About Me.

Founder & Lead Security Researcher, CyberSecOrg

I'm Aryan Akbar Joyia, Founder & Lead Security Researcher at CyberSecOrg, an independent cybersecurity services and research firm. I specialize in penetration testing, offensive security, vulnerability research, and web, API, mobile, and network security.

My work focuses on chained exploitation, WAF filter evasion, and authorization security. I also build custom security tools and automation frameworks.

In 2026, I represented Pakistan at Microsoft Blue Hat Asia in Singapore, achieving 2nd place on Day 1 and 1st place on Day 2 in the Security Village's Rogue App Hunt, and winning the Social Media Contest.

I'm currently pursuing FA (IT) in Computer Systems Networking and Telecommunications at Government Graduate College, Vehari.

Professional & Research Portals

Download CV
CyberSecOrg

Cybersecurity Services

Web Application Penetration Testing

Comprehensive security assessments of web applications using manual testing methodologies to identify IDOR, authentication bypass, SSRF, and business logic vulnerabilities.

API Security Testing

Security assessment of REST and GraphQL APIs focusing on authentication mechanisms, token validation, authorization gaps, and injection vulnerabilities.

Mobile Application Security

Static and dynamic analysis of mobile applications to identify insecure data storage, weak cryptography, communication security issues, and client-side vulnerabilities.

Network Security Assessment

Network infrastructure security testing including perimeter assessment, internal network segmentation analysis, and vulnerability identification in network services and configurations.

Security Tool Development

Custom security tooling and automation framework development using Python to support penetration testing workflows, vulnerability validation, and security research.

Cybersecurity Consulting

Security engineering advisory services including threat modeling, secure architecture review, and security control alignment with OWASP, NIST, and industry best practices.

CyberSecOrg provides professional cybersecurity services and security research.

Request Services
Methodology

Engagement Methodology

All security assessments follow a structured engagement lifecycle:

CyberSecOrg

Security Research & Penetration Testing

WAFStrike Framework

CyberSecOrg | Security Tool Development

Python-based authorization testing framework for identifying gaps between WAF filtering and backend authorization logic.

March 2026 – April 2026

Python implementation with differential WAF/backend analysis and structured JSON output.

Standards: OWASP WSTG-ATHZ-02 | MITRE ATT&CK T1190

Comparison: Surfaces access control gaps that signature-based scanners (Burp Suite passive scan, OWASP ZAP) miss.

Availability: GitHub repository and methodology documentation available on request.

WordPress Chained Exploit Testing

CyberSecOrg | Penetration Testing | CVSS 9.1 Critical

Chained WordPress vulnerabilities demonstrating potential administrative session compromise.

February 2026

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vectors: WPBakery LFI + Authenticated Stored XSS chained to achieve full admin session hijacking and privileged credential extraction.

Environment: Production WordPress secured by Wordfence WAF.

Business Impact: Full administrative compromise enabling defacement, data exfiltration, and malware distribution to site visitors.

MITRE ATT&CK: T1190, T1059, T1078

Origin Protocol API Failure

CyberSecOrg | Vulnerability Research | CVSS 8.2 High

Unauthenticated exposure of financial infrastructure statistics caused by an authorization/CORS configuration weakness.

December 2025

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Endpoint: /api/v2/arm/daily_stats/

Issue: Loose CORS mapping enabling authorization bypass.

Business Impact: Unauthorized exposure of financial vault statistics enabling competitive intelligence theft and regulatory non-compliance under financial data protection obligations.

Standards: OWASP A01:2021 | MITRE ATT&CK T1530

Large-Scale Booking Engine

CyberSecOrg | Penetration Testing | CVSS 8.4 High

Insecure token validation identified a high-confidence account takeover risk during authorized testing.

December 2025

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Issue: Token validation weakness leading to high-confidence Account Takeover (ATO).

Ethical Testing: Halted testing immediately post-validation following strict ethical boundaries and responsible disclosure protocols.

