Waris Damkham

Offensive Security Engineer · AI Security Researcher · Security Builder

Focus: Red Teaming • AI Security • Identity & AppSec.

Focus areas include enterprise penetration testing, identity and application security, vulnerability research, and offensive tooling.

Black Hat Asia 2026 Arsenal Speaker
DEF CON Singapore 2026 Demo Labs
30 CVEs
3 IEEE Publications
Selected certifications: OffSec Certified Professional+ (OSCP+); OffSec Certified Professional (OSCP); Hack The Box Certified Penetration Testing Specialist; Practical Network Penetration Tester; Certified Red Team Professional; Certified by Altered Security Red Team Professional for Azure; Hack The Box Certified Web Exploitation Specialist; Web Application Penetration Tester eXtreme; Burp Suite Certified Practitioner; Practical AI Pentest Associate; Practical Mobile Pentest Associate; API Security Certified Professional; Hack The Box Certified Defensive Security Analyst; Practical SOC Analyst Associate; Hack The Box Certified Junior Cybersecurity Associate; Jr Penetration Tester (PT1); Cloud Digital Leader Certification; GitHub Foundations
10 Talks & Contributions

PicoCTF

PicoCTF What Lies Within Writeup: Recovering Hidden Bits from an Image

A short forensics walkthrough using zsteg to find hidden data inside the What Lies Within image challenge.

Feb 27, 20242 min readAdapted from my picoCTF notes

PicoCTFForensicsSteganographyzsteg

What Lies Within is a picoCTF 2019 image forensics challenge. The prompt hints that something is hidden inside the provided building image.

Analysis

I started by confirming the file type, then used zsteg to inspect hidden bit-plane data:

file buildings.png
zsteg buildings.png

Flag

The hidden data is recovered directly from the zsteg output.

zsteg output

Key Takeaways

Image steganography challenges often hide data in low-order bits.
zsteg is a strong first pass for PNG/BMP-style challenges.
Confirming the file type first helps avoid using the wrong tool.