Waris Damkham

Offensive Security Engineer & AI Security Researcher

OSCP+OSCPPNPTPMPAPSAAeWPTXCRTPCPTSCWESCJCABSCPPT1ASCPACPGHFCDLHCCDA-TechCKBProC-APIPenC-AI/MLPenCCPenX-AWSCAPenXCMPen-Android & iOSCNPenCAPenCAPCRTACRT-IDMCRTACCEPCCPCCVE-2025-12782CVE-2025-14166CVE-2025-14068CVE-2025-14366CVE-2025-14003CVE-2025-13693CVE-2025-14153CVE-2025-14626CVE-2025-14453CVE-2025-14506CVE-2026-0694

Explore my skills, research, and hands-on security projects below.

About Me

I am an Offensive Security Engineer, Penetration Tester, and AI Security Researcher with a strong passion for Linux 🐧, Cybersecurity 🔒, AI 🤖, and DevOps ⚙️. My expertise spans Offensive Security, AI-driven threat research, Web security, and Mobile security, with hands-on experience in penetration testing and security assessments. I have led significant research projects, including the development of an Automated COVID-19 Screening Framework Using Deep CNN With Chest X-Ray Medical Images, research on Detecting Vulnerable OAuth 2.0 Implementations in Android Applications, and the creation of Practical Mobile-Based Services for Identification of Chicken Diseases From Fecal Images. These projects have been presented at conferences and featured in publications. I am actively seeking full-time opportunities where I can continue to grow, gain valuable industry insights, and contribute innovatively to a collaborative security research environment.

TryHackMeHackTheBoxCredential.NetMedium
OffSec Certified Professional+ (OSCP+)
OffSec Certified Professional (OSCP)
Practical Network Penetration Tester
Practical Mobile Pentest Associate
Practical SOC Analyst Associate
Web Application Penetration Tester eXtreme
Certified Red Team Professional
Hack The Box Certified Penetration Testing Specialist
Hack The Box Certified Web Exploitation Specialist
HTB Certified Junior Cybersecurity Associate
Burp Suite Certified Practitioner
Jr Penetration Tester (PT1)
API Security Certified Professional
APIsec Certified Practitioner
GitHub Foundations
Cloud Digital Leader Certification
Certified Kiosk Breakout Professional (CKBPro)
Certified API Pentester (C-APIPen)
Certified Cloud Pentesting eXpert - AWS (CCPenX-AWS)
Certified AI/ML Pentester (C-AI/MLPen)
Certified Mobile Pentester (CMPen-IOS)
Certified Mobile Pentester (CMPen-Android)
Certified AppSec Pentesting eXpert (CAPenX)
Certified Network Pentester (CNPen)
Certified AppSec Pentester (CAPen)
Certified AppSec Practitioner (CAP)
Certified Red Team Analyst
Certified Red Team Infra Developer
Multi-Cloud Red Team Analyst
Certified Cybersecurity Educator Professional (CCEP)
Certified C++ Practitioner Certification (CCPC)
Basic Web Application Security Badge
Basic SOC Badge
SOC Tier 1 Badge
Postman API Fundamentals Student Expert
GitOps Fundamentals
Cyber Threat Intelligence 101
Google IT Support Certificate
Meta Full-Stack Engineer Certificate
Open Source Software Development, Linux and Git Specialization
Google Cybersecurity Certificate
AWS Academy Graduate - AWS Academy Cloud Foundations

Skills & Tools

Programming Languages
Web Development
Backend, Frameworks & Testing
Data Management & Search Engines
Cloud & Container Platforms
DevOps & CI/CD Tools
Penetration Testing & Vulnerability Assessment
Machine & Deep Learning
Productivity & Collaboration

Experience

Offensive Security Engineer at Kasikorn Business Technology Group
Offensive Security Engineer
Kasikorn Business Technology Group · Full-time
Nov 2024 - Present
Bangkok, Thailand 🇹🇭 · Hybrid

Key Responsibilities:

  • Performed penetration testing across Web, Mobile, API, and Network environments for over 80 projects annually, covering KBTG and its subsidiaries.
  • Acted as project owner for 4 major security assessment projects in 2025, leading end-to-end execution and reporting.
  • Served as a core member in Red Team operations (Red Team Campaign), leading and executing advanced threat simulation and detection exercises.
  • Created comprehensive summary reports of security findings in both Thai and English, ensuring clear communication with stakeholders
  • Led the development of an automated reporting system and collaborated with the team to design reporting formats and styles.
  • Significantly reduced response time for critical vulnerability alerts by building automation solutions using Power Apps, Power Automate, and Python.
  • Conducted AI security research focused on both Offensive (Red Team) and Defensive (Blue Team).
  • Collaborated closely with the Threat Intelligence team to support real-time alerting.
  • Presented findings and shared AI threat insights during TBCert sessions and internal security briefings.
  • Delivered knowledge-sharing sessions on AI security to regional KBTG teams.

