: penetration tester : manama, bahrain :

MOOSA NAYEM

> penetration tester.

I break into web apps, APIs and networks (with permission), then write the report that gets them fixed. Right now I'm one of 15 graduates on the Central Bank of Bahrain's GP15 programme, picked from 1,600 applicants.

get in touch↗ view timeline↓

reach me via terminal

$ echo 'hi moosa' | mail nayempw@protonmail.com

IMG_0x01.ASCII84×50decoding…

                                    ..'''''''..
                                .''''''''.''''.....
                              '.'''' ... ..         ...'.
                          .''''-o*ooooooooo******++=====-'
                     ''''''''':x@@@@@@@@@@@@@@@@@@@@@@@@@+''.
                   .'''''''''' -8@@@8@@@8888888@@@@@@@@@%: .''''
                 .'''''''''''..':#@@@@@@@@@@@@@@@@@@@@#=' ...''''.
               ''''''''''''''''' :+####%%%%%###8888#o-' ...''''''''
             ''''''''::::::::''''''''''...'..''':'''''::::::''''''''
            . ...'''--:''''''.    .                ''''':::---:''''''.
            . ...'::-:''''''.                        ..''''':=-:::'''''
           .''::::---:''''.       ..'':'      .:'''''.   .'''-=::::'''''.
           '''''::::-'''..'':-----------:'...'-=---==---:'..':=-:''''''''.
          '''''::-:::'.':-====++==---::::-:::::----=======-:''::::''..'..'
         '''''::::::::*x+===*x%%%%%%xo*=-::::=*xxx%%%#%o+==o*:'''':::'.  .
        ''''':::::::'o#%=--+x%%#######x*=----*x##8###%%xo--*8+::''.'':''.
       ''.'':::::::-:o%x=+*oxxxxxxxxxx%o+=+++*x%xxxxxooox*=o%+==:''..'''''.
       '.'':::::':++==+o-*%8oox*%8#**o*%8%%%#8xo+o##**x**8#o+-=*='..'.....
      ''''::::'' :*=-=++--=x-=**+o*+**++8*:=8o+*o*xo++*+-%+-+=-+='''.....
      ''''::'''. '+==+=+-=-*=:=+---===-*%:':x*=++======-=o--=+-=-'''....
      '''':'''.  '--===+---:+=--:::::-+x=:::-%+----:::-=*---====:''''. ..
     ''''''''.    :====+=---:===----=*o=:::::=x*=----=++---==+==:'''.....
     '''''''.     '====++----:::---===-::'''::-++====--:---===--''''....
     '''''..      .-=--+*==---:::'::----:'''':--=-:::::---=+---:'''...
     ......         ':::++==--::::::-=*oo*-=*x*=---::----=++-::''.'...
     . ..        ... '':=+++==--:-+oxxx%##xx###%x*=---===++-::'''. ....
     .  ..      ....''::-++++==--+oxo*+++==++**ooxo=-=++=+=::'''...''..
     . .        ...''::--=o++==----=**++++++++**+==--=+++*-:''''..''''.
     '         ....''::---+o++====---=-------===--===+**o+::''. .'''''.
     .        ....'''::::--*o*****=--+++**+++++=-=*ooo*o*=::'....''''''.
     .       . ...''::::----*oooxx*+-=+*ooooo*==+*xxoxo++=-'.......''''.
     .      .. ..'':::::---=-+oxxxo**=---=====+*ooxxxo+=+=:..... ...''''.
     .    ...  ..'':::::----===*x%%xo**++++=+*oxxxxx*===--'''..   ....'.. .
     .  . .    .'''::::---:'-===+ox%xooo**oooxx%%xo+===':-''''.
     ......   .''''::::---'  ':=++*oxxx%xxxx%%%xo*++=:. .--:'.
    .....     .''''::::--:      ':==+*ooxxxxxo*+=-:'    .:==-.
    '...    ...'''':::'':.          .':::::'''..        .'-=='
    ''..    ..''''''.. .''                              .'::::
    '.    ....''...      ''.         .   ..            .''''::'
    .  ......   ..         ..        .    .           ..... '''.
   ......      ..                    .                       '''
  ......     ...                    .'                        '''
...       .....                     ''                         '''
       ......                        '                          '''
...                                                              '''
 ...                                                              '''
    ..                                                             ''.
                                                                    ..'
                                     .                                .'
                                     .                                 ''

