

• Security Consulting & Risk Management

  • Collaborated directly with clients to define practical remediation strategies.

  • Advised on security trade-offs, balancing robust defense mechanisms with product usability and business operational requirements.

• Reviewing and addressing security vulnerabilities in Apache Airflow

• Collaborating with the open-source community

• Maintaining the security posture of the project in accordance with ASF guidelines

• Developed a multi-cloud security audit tool for Samsung Electronics to automate compliance checks across AWS, GCP, and Azure

  • Implemented 260+ security inspection checks (IAM, Network, Container, Database, Storage, Monitoring, Logging) using Python and FastAPI, aligned with IaC principles

  • Engineered an agentless, multi-threaded scanning engine optimized for large-scale enterprise environments

• Conducted black-box penetration testing on 19+ Samsung corporate web services; identified 10 vulnerabilities

  • Found several medium-impact issues including IDOR, file upload bypass, and reflected XSS

• Advisor: Prof. Daehee Jang

• Conducted research and development on [REDACTED]

• Web Penetration Testing / Red Teaming

  • Conducted numerous penetration tests over 3 years targeting web services across major industries including finance, enterprises, and government agencies

  • Performed black-box assessments on diverse environments such as KB Kookmin Bank, Hana Bank, Ministry of Culture, Sports and Tourism and Ministry of Foreign Affairs-affiliated services, and Lotte Castle IoT systems

  • Executed a penetration testing engagement for the City of Bandung, Indonesia web services

• CTF Platform Development and Operation

  • Designed and developed a custom web-based CTF platform (Django + React)

  • Managed the full pipeline of distributing, collecting, and uploading challenges across ~20 problem setters

  • Operated on-site competitions including the Ministry of Education Cybersecurity Competition and Ko-World CTF at Dubai GITEX

• Internal Security Infrastructure

  • Designed and built internal GitLab, tech blog, deployment systems, and internal network environment to prevent external leakage of exploits

• Web penetration testing
• Red-teaming
• Security auditing
• Vulnerability disclosure (CVE, HackerOne, Google VRP)

• Educational system development (Cyber Drill System, Django + React)
• CTF competition operation
• Internal tools, technical blogs, deployment systems

https://new-blog.ch4n3.kr/llm-found-security-issues-from-django-en/

https://new-blog.ch4n3.kr/def-con-33-review-en/

https://new-blog.ch4n3.kr/is-airflow-truly-safe-en/

https://new-blog.ch4n3.kr/cve-2024-7592-en/

https://new-blog.ch4n3.kr/reviews-for-2024-django-security-issues/

https://new-blog.ch4n3.kr/do-not-use-maildev-anyway/