Business Impact: Mass account takeover risk across entire user base, enabling fraud, identity theft, and platform reputation damage.

Standards: OWASP A07:2021 | MITRE ATT&CK T1539

FareHarbor Provider Dashboard

CyberSecOrg | Vulnerability Research | CVSS 9.4 Critical

Production payment-provider API credentials were exposed through an unauthenticated client-side JavaScript bundle.

December 2025

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Payment Processors: Stripe, PayPal, Adyen, dLocal

Issue: Hardcoded production API keys embedded in client-side JavaScript bundle accessible to unauthenticated users.

Impact: Any visitor could extract keys and initiate unauthorized payment capture or refund operations.

Business Impact: Direct financial fraud exposure, PCI DSS breach notification obligation, and potential PA-DSS non-compliance.

Disclosure: Reported via coordinated disclosure with full reproduction steps and remediation guidance.

Standards: OWASP A02:2021 | CWE-312 | NIST SP 800-53 SC-28 | MITRE ATT&CK T1552.001

Booking.com Analytics Audit

CyberSecOrg | Penetration Testing | CVSS 7.4 High

Session-management and authorization weaknesses identified during security testing of analytics infrastructure.

December 2025

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Issues: Session ID confusion, missing CSRF token rules, and Referrer bypass leaks.

Impact: Demonstrated logical authorization gaps in session management.

Business Impact: Session hijacking enabling unauthorized access to user travel data and payment history.

Standards: CWE-352 | MITRE ATT&CK T1185

Shakepay Core API Bypass

CyberSecOrg | Vulnerability Research | CVSS 9.8 Critical

Authentication bypass identified on production API infrastructure during authorized security research.

October 2025

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Issue: Authentication bypass on key production endpoint nodes.

Triage: Security triage accepted finding under formal organizational risk management protocols.

Business Impact: Unauthenticated access to production financial endpoints risking unauthorized fund transfers and regulatory breach under FINTRAC obligations.

Standards: OWASP A01:2021 | MITRE ATT&CK T1190 | CWE-306

Security Research

Vulnerability Research & Responsible Disclosure

Security Research Contribution — Allama Iqbal Open University (AIOU)

Security Research | Feb 2025 – Mar 2025

Responsible security research on AIOU's online admission system, identifying multiple web security issues affecting input handling, session protection, and administrative interface exposure.

Scope: Conducted responsible security research on AIOU's online admission system.

Findings: Identified reflected XSS, static CSRF token handling, and exposed administrative interface references.

Methodology: Analyzed frontend source code and application behavior to validate input-handling weaknesses and session-protection issues.

Impact Assessment: Assessed potential impact on authentication integrity, session security, and administrative access control.

Deliverable: Prepared a structured vulnerability report containing technical findings, risk assessment, and remediation recommendations.

Disclosure: Coordinated disclosure with AIOU IT management under responsible disclosure principles.

Associated with: Freelance

High-Severity Information Disclosure — BigBlueButton Greenlight

Vulnerability Research

Sensitive configuration and environment data exposure identified in BigBlueButton Greenlight v2.

Scope: Conducted security research on BigBlueButton Greenlight v2.

Issue: Identified sensitive information exposure caused by misconfigured server environments and publicly accessible configuration files.

Exposure: Environment-based secrets, API credentials, and authentication-related parameters.

Attack Surface: Publicly accessible endpoints and search-engine indexing increased exposure.

Impact: Potential unauthorized access to backend services and third-party integrations.

Disclosure: Reported through responsible disclosure to the maintainers.

Resolution: Issue was acknowledged and mitigated by the development team.

Reflected XSS — GulahmedShop

Vulnerability Research

Reflected cross-site scripting vulnerability identified during authorized security research.

Issue: Reflected cross-site scripting (XSS) vulnerability identified in GulahmedShop application.

Security Impact: Potential for script injection in user context through reflected input vectors.

Conduct: Identified during authorized security research.

XSS Leading to Account Takeover — SquareX

Vulnerability Research

A cross-site scripting vulnerability was identified that could be chained toward account takeover.