Skills: Penetration test · Kali linux · Burp Suite · AI Security · Reporting · Power Automate · Power Apps

Cybersecurity Consultant (Penetration tester) at ALPHASEC
Cybersecurity Consultant (Penetration tester)
ALPHASEC · Full-time
Jun 2024 - Oct 2024 · 5 mos
Bangkok, Thailand 🇹🇭 · Hybrid

Key Responsibilities:

  • Conducted in-depth penetration testing of IT infrastructure, identifying vulnerabilities in operating systems, applications, configurations, and user behavior.
  • Specialized in web, mobile, and software vulnerability assessments following OWASP Top 10 and industry best practices.
  • Delivered detailed security reports with actionable remediation steps to strengthen clients’ overall security posture.
  • Worked cross-functionally with development and infrastructure teams to ensure timely remediation of security risks.
  • Successfully completed 16 security assessment projects during the engagement.

Skills: Penetration test · Kali linux · Burp Suite · OWSAP · Vulnerability Assessment

Cybersecurity Consultant (Penetration tester) at KPMG · Advisory · Tech-Cyber
Cybersecurity Consultant (Penetration tester)
KPMG · Advisory · Tech-Cyber · Internship
Jan 2024 - Apr 2024 · 4 mos
Bangkok, Thailand 🇹🇭 · Hybrid

Key Responsibilities:

  • Assisted in conducting penetration tests on software, mobile, and web applications using tools such as Kali Linux and Burp Suite.
  • Followed OWASP best practices to identify and document security vulnerabilities and simulate real-world cyberattacks.
  • Performed vulnerability assessments on KPMG’s internal network using Nessus and other scanning tools.
  • Contributed to the development of a secure internal website, incorporating security-by-design principles.
  • Completed 2 penetration testing projects and 1 vulnerability assessment project, improving communication of complex findings to stakeholders.
  • Gained practical expertise in offensive security while actively pursuing continuous learning in a dynamic threat landscape.

Skills: Penetration test · Kali linux · Burp Suite · OWSAP · Cybersecurity · Vulnerability Assessment

Detecting Vulnerable OAuth 2.0 Implementations in Android Applications at Ritsumeikan University
Detecting Vulnerable OAuth 2.0 Implementations in Android Applications
Ritsumeikan University · Internship
May 2023 - July 2023 · 3 mos
Shiga, Japan 🇯🇵 · On-site

Key Responsibilities:

  • Conducted research on OAuth 2.0 implementations in Android applications and browser extensions, focusing on vulnerabilities related to Cross-Site Request Forgery (CSRF).
  • Evaluated critical security parameters such as the state value and authorization code to determine resilience against CSRF attacks.
  • Developed a custom Android application and analyzed real-world apps and extensions to assess OAuth integration practices.
  • Identified insecure implementations that exposed users to potential token hijacking and session fixation risks
  • Contributed to the development of a benchmark for future security audits of Android apps and browser extensions using OAuth 2.0, promoting safer authentication design.
  • Presented research findings at the Workshop on Cyber Forensics, Security, and E-discovery, part of the 23rd IEEE International Conference on Software Quality, Reliability, and Security (QRS 2023).

Skills: Android Development · OAuth2.0 · Application Security · Security · Cybersecurity · Java

Automated COVID-19 Screening Framework Using Deep CNN With Chest X-Ray Medical Images at National Central University
Automated COVID-19 Screening Framework Using Deep CNN With Chest X-Ray Medical Images
National Central University · Internship
Jun 2022 - Jul 2022 · 2 mos
Taoyuan City, Taiwan 🇹🇼 · Remote

Key Responsibilities:

  • Contributed to a research project focused on automated COVID-19 diagnosis using deep learning and chest X-ray images.
  • Developed and evaluated a convolutional neural network (CNN) model enhanced by transfer learning for accurate COVID-19 screening.
  • Utilized Grad-CAM visualizations to interpret model predictions and enhance explainability for medical practitioners.
  • Conducted experiments on publicly available datasets to assess model performance in terms of accuracy, precision, recall, and F-measure.
  • Demonstrated expertise in artificial intelligence, deep learning, and medical image analysis applied to real-world health challenges.
  • Published research findings at the 2022 6th International Conference on Information Technology (InCIT).

Skills: Public Speaking · Jupyter · Convolutional Neural Networks (CNN) · Deep Learning · Artificial Intelligence (AI) · Communication · Python

Education

Mahidol University Logo
Bachelor of Science in Information and Communication Technology
Mahidol University, Thailand 🇹🇭
International Program
2020 - 2024

Activities and societies:

ICT Internship Poster Exhibition 2023 at ICT Mahidol
Sep 2023
Joined the exhibition showcasing B.Sc. ICT International Program student internships. Proudly shared my experience from Ritsumeikan University among esteemed peers. An enriching platform for insights and networking.

