@d7meeAz
Penetration Tester
& Security Researcher
Offensive Security · Web, API & Network
I test web applications, APIs, and internal networks, report reproducible findings, and follow fixes through retest. Mozilla credited me on 3 CVE IDs; I've submitted 300+ reports on BugBounty.sa.
- 3Mozilla CVE IDstwo Firefox bugs
- 300+BugBounty.sa reportsSaudi programs
- 2,175total points37th overall
- #4Period 3-20261,120 points
Documented security research.
Mozilla credited me on 3 CVE IDs across two Firefox bugs. Both fixes shipped, and the advisory links are public.
Windows search connector missed by Firefox's executable list
A downloaded .searchConnector-ms file bypassed Firefox's executable warning because the extension was missing from sExecutableExts. Fixed in Firefox 157.0.1, Firefox ESR 153.5, and Firefox 159. CVE-2026-118002LowNTLM credential disclosure via a race condition
A race condition in Firefox's Networking component could disclose NTLM authentication material to an untrusted host. Fixed in Firefox 159.About me.
I'm Abdulrahman Alzahrani, an offensive security specialist focused on web, API, and network penetration testing. Online, I go by d7meeAz.
I run scoped penetration tests end to end: scoping, manual testing, authorization and business-logic analysis, risk-rated findings, remediation guidance, and retest. My work covers web applications, APIs, VPNs, and internal networks, and I also review application source code for logic flaws, broken authentication, and API exposure.
Mozilla credited me on 3 CVE IDs across two Firefox bugs. On BugBounty.sa I have submitted 300+ reports and hold 37th overall with 2,175 points; I ranked #4 for Period 3-2026 with 1,120 points. I also won first place at the Tuwaiq Cyber Challenge 2026.
- Based
- Saudi Arabia
- Focus
- Web, API, Network, AppSec
- Languages
- Arabic · English
- Status
- Available for scoped work
Have a target in mind?
Share what you need tested, the environment, and your timeline. I'll reply with a clear scope, deliverables, and the next step.
Discuss your scopeThree CVE IDs across two Firefox security bugs, fixed in Firefox and Firefox ESR.
Web and API assessments on formal requests, source review, and client-ready reports with risk rating, impact, PoC, and remediation.
Containment, timeline reconstruction, evidence preservation, and a hardening roadmap after an extortion-linked intrusion.
300+ reports submitted across Saudi programs, spanning telecom, government, fintech, and enterprise targets.
View leaderboardCertifications.
eWPTX
Web Application Penetration Tester eXtreme
View certificate
eCPPT
Certified Professional Penetration Tester
View certificate
eCIR
Certified Incident Responder
View certificate
eJPT
Junior Penetration Tester
View certificate
Security+
CompTIA Security+ (SY0-701)
View certificate
For research and security assessments.
Hiring, commissioning an assessment, or want a second opinion on an authorization design? Send the scope and timeline. Get in touch with me.
abdulrahmanalz09@gmail.comWork with me
- Web, API, and external network penetration testing
- VPN and internal network security assessments
- Fixed-scope VAPT with reporting and retest
- White-label delivery with consultancies and MSSPs
- Research collaborations and second opinions