> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/about.md).

# About

### Alham Rizvi

**Offensive Security Researcher · Penetration Tester · Security Consultant at Info eShield Cyber Solutions**\
Mumbai, Maharashtra, India\
*Side hustle: Reverse Engineering, Exploit Development*

#### By the Numbers

I’m currently a Security Consultant at InfoShield, and over the past two years I’ve discovered more than 150 vulnerabilities, including critical findings such as RCE and XSS. This year alone, more than 60 of them were assigned CVEs. I’m now preparing for the CRTO.

#### Who Am I

I'm an offensive security researcher and a final-year CS student, working as a **Security Consultant at InfoShield**. I got into cybersecurity in 2024 through red teaming. I'd always struggled with coding and assumed security would be the easier path. That turned out to be wrong in the best way: the deeper I went, the more I had to learn to code, and I now write **Rust and C++** and work comfortably in **system design and low-level systems**.

Two years in, I've discovered 150+ vulnerabilities, with 60+ CVEs assigned this year alone. My day-to-day work is Web, API, Network, and Cloud penetration testing. Beyond that, I do reverse engineering and exploit development across **Windows, Linux, and macOS internals**, with a deep focus on **Linux kernel exploitation**. I'm also expanding into AI red teaming and preparing for the **CRTO**.

#### About This Blog

This is my personal writeup channel, where I document offensive security research as I learn it. Some posts are finished and others are still in progress, and I'm working through the backlog by the end of the year.

**Every Sunday**, I publish a deep dive into one web application attack, covering the vulnerability, the exploitation process, and the concepts behind it.

**Current focus areas:**

* **Web Application Pentesting:** in-depth, attack-by-attack coverage
* **AI Pentesting:** prompt injection, model exploitation, and AI red teaming
* **Kernel & Exploit Development:** Linux kernel exploitation, memory corruption, and OS-level vulnerability research

#### Featured Projects

| Project                | What it does                                                       |
| ---------------------- | ------------------------------------------------------------------ |
| **ParameterX**         | Advanced parameter discovery and testing                           |
| **XSSion**             | Fast reflected XSS detection                                       |
| **urlx**               | Multi-source URL discovery and live host probing for recon         |
| **tr01d**              | CLI tool for extracting API keys, tokens, and other sensitive data |
| **rapzy**              | Web UI for subdomain enumeration with comprehensive scanning       |
| **Bug Bounty Roadmap** | A complete 2026 roadmap and guide for bug bounty hunters           |

### Links & Profiles

You can checkout all my socials here: <https://alhamrizvi.in>

### Get In Touch

Open to collaborating on security research, bug bounty, and pentesting engagements. Reach out through any of the channels above.