Дмитро

PENETRATION TESTER

SHAMSHUR
WORK EXPERIENCE

DMYTRO Penetration Tester
H-X Technologies
Sep 2025 – Present
Performed penetration testing of web applications as part of the H-X
PERSONAL DATA: Technologies security team.
[open contact info](look above in the "contact info" section) Conducted security testing of production web applications for AIX, MURKA, and
Kyiv DTEK as part of authorized security assessment projects.

Identified and validated 30+ medium/high severity vulnerabilities, primarily in:
authentication and authorization logic
object-level access control (BOPLA / BOLA)
TOOLS AND TECHNOLOGIES:
business logic
BurpSuite
All findings were confirmed by the affected companies and addressed through
This is used for manual auth flow analysis and logic
coordinated remediation.
testing
Repeater
PUBLICATIONS
JWT editor TOTP
Python Authored a technical article examining practical weaknesses of TOTP-based
authentication in production systems. The analysis highlights architectural and
custom automation and test case
logic-level issues in real-world implementations, including flawed verification flows
generation beyond Burp capabilities
and state management, instead of theoretical cryptographic attacks.

Wireshark
for protocol-level inspection (TLS
handshake, token exchange)
FOCUS
cryptography
My primary focus areas include authentication and authorization mechanisms,
IDOR vulnerabilities, race conditions, asynchronous logic issues, and business
LANGUAGES logic flaws.

English B1-B2 API Security:
Authorization and object-level access control (BOPLA/BOLA)
Russian C2 Token handling and session lifecycle issues
Race conditions and async behavior in APIs
Ukrainian C1 Web cache poisoning
Web cache deception