Waris Damkham
Offensive Security Engineer & AI Security Researcher
Red Teaming • AI Security • Web/AppSec
About Me
I am an Offensive Security Engineer and AI Security Researcher with hands-on experience across enterprise penetration testing and applied AI and security research. I deliver end-to-end assessments across Web, API, Mobile, and Network environments, and contribute to Red Team operations focused on real-world attack scenarios, identity abuse, and security posture improvement. My work also includes security automation, critical vulnerability response support, and AI security readiness for AI-enabled applications. I conduct applied identity and access security work on Microsoft 365 Conditional Access policy enforcement, with tooling selected for Black Hat Asia 2026 (Arsenal). Open to global opportunities in Red Teaming, Identity Security, and AI Security.
Highlighted Certifications
Skills & Tools
Experience
Key Responsibilities:
- Performed penetration testing across Web, Mobile, API, and Network environments for over 80 projects annually, covering KBTG and its subsidiaries.
- Acted as project owner for 4 major security assessment projects in 2025, leading end-to-end execution and reporting.
- Served as a core member in Red Team operations (Red Team Campaign), leading and executing advanced threat simulation and detection exercises.
- Created comprehensive summary reports of security findings in both Thai and English, ensuring clear communication with stakeholders
- Led the development of an automated reporting system and collaborated with the team to design reporting formats and styles.
- Significantly reduced response time for critical vulnerability alerts by building automation solutions using Power Apps, Power Automate, and Python.
- Conducted AI security research focused on both Offensive (Red Team) and Defensive (Blue Team).
- Collaborated closely with the Threat Intelligence team to support real-time alerting.
- Presented findings and shared AI threat insights during TBCert sessions and internal security briefings.
- Delivered knowledge-sharing sessions on AI security to regional KBTG teams.
Skills: Penetration test · Kali linux · Burp Suite · AI Security · Reporting · Power Automate · Power Apps
Key Responsibilities:
- Conducted in-depth penetration testing of IT infrastructure, identifying vulnerabilities in operating systems, applications, configurations, and user behavior.
- Specialized in web, mobile, and software vulnerability assessments following OWASP Top 10 and industry best practices.
- Delivered detailed security reports with actionable remediation steps to strengthen clients’ overall security posture.
- Worked cross-functionally with development and infrastructure teams to ensure timely remediation of security risks.
- Successfully completed 16 security assessment projects during the engagement.
Skills: Penetration test · Kali linux · Burp Suite · OWSAP · Vulnerability Assessment
Key Responsibilities:
- Assisted in conducting penetration tests on software, mobile, and web applications using tools such as Kali Linux and Burp Suite.
- Followed OWASP best practices to identify and document security vulnerabilities and simulate real-world cyberattacks.
- Performed vulnerability assessments on KPMG’s internal network using Nessus and other scanning tools.
- Contributed to the development of a secure internal website, incorporating security-by-design principles.
- Completed 2 penetration testing projects and 1 vulnerability assessment project, improving communication of complex findings to stakeholders.
- Gained practical expertise in offensive security while actively pursuing continuous learning in a dynamic threat landscape.
Skills: Penetration test · Kali linux · Burp Suite · OWSAP · Cybersecurity · Vulnerability Assessment
Key Responsibilities:
- Conducted research on OAuth 2.0 implementations in Android applications and browser extensions, focusing on vulnerabilities related to Cross-Site Request Forgery (CSRF).
- Evaluated critical security parameters such as the state value and authorization code to determine resilience against CSRF attacks.
- Developed a custom Android application and analyzed real-world apps and extensions to assess OAuth integration practices.
- Identified insecure implementations that exposed users to potential token hijacking and session fixation risks
- Contributed to the development of a benchmark for future security audits of Android apps and browser extensions using OAuth 2.0, promoting safer authentication design.
- Presented research findings at the Workshop on Cyber Forensics, Security, and E-discovery, part of the 23rd IEEE International Conference on Software Quality, Reliability, and Security (QRS 2023).
