Skip to content

Open to full stack, cloud and AppSec roles

Taimur QaziFull stack engineer who builds secure web platforms on AWS.

3+ years shipping production apps for trading, construction, travel and AI products, from React and Next.js front ends to Node services, Terraform and CI/CD. Now finishing an M.S. in Cybersecurity at the University of Delaware.

View projectsRésuméGet in touch
Years in production
3+
Projects, 7 live
18
M.S. Cybersecurity GPA
3.94
CompTIA certified
Sec+
ProjectsExperienceEducationToolboxTXTabout me.txtPDFresume.pdfcontact meterminal
Web Security Writeups

Web Security Writeups, Open source | Taimur Qazi

Web Security Writeups

Application security writeups from the PortSwigger Web Security Academy

4vulnerabilities exploited and written up
1 + 3Critical and High severity findings
BSCPcertification I'm working toward

Hands-on writeups from the PortSwigger Web Security Academy, on the way to the Burp Suite Certified Practitioner (BSCP) certification. Each one goes past the payload: how I found the flaw, how I exploited it, its impact, the root cause, and how to fix it.

  • Path traversal: read /etc/passwd through a product image endpoint that trusted a user supplied filename.
  • Horizontal to vertical privilege escalation (Critical): changing an account ID parameter loaded the administrator's page with their real password pre-filled, leading to full admin takeover.
  • Broken access control: an account page protected by unguessable GUIDs, defeated because another user's GUID leaked on a public blog post.
  • Username enumeration and brute force: different login error messages revealed valid usernames, which I enumerated and then brute forced with Burp Intruder.
  • Every writeup maps to its OWASP Top 10 category and ends with remediation a developer can act on.
Burp SuiteBurp IntruderOWASP Top 10Access controlPath traversalAuthenticationRemediation
View code on GitHub Open source