Issue: Cross-site scripting (XSS) vulnerability identified in SquareX application.

Attack Chain: Vulnerability could be chained toward account takeover.

Security Impact: Potential for unauthorized account access through XSS exploitation.

Conduct: Identified during authorized security research.

Exposed & Unrestricted Google Maps API Key

Vulnerability Research

Fully unrestricted Google Maps API key exposure with documented USD 1M+ potential billing exposure from unauthorized API consumption.

Organization: Major Clothing Brand (anonymous)

Finding: Publicly exposed Google Maps API key.

Configuration: The key was fully unrestricted.

Root Cause: Missing application/API restrictions allowed unauthorized use of the credential.

Impact: Unauthorized consumption of Google Maps Platform services could generate substantial API charges.

Estimated Financial Exposure: USD 1M+

Impact Assessment: Testing/documentation demonstrated that abuse at scale could create USD 1M+ in potential API billing exposure. This represents potential exposure, not a confirmed USD 1M+ financial loss.

Conduct: Identified during authorized security research.

Publications

Security Research & Technical Writing

Finding Origin IPs Behind Cloudflare During Pentests

CyberSecOrg | White Paper | Security Research

A practical security research paper exploring methodologies for identifying potential origin infrastructure behind Cloudflare during authorized penetration testing engagements.

Read White Paper →
Certifications

Certifications & Training

Offensive Security & Penetration Testing Core

  • Certified Network Pentester (CNSP) | The SecOps Group Verify →
    Credential ID: 8787025
  • Certified Network Security Practitioner (CNSP) | The SecOps Group Verify →
    Credential ID: 10233311
  • Web Application Hacking Mastery | Cybrary Verify →
    Credential ID: CC-fbf3e0ce-5ecf-42de-8d2f-d44dcf7fd2e1
  • Advanced Penetration Testing | IT Masters (Charles Sturt University)

Governance, Compliance & Critical Infrastructure

  • Introduction to Critical Infrastructure Protection (ICIP) | OPSWAT Academy Verify →
    Credential ID: PwTGeEcFkA
  • Cybersecurity Compliance & System Administration | IBM iX
    Credential ID: IBM iX Program Completion
  • ISO 27001 Associate | Information Security Governance Framework Verify →
    Credential ID: Self-Paced Completion
  • Applied in engagements involving access control gap analysis and security control mapping.

Threat Management, Defense & Incident Response

  • Certified Ransomware Protection Officer (CRPO) | EU Cyber Academy Verify →
    Credential ID: 64d63660ac9488bbf50f3e76
  • Cyber Threat Management | European Union Agency for Cybersecurity (ENISA)
  • Cybersecurity Essentials | EU4Digital Facility, European Union (Expires: Oct 2028)
  • Vulnerability Management Foundation | Qualys Enterprise Security Verify →
  • Tata — Cybersecurity Analyst Job Simulation | Forage | Issued: June 2026 Verify →
    Credential ID: mLYLJjd8n7sB4t57w

Computer Science Foundations

  • CS50x: Introduction to Computer Science | Harvard University Verify →
    Credential ID: HarvardX Verified Certificate
  • Foundational systems knowledge applied to exploit development and custom security tooling.
  • SOE.YDB-ADVSQL0001: Databases & Advanced Topics in SQL | Stanford Online (Focus: DBMS Injection Remediation & Advanced Query Structure) Verify →
    Credential ID: StanfordOnline Verified
National Security Contributions

PK-CERT Infrastructure Shielding

7+ Valid Security Disclosures Accepted and Remediated

Featured Disclosure
CVE-2024-5932 — GiveWP Plugin Remote Code Execution

Severity: Critical | CVSS 10.0

Unauthenticated PHP object injection enabling remote code execution.

Status: Fixed ✓

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description: Unauthenticated PHP object injection via the GiveWP WordPress donation plugin enabling remote code execution on affected installations without any authentication requirement.

