Theodore Valentinus Bachri

Cyber Security Enthusiast / CTF Enjoyer

Securing digital architectures through offensive penetration testing, real-world exploit analysis, and proactive vulnerability research.

Connect & Verification:
Explore Assessments Email
bash - session://theodore-sec-ops
STATUS: ONLINE
theodore@sec-lab:~$ whoami --verbose
Name: Theodore Valentinus Bachri
Role: Cyber Security Enthusiast / CTF Enjoyer
Focus Areas: Web Pentest, Android Exploitation, Host Hardening
Frameworks: OWASP WSTG, OWASP MASTG, MITRE ATT&CK
Recent CVEs: CVE-2025-22131 (XSS), CVE-2024-28397 (RCE)
theodore@sec-lab:~$
theodore@sec-lab:~$ cat security_methodology.md
[01] Reconnaissance & Attack Surface Mapping (Nmap, Subdomain Enum)
[02] Web & API Assessment (IDOR, Injection, XSS, CSRF, RFI)
[03] Mobile Static & Dynamic Analysis (Frida, APK Decompilation)
[04] Privilege Escalation (Sudo misconfigs, Linux bin exploits)
[05] Defensive Telemetry (Zabbix, Honeypots: Cowrie, Dionaea)
theodore@sec-lab:~$
theodore@sec-lab:~$ ./check_summary.sh
4
Documented Engagements
2+
CVEs Investigated
20+
Security Tools & Tech
Root
HTB Target Escalations
theodore@sec-lab:~$
Offensive Security
OWASP WSTG & MASTG Standard Testing
Vulnerability Research
CVE Chaining & Sandbox Breakout Analysis
Infrastructure & Telemetry
Automated Zabbix & Threat Honeypots
Overview

Security Profile & Approach

Offensive Mindset

Approaching applications and network infrastructures through an adversarial lens. Specialized in mapping out complex attack vectors, chaining subtle low-severity oversights into full-compromise paths, and validating root-cause flaws before malicious actors can exploit them.

CTF & Lab Exploitation

Active participant in competitive Capture The Flag (CTF) environments and Hack The Box machines. Consistently solving challenges spanning web exploitation, sandbox escapades, privilege escalation, binary enumeration, and credential theft under structured team workflows.

Defensive Fortification

Balancing offensive knowledge with hands-on infrastructure monitoring and incident telemetry. Experienced in deploying centralized Zabbix agent networks, configuring Cowrie and Dionaea honeypots, and conducting Linux troubleshooting to guarantee enterprise system integrity.

Competencies

Technical Skills & Security Arsenal

Core toolkits, programming languages, and monitoring frameworks leveraged across security assessments and infrastructure hardening.

Penetration Testing & Security

Methodical assessment of web applications, mobile binaries, network protocols, and security architectures.

Kali Linux BurpSuite Frida Threat Modelling Wireshark OWASP WSTG OWASP MASTG CVE Research & Analysis

Programming

Exploit writing, automation scripts, reverse engineering, and database query manipulation.

Python Bash Scripting C PHP SQL Java

Monitoring & Troubleshooting

Host health diagnostics, threat deception sensors, telemetry aggregation, and operating system triage.

Zabbix Honeypot Cowrie Dionaea Linux (Ubuntu) Linux Troubleshooting & Analysis
Proof Of Capability

Featured Security Engagements

Documented penetration tests, vulnerability chain write-ups, mobile security audits, and infrastructure automation.

Web Application Pentest Hack The Box: Guardian
Team of 3 | Penetration Tester

Penetration Testing - Hack The Box: Guardian

Executed initial reconnaissance, target enumeration, and exploited IDOR/XSS vectors to compromise internal accounts and achieve full machine takeover.

Kali Linux Nmap Web Exploitation Bash
01
Initial Access

Chained multiple web vulnerabilities: leveraging IDOR to extract Gitea credentials, XSS for session hijacking (CVE-2025-22131), and CSRF paired with RFI to deploy an interactive reverse shell.

02
Lateral Movement

Extracted hardcoded MySQL credentials from an internal Gitea repository to authenticate and establish an SSH session as a privileged user.

03
Privilege Escalation

Exploited misconfigured sudo/user permissions and an execution flaw in safeapache2ctl to escalate privileges directly to root.

Read Full Write-up (PDF)
Web Application Pentest Hack The Box: CodePartTwo
Team of 3 | Pentester & Report Writer

Penetration Testing - Hack The Box: CodePartTwo

Conducted system enumeration, analyzed sandbox escapades in