Bangkok Christian College Logo
Bangkok Christian College
Smart Computer · GPAX 3.48
2008 - 2020

Activities and societies:

Leader of Academic Computer & Careers of Bcc Showcase 2018
I served as the president of the Computer & Careers group during our school's academic day, 'The New Frontier' for the BCC Showcase. Our event featured a cooking competition named 'BCC FOOD FEST' and a 'TECHZONE' highlighting modern innovations, such as a futuristic house concept.

HackTheBox Logo
Self-Learning on HackTheBox
Online Platform for Cybersecurity Training

Activities and societies:

Pro Hacker
HackTheBox Profile

TryHackMe Logo
Self-Learning on TryHackMe
Online Platform for Cybersecurity Training

Activities and societies:

waris.dam [0xA][WIZARD]
TryHackMe Profile

Projects

Academic Publications

Research papers presented at international IEEE conferences

TENCON 20242025
Practical Mobile Based Services for Identification of Chicken Diseases From Fecal Images

IEEE Region 10 Conference 2024

Poultry farming is crucial to the food chain, and chicken health directly impacts product quality and safety. Diagnosing poultry diseases using polymerase chain reaction is costly, particularly for small farms. To address this, we developed a mobile-based service for farmers, enabling the identification of common chicken diseases from fecal images via a Line account. Our system achieved 86.49% segmentation precision and 95.93% classification accuracy on a large dataset, offering a practical and accessible tool for local farmers.

March 5, 2025
QRS 20232023
Detecting Vulnerable OAuth 2.0 Implementations in Android Applications

23rd IEEE International Conference on Software Quality, Reliability, and Security

OAuth 2.0, commonly used for authorization, can be susceptible to CSRF attacks in Android applications. To address this, we developed an Android app to assess other apps' use of the OAuth 2.0 state parameter—a key defense against CSRF. Our analysis, conducted on both Chrome and the default browser, evaluates whether Android apps using OAuth 2.0 are adequately protected against CSRF attacks. Our research aims to protect users by highlighting apps with potentially vulnerable OAuth 2.0 implementations.

February 19, 2024
InCIT 20222022
Automated COVID-19 Screening Framework Using Deep CNN With Chest X-Ray Medical Images

6th International Conference on Information Technology

An automated COVID-19 screening framework using chest X-ray images is proposed in this study. It leverages artificial intelligence techniques and transfer learning for accurate diagnosis. The framework extracts features using transfer learning and applies modified deep neural networks. Grad-CAM visualization supports the predicted diagnosis. Experimental results demonstrate superior performance compared to other deep learning techniques. This framework has the potential to aid in early COVID-19 diagnosis and alleviate the burden on radiologists.

March 21, 2023

Security Vulnerabilities (CVEs)

6.4MEDIUM
CVE-2026-0694
SearchWiz

The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in post titles that will execute whenever a user performs a search and views the search results page.

Jan 13, 2026
6.4MEDIUM
CVE-2025-14506
ConvertForce Popup Builder

The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in all versions up to, and including, 0.0.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Jan 9, 2026
6.4MEDIUM
CVE-2025-14453
My Album Gallery

The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Jan 6, 2026

Speaker & Presentations

ArsenalAccepted
Oblivion Token: M365 Conditional Access Policy Bypass OST (Offensive Tooling)
Black Hat Asia Arsenal 2026

Oblivion Token is a focused offensive-research utility that makes Microsoft 365 Conditional Access Policy (CAP) bypass testing practical, repeatable, and scriptable. Designed for red-teamers and security researchers, it systematizes token-centric workflows and exercises policy edge cases to expose where device, network, or app-context assumptions fail including realistic test paths against Microsoft first-party (built-in) applications.

Marina Bay Sands, SingaporeApril 2026
WebinarPresented
AI Secuirty Unmasked: The. Hidden Danger Behind Yout AI Tools
KBTG Knowledge Sharing 2025

TBA

MS TeamsSep 2025
MeetupPresented
AI Security Research: The Rise of AI Threat (ยุคใหม่ของภัยคุกคามอัตโนมัติ)
TBCert Monthly Meeting 2025

TBA

Bangkok, ThailandMay 2025

Certifications

SECURITY ANALYST COURSE
SEC Playground
July 2025
View Credential
SOC Tier 1 Badge
SEC Playground
July 2025
View Credential
Basic SOC Badge
SEC Playground
July 2025
View Credential
Cloud Digital Leader Certification
Google Cloud
June 2025 - June 2028
View Credential

Competitions

Blog

My Resume

resume.pdf — waaris_m@portfolio
contact.sh — bash
waaris_m@portfolio:~$ cat contact.txt
# CONTACT INFORMATION
PHONE:+66 63 954 4447
LOCATION:Bangkok, Thailand 🇹🇭
waaris_m@portfolio:~$_