Business Impact: Complete server compromise, data exfiltration, malware deployment, and defacement of donation-handling infrastructure.

Disclosure: Re-discovered and submitted to PK-CERT via official responsible disclosure process. Acknowledged, coordinated, and remediated.

References: CVE-2024-5932 (NVD) | CWE-502 | MITRE ATT&CK T1190 | NIST SP 800-53 SI-10

SQL Injection (SQLi)

Severity: High | CVSS 9.1

Bypassed database abstraction layers risking full backend data access.

Status: Fixed ✓

CVSS 9.1 | CWE-89 | MITRE ATT&CK T1190

Business Impact: Full backend database access enabling mass PII exfiltration and credential theft. Maps to NIST SP 800-53 SI-10, OWASP A03:2021.

Reflected XSS to Session Hijacking (High)

Severity: High | CVSS 8.0

Cookie stealing leading to direct administrative Account Takeover (ATO).

Status: Fixed ✓

CVSS 8.0 | CWE-79 | MITRE ATT&CK T1185

Business Impact: Administrative account takeover enabling platform-wide data manipulation and unauthorized access. Maps to OWASP A03:2021, NIST SP 800-53 SI-10.

Broken Access Control (High)

Severity: High | CVSS 8.1

Unauthorized administrative endpoint access leaking sensitive PII records.

Status: Fixed ✓

CVSS 8.1 | CWE-284 | MITRE ATT&CK T1078

Business Impact: Unauthorized access to sensitive PII records with potential regulatory exposure under data protection laws. Maps to OWASP A01:2021, NIST SP 800-53 AC-3.

Exposed Cloud & API Production Credentials (High)

Severity: High | CVSS 8.8

Hardcoded deployment environment secrets allowing third-party abuse.

Status: Fixed ✓

CVSS 8.8 | CWE-312 | MITRE ATT&CK T1552.001

Business Impact: Third-party service abuse, unauthorized cloud resource consumption, and supply chain compromise risk. Maps to NIST SP 800-53 SC-28, OWASP A02:2021.

SEO Poisoning via Malicious Content Injection

Severity: Medium | CVSS 6.1

Manipulated application response loops altering index ranking paths.

Status: Fixed ✓

CVSS 6.1 | CWE-79 | MITRE ATT&CK T1491.002

Business Impact: Search engine ranking manipulation, reputational damage, and malicious redirect exposure for end users. Maps to OWASP A03:2021.

Insufficient Anti-Automation Controls (Medium)

Severity: Medium | CVSS 5.3

Lack of rate limits enabling automated authentication brute-forcing.

Status: Fixed ✓

CVSS 5.3 | CWE-307 | MITRE ATT&CK T1110

Business Impact: Credential stuffing and brute-force attack surface enabling mass account compromise. Maps to NIST SP 800-53 AC-7, OWASP A07:2021.

International Recognition

Achievements & Events

International Event

Microsoft Blue Hat Asia 2026

Location: Singapore | 2026

🇵🇰 PAKISTAN REPRESENTATION

Only participant representing Pakistan at Microsoft Blue Hat Asia 2026

Representing: CyberSecOrg

Role: Founder & Lead Security Researcher

Security Village — Rogue App Hunt

Competed in the Blue Hat Asia Security Village's Rogue App Hunt, a hands-on security challenge requiring practical security research and problem-solving skills.

Day 1: 🥈 2nd Position

Day 2: 🥇 1st Position

Additional Recognition

🏆 Blue Hat Asia 2026 Social Media Contest Winner

Sponsorship

Trip Sponsored by Resecurity

Participation through my independent cybersecurity firm, CyberSecOrg.

Verification

Verification & References

Professional references and engagement verification available upon request for qualified opportunities. Bug bounty acknowledgments and disclosure timelines available via PK-CERT and relevant platform Hall of Fame records.

Request Reference Letter
Contact Me

Get In Touch

Secure Mail Gateway

Click to initialize connection pipeline

aryanakbarjoyia@gmail.com