NADER ALHARBI

Summary

Cybersecurity enthusiast with a strong interest in penetration testing, red teaming, and ethical hacking. Skilled in identifying and exploiting security vulnerabilities to help strengthen systems and networks. Actively pursuing advanced knowledge about new exploitation techniques. A team player with a proactive approach to learning and problem-solving, aiming to contribute effectively to the field of cybersecurity while continuously honing technical expertise.

Education

Experience

Certifications

Professional certifications that enhance my expertise and validate my skills in various domains.
Under each Certificate you can find key topics and skills gained by the Certificate.

Certified Red Team Professional (CRTP)

Issued by Altered Security

Key Topics and skills

• Active Directory (AD) Enumeration
• AD attacks
• ACLs Abuse
• AD Presistance
• Child to parent domain escalation
• Trust Attacks
• Forest privilege escalation

Web Application Penetration Tester eXtreme (eWPTX)

Issued by INE

Key Topics and skills

• Web Application Penetration Testing Methodology
• Web Application Reconnaissance
• Authentication Attacks
• Advanced Injection Vulnerabilities
• API Penetration Testing
• Server-Side Attacks
• Filter Evasion & WAF Bypass

Certified Professional Penetration Tester (eCPPT)

Issued by INE

Key Topics and skills

• Client-Side Attacks
• Web Application PT
• Network Penetration Testing
• Exploit Development
• Post-Exploitation
• Red Teaming and Active Directory Penetration Testin

Mobile Application Penetration Testing (eMAPT)

Issued by INE

Key Topics and skills

• Android and iOS Architecture
• Static and Dynamic Analysis
• Developing APK Exploits
• Reversing APKs
• Intercepting Web Requests

Certified Red Team Analyst (CRTA)

Issued by CWL

Key Topics and skills

• Red Team Methodologies
• Understanding of MITRE ATT&CK
• Internal & External Recon
• Perform Kerberos based attacks in fully patched Active Directory
• Pivoting and Lateral Movement Techniques

Certified Threat Hunting Professional (eCTHP)

Issued by INE

Key Topics and skills

• Threat hunting methodology
• Threat hunting using Splunk
• Threat hunting using ELK
• Memory-based threat hunting

Junior Penetration Tester (eJPT)

Issued by INE

Key Topics and skills

• Assessment Methodologies
• Host & Networking Auditing
• Host & Network PT
• Web Application PT

Offshore ProLab

Issued by Hack The Box

Key Topics and skills

• Web Application Attacks
• Enumeration
• Exploiting Real-World Active Directory Flaws
• Local Privilege Escalation
• Lateral Movement and Crossing Trust Boundaries
• Evading Endpoint Protections
• Compromising all 5 Domains

Zephyr ProLab

Issued by Hack The Box

Key Topics and skills

• Active Directory
• Red Teaming
• Enumeration
• ACLs Abuse
• Lateral movement and crossing trust boundaries
• Pivoting
• SQL attacks

Dante ProLab

Issued by Hack The Box

Key Topics and skills

• Enumerating networks and machines
• Exploiting numerous vulnerabilities
• Crafting custom payloads
• Lateral movement
• Pivoting
• Escalating privileges

Courses & Bootcamps

Continuous learning is key to staying ahead in the fast-evolving cyber landscape. Here are some of the courses and bootcamps I've completed to enhance my skills.

Projects

Here are some of the projects I've worked on that showcase my skills and expertise. Click project to see demo video.

Google Chrome Password Stealer

This malware decrypts and steals passwords stored in Google Chrome, sending them to the attacker’s Command and Control (C2) server without detection from Windows Defender on Windows 10.

Python Stealer Evasion

Subnet Scanner

This Python program identifies live hosts on a subnet, useful for penetration testers to locate active hosts.

Python Enumeration

Fake CAPTCHA Attack Simulation

This demo replicates how threat actors use fake CAPTCHA pages to trick victims into executing malicious code. Designed to raise awareness, it highlights the importance of verifying website authenticity to prevent falling for such social engineering attacks.

Try Demo

Awareness Social Engineering

NRcTwo

This is a IP-less C2 (Command And Control) That I have created that leverages Telegram for communication. This C2 has multiple functionalities, including:
• Gathering system information from the victim machine
• Executing commands on the victim machine
• Taking screenshots
• Retrieving public IP and location
• Persistence via startup apps

C2 Telegram Bot Python

Connect

Feel free to reach out if you're interested in working together or have any questions.

My LinkedIn Profile

My Email

My X/Twitter Account