Personal information hidden

ALEXANDER SHIPULA
Zaporizhzhia, Ukraine · [open contact info](look above in the "contact info" section) · [open contact info](look above in the "contact info" section) · github.com/Alex-Shipula

PROFESSIONAL SUMMARY

Penetration Tester / Application Security Engineer with 2+ years in application security and security-
focused engineering on top of a 7-year software development background. I test web applications and
APIs manually following OWASP WSTG and OWASP API Top 10 — access control (IDOR/BOLA),
authentication and session management, injection, business-logic flaws and defence bypass — and I
confirm findings with reproducible PoCs rather than relying on automated scanners. Bug bounty
researcher on HackerOne, Bugcrowd and HackenProof. Comfortable with Python/Bash tooling, Burp Suite,
Nmap, Linux/Docker, and with mobile and reverse-engineering work as an added capability (ADB, Frida,
jadx, Ghidra, MobSF). BSc in Cybersecurity; MSc in Cybersecurity of Intelligent Systems (in progress).

CORE SKILLS

Methodology: OWASP WSTG · OWASP API Security Top 10 · OWASP ASVS · manual black/grey-box testing ·
threat modelling · risk rating · technical reporting with PoC, impact and remediation

Web & API Testing: access control (IDOR / BOLA / BFLA) · authentication and session management ·
injection (SQLi, NoSQLi, XSS, SSTI) · SSRF · business-logic flaws · WAF / defence bypass · GraphQL and REST
API testing

Tools: Burp Suite · Nmap · Nuclei · Subfinder · HTTPX · Katana · ffuf · Metasploit · sqlmap · Frida · ADB · jadx ·
apktool · MobSF (working knowledge) · Ghidra · Caido

Languages for tooling: Python (primary) · Bash · JavaScript / TypeScript · Go (reading, working with
services) · SQL

Networking & Systems: HTTP/HTTPS · TCP/IP · DNS · TLS · WebSockets · Linux (Ubuntu/Kali) · Docker · basic
Kubernetes and cloud (AWS/GCP) assessment · proxy and traffic inspection

Adjacent strengths: Android APK analysis and SSL-pinning bypass · JavaScript deobfuscation and AST/taint
analysis · browser fingerprinting and automation internals · applied cryptography (AEAD, ECDH, EdDSA,
HKDF, TLS 1.3)

SELECTED SECURITY PROJECTS

• Bug Bounty Research — HackerOne / Bugcrowd / HackenProof: web, API and mobile targets;
focus on authentication and session flaws, IDOR/BOLA, WebSocket testing and client-side JavaScript
attack surface; every report backed by a reproducible PoC and impact assessment.
• BugHunter — JavaScript Static Analysis CLI : Node.js/TypeScript CLI that collects JS assets, walks
the AST and applies taint tracking to detect DOM XSS and prototype pollution — automated
discovery that feeds manual verification.
• Android Crypto RE Lab (lab): APK decompilation with jadx/apktool, runtime hooking with Frida for
javax.crypto/OkHttp, SSL-pinning bypass in lab applications, Ghidra native analysis — covering
mobile testing and reverse-engineering tasks.

• TLS / HTTP2 Fingerprint & Traffic Lab (lab): Python/Go tooling to inspect TLS ClientHello, HTTP/2
settings, WebSocket and DoH behaviour — useful for fingerprint-based defences and protocol-level
testing.
• Anti-Detect Chromium Browser (commercial, 2023–2025): browser internals, runtime fingerprint
injection, isolated profiles and proxy tunnelling — practical depth in how modern web defences and
fingerprinting actually work.

PROFESSIONAL EXPERIENCE

HackerOne — Security Researcher
Dec 2025 – Present

• Perform manual security testing of web applications, APIs and mobile clients; identify and exploit
access-control flaws, authentication/session weaknesses, injection issues and business-logic errors.
• Write technical reports with proof-of-concept, clear risk assessment and practical remediation
guidance; maintain a private toolkit for JS asset collection, taint analysis and HTTP traffic inspection.
• Research Android attack surface with ADB/Frida and manual APK analysis, including certificate-
pinning bypass in lab environments.

Noname Digital LLC — FullStack Engineer (anti-detect browser / Chromium)
Jun 2023 – Apr 2025

• Built an anti-detect Chromium-based desktop browser (Electron + React, Windows/Linux);
embedded a Chromium binary and controlled it from Node.js.
• Implemented runtime fingerprint injection (WebGL, CPU info, OS, user-agent, cookies), isolated
browser profiles and multi-account session management.
• Integrated proxy tunnelling via an external Go service and worked on browser automation and
client-side behaviour patching — direct insight into how anti-bot and detection systems operate,
and therefore how to test around them.

MetaProject — FullStack Engineer
May 2025 – Nov 2025

• Built a production Next.js 15/React 19 application (RSC, Server Actions, Edge Runtime); implemented
caching and performance optimisation.
• Implemented a robust data layer with TanStack Query and server-state synchronisation — strong
engineering discipline applied later to security tooling and reporting.

OpenGeeksLab — Front End Engineer
Oct 2021 – Jul 2024

• Built a Web3 token sale/management platform with Web3/Ethers.js and a React Native mobile
version; integrated Azure OCR and PDF generation.
• Developed a Jira-integrated task platform — experience in API integration and understanding of
application business logic.

Earlier Software Engineering Experience
2018 – 2022

• Web3 wallet/smart-contract integration; secure API development on Node.js; React/Redux
frontends; WordPress/landing pages. Strong foundation for reading and reasoning about
application code during security reviews.

EDUCATION & DEVELOPMENT

MSc in Cybersecurity of Intelligent Systems — Odesa Polytechnic, 2026–2028 (in progress)

BSc in Cybersecurity and Information Protection — Zaporizhzhya National Technical University, 2022–
2026

Continuous practice: Bug Bounty (HackerOne, Bugcrowd, HackenProof) · lab-based reverse engineering
and mobile testing · applied-cryptography study (AEAD, ECDH, EdDSA, HKDF, TLS 1.3) · actively pursuing
offensive security certifications (OSCP/PNPT track)