Skills: Android Development · OAuth2.0 · Application Security · Security · Cybersecurity · Java
Key Responsibilities:
- Contributed to a research project focused on automated COVID-19 diagnosis using deep learning and chest X-ray images.
- Developed and evaluated a convolutional neural network (CNN) model enhanced by transfer learning for accurate COVID-19 screening.
- Utilized Grad-CAM visualizations to interpret model predictions and enhance explainability for medical practitioners.
- Conducted experiments on publicly available datasets to assess model performance in terms of accuracy, precision, recall, and F-measure.
- Demonstrated expertise in artificial intelligence, deep learning, and medical image analysis applied to real-world health challenges.
- Published research findings at the 2022 6th International Conference on Information Technology (InCIT).
Skills: Public Speaking · Jupyter · Convolutional Neural Networks (CNN) · Deep Learning · Artificial Intelligence (AI) · Communication · Python
News Conference Paper Show Credential Conference Certifications
Education
Activities and societies:
Activities and societies:
Activities and societies:
Projects
Academic Publications
Research papers presented at international IEEE conferences
Practical Mobile Based Services for Identification of Chicken Diseases From Fecal Images
IEEE Region 10 Conference 2024
Poultry farming is crucial to the food chain, and chicken health directly impacts product quality and safety. Diagnosing poultry diseases using polymerase chain reaction is costly, particularly for small farms. To address this, we developed a mobile-based service for farmers, enabling the identification of common chicken diseases from fecal images via a Line account. Our system achieved 86.49% segmentation precision and 95.93% classification accuracy on a large dataset, offering a practical and accessible tool for local farmers.
Detecting Vulnerable OAuth 2.0 Implementations in Android Applications
23rd IEEE International Conference on Software Quality, Reliability, and Security
OAuth 2.0, commonly used for authorization, can be susceptible to CSRF attacks in Android applications. To address this, we developed an Android app to assess other apps' use of the OAuth 2.0 state parameter—a key defense against CSRF. Our analysis, conducted on both Chrome and the default browser, evaluates whether Android apps using OAuth 2.0 are adequately protected against CSRF attacks. Our research aims to protect users by highlighting apps with potentially vulnerable OAuth 2.0 implementations.
Automated COVID-19 Screening Framework Using Deep CNN With Chest X-Ray Medical Images
6th International Conference on Information Technology
An automated COVID-19 screening framework using chest X-ray images is proposed in this study. It leverages artificial intelligence techniques and transfer learning for accurate diagnosis. The framework extracts features using transfer learning and applies modified deep neural networks. Grad-CAM visualization supports the predicted diagnosis. Experimental results demonstrate superior performance compared to other deep learning techniques. This framework has the potential to aid in early COVID-19 diagnosis and alleviate the burden on radiologists.
Security Vulnerabilities (CVEs)
CVE-2025-14610
TableMaster for Elementor
The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the plugin not restricting which URLs can be fetched when importing CSV data from a URL in the Data Table widget. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations, including localhost and internal network services, and read sensitive files such as wp-config.php via the 'csv_url' parameter.
CVE-2026-0920
LA-Studio Element Kit for Elementor
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
CVE-2026-0694
SearchWiz
The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in post titles that will execute whenever a user performs a search and views the search results page.
Speaker & Presentations
Oblivion Token: M365 Conditional Access Policy Bypass OST (Offensive Tooling)
Black Hat Asia Arsenal 2026
Oblivion Token is a focused offensive-research utility that makes Microsoft 365 Conditional Access Policy (CAP) bypass testing practical, repeatable, and scriptable. Designed for red-teamers and security researchers, it systematizes token-centric workflows and exercises policy edge cases to expose where device, network, or app-context assumptions fail including realistic test paths against Microsoft first-party (built-in) applications.
AI Secuirty Unmasked: The. Hidden Danger Behind Yout AI Tools
KBTG Knowledge Sharing 2025
TBA
AI Security Research: The Rise of AI Threat (ยุคใหม่ของภัยคุกคามอัตโนมัติ)
TBCert Monthly Meeting 2025
TBA
Certifications
.png)
.png)
.png)
.png)
