Waris Damkham

Offensive Security Engineer · AI Security Researcher · Security Builder

Focus: Red Teaming • AI Security • Identity & AppSec.

Focus areas include enterprise penetration testing, identity and application security, vulnerability research, and offensive tooling.

Black Hat Asia 2026 Arsenal Speaker
DEF CON Singapore 2026 Demo Labs
30 CVEs
3 IEEE Publications
Selected certifications: OffSec Certified Professional+ (OSCP+); OffSec Certified Professional (OSCP); Hack The Box Certified Penetration Testing Specialist; Practical Network Penetration Tester; Certified Red Team Professional; Certified by Altered Security Red Team Professional for Azure; Hack The Box Certified Web Exploitation Specialist; Web Application Penetration Tester eXtreme; Burp Suite Certified Practitioner; Practical AI Pentest Associate; Practical Mobile Pentest Associate; API Security Certified Professional; Hack The Box Certified Defensive Security Analyst; Practical SOC Analyst Associate; Hack The Box Certified Junior Cybersecurity Associate; Jr Penetration Tester (PT1); Cloud Digital Leader Certification; GitHub Foundations
10 Talks & Contributions

PicoCTF

PicoCTF So Meta Writeup: Inspecting Image Metadata and Hidden Data

A compact So Meta walkthrough using image inspection and zsteg to recover the flag.

Mar 20, 20242 min readAdapted from my picoCTF notes

PicoCTFForensicsMetadatazsteg

So Meta is a picoCTF 2019 forensics challenge that points toward image metadata and hidden content.

Challenge image

Analysis

I used zsteg against the image to inspect embedded data:

zsteg pico_img.png

Flag

The flag appears in the tool output.

zsteg result

Key Takeaways

Metadata-themed challenges are usually quick wins with basic inspection tools.
If standard metadata is not enough, check for embedded data with steganography tools.
Keep a small forensics checklist: file, strings, metadata tools, then stego tools.