subject: moosa.nayemclearance: gp15hover to glitch

eJPT certified✦ CBB GP15 — 1 of 15✦ First-Class Honours · 90%✦ HTB lvl 53✦ CJCA 96.5%✦ CWES 88.5%✦ CPTS 41.6%✦ OSCP: loading_✦ ex-Vulnxperts pentester✦ NEBRC ethical hacker✦ eJPT certified✦ CBB GP15 — 1 of 15✦ First-Class Honours · 90%✦ HTB lvl 53✦ CJCA 96.5%✦ CWES 88.5%✦ CPTS 41.6%✦ OSCP: loading_✦ ex-Vulnxperts pentester✦ NEBRC ethical hacker✦

#01$ cat about.md

Whoami

Bahraini penetration tester with a First-Class Honours degree in Networks & Cybersecurity (90% overall) from Northumbria University, and hands-on testing experience in Bahrain and the UK.

Most of my time goes on the offensive side: web and infrastructure assessments, API testing, and the OWASP Top 10 against real clients. I've done it at Vulnxperts for enterprise clients and at the NEBRC for small businesses across North East England. I'm just as careful with the report as with the exploit, because a finding only matters once someone can act on it.

Off the keyboard I'm an ex-national basketball player (GCC U16 gold with Team Bahrain) and a former student council president. These days I'm grinding Hack The Box toward the OSCP.

langArabic (native) · English (IELTS 8.0)
htbseanporter · Skilled · Level 53
nowGraduate Trainee, Central Bank of Bahrain
nextOSCP

BSc overall
first-class honours

0/1600

GP15 selection
under 1% acceptance

lvl0

Hack The Box
rank: skilled

HTB CJCA
almost certified

#02$ git log --graph --all

Timeline

Oct 2026 — now

commit 9f3c2e1 HEAD -> main work

Graduate Trainee — GP15

Central Bank of Bahrain // Manama, BH

Selected as one of 15 graduates from 1,600 applicants for the Central Bank of Bahrain's flagship graduate programme. Started 1 October 2026.

GP1515 / 1600under 1% acceptance
Aug 2026 — Oct 2026
commit 4b7a0d9 work

Penetration Tester

Vulnxperts // Bahrain
- Delivered scoped web application and infrastructure penetration tests for enterprise clients, from recon and enumeration through exploitation to remediation.
- Tested against the OWASP Top 10 (injection, authentication and access-control flaws, BOLA, insecure file upload) with Burp Suite, Nmap, sqlmap, ffuf and Metasploit.
- Wrote client-facing reports with reproduction steps, CVSS-based severity and prioritised remediation, and presented findings to technical and non-technical stakeholders.
Web AppInfrastructureOWASP Top 10Burp SuiteCVSS
Class of 2026
commit e21c8f4 edu

BSc (Hons) Networks & Cybersecurity

Northumbria University // Newcastle upon Tyne, UK
- First-Class Honours, overall mark 90%.
- Advanced Security 89% (ethical hacking, pentesting, securing servers) · Digital Forensics 90% · Networking 90%.
- Dissertation (90%): designed and ran a factorial experiment on mandatory age verification with 57 participants, on a web platform I built, analysed in R.
- Year 1 average 82%, top 10 of 430 students in Computing Fundamentals.
First-Class90% overall
2024 — 2026
commit 7d10a3b work

Ethical Hacker (Part-time)

North East Business Resilience Centre // UK
- Selected from 90+ applicants across UK universities to deliver security services to small and medium businesses.
- Ran vulnerability assessments across North East England and turned findings into prioritised remediation guidance for non-technical clients.
NEBRCVuln AssessmentSMEs
Aug 2024
commit c08e5f2 work

Cybersecurity Intern

NGN International // Bahrain
- Network scanning and reconnaissance with Nmap; shadowed live penetration-test engagements with senior consultants from scoping to final report.
NmapRecon
Jul 2024 — Mar 2025
commit 3a9b6d0 work

Front-End Developer (Remote)

Kuwait Integrated Technology Solutions // Remote
- Built and maintained web applications to spec, managing code via Git in a collaborative team.
JavaScriptSvelteGit
root commit
commit 1 root edu

High School Diploma

Al Raja School // Bahrain
- Cumulative average 97.23%. AP Computer Science 5, AP Calculus 4.
- Represented Bahrain at U16 national basketball level in the GCC league — gold medal.
- Student Council President; organised a graduation ceremony for 800+ guests.
97.23%Team BahrainStudent Council

#03$ ls ~/certs --status

Certs

INE Security [ ✓ certified ]

eJPT

eLearnSecurity Junior Penetration Tester

Certified. Practical, hands-on network and web pentest exam.

progress100%

Hack The Box [ in progress ]

CJCA

HTB Certified Junior Cybersecurity Associate

Offensive and defensive foundations, from exploitation to SIEM monitoring and log analysis.

progress96.5%

Hack The Box [ in progress ]

CWES

HTB Certified Web Exploitation Specialist

SQLi, XSS, file upload, command injection and API testing.

progress88.5%

Hack The Box [ in progress ]

CPTS

HTB Certified Penetration Testing Specialist

Full-scope penetration testing, including Active Directory and pivoting.

progress41.6%

OffSec [ queued ]

OSCP

Offensive Security Certified Professional

Currently in preparation. The next boss fight.

progressloading…

Hack The Box [ queued ]

COAE

HTB Certified Offensive AI Expert

AI red teaming, covering LLM exploitation, adversarial ML and data poisoning.

progressloading…

Hack The Box [ track record ]

LVL 53

Rank: Skilled // handle: seanporter

Boxes, Academy modules and a lot of late nights. The training ground for everything above.

#04$ which --all tools

Arsenal

~/offensive — Offensive Security

Web App Pentesting
Infrastructure Pentesting
API Security
OWASP Top 10
Manual Exploitation
Privilege Escalation
Vulnerability Assessment

~/tooling — Tooling

Burp Suite
Caido
Nmap
Metasploit
sqlmap
ffuf
Gobuster
Wireshark
Nessus

~/ai — AI-Assisted Offense

AI Agents
AI Agents for Pentesting

~/reporting — Reporting

Client Reports
Repro Steps
CVSS Scoring
Prioritised Remediation
Non-technical Briefings

~/defence — Defence & Forensics

GoPhish
MITRE ATT&CK
Autopsy
FTK Imager
Volatility

~/systems — Systems & Networking

Kali
Arch Linux
Windows
Active Directory
TCP/IP
VirtualBox
VMware

#05$ ls -la ~/projects

Projects

01 exploit / tooling ↗

drupalgeddon2-cli

A command-line rewrite of the Drupalgeddon2 (CVE-2018-7600) proof of concept, built while working through HTB Academy's Attacking Common Applications. Auto-plants a web shell with a randomised name and parameter, and supports one-shot commands or an interactive pseudo-shell. For authorised testing only.

PythonCVE-2018-7600RCEHTB Academy

02 phishing simulation ↗

Fantasy Cyber League

A gamified security-awareness platform (university group project). I owned the phishing simulator: self-hosted GoPhish with authentication, dashboards and a webhook processor, deployed via CI. Found and fixed an XSS flaw along the way.

Group ProjectGoPhishCI/CDXSS fix

03 research platform private

Age-Verification Experiment

Dissertation project (90%). Designed and ran a factorial experiment on mandatory age verification with 57 participants, on a web platform I built from scratch, then analysed the results in R.

PHP / RResearchWeb PlatformR

#06$ ssh guest@nayem-m.github.io

Shell

: zsh : : guest@nayem-m : 120×32

#07$ tail -f ~/blog

Blog

$ ls -la ~/blog/posts
total 0
drwxr-xr-x  2 moosa  staff   64 Oct  6  .
drwxr-xr-x  8 moosa  staff  256 Oct  6  ..

// writeups compiling… HTB boxes, web vulns and lessons from the field, soon.

open ~/blog→

: open channel :

Let's talk_

Security roles, collaborations, CTF teams, or just to swap war stories. My inbox is open.

linkedin in/moosa-nayem ↗ github @nayem-m ↗ mail open mail client →

MOOSA NAYEM

Graduate Trainee — GP15

Penetration Tester

BSc (Hons) Networks & Cybersecurity

Ethical Hacker (Part-time)

Cybersecurity Intern

Front-End Developer (Remote)

High School Diploma

drupalgeddon2-cli

Fantasy Cyber League

Age-Verification Experiment

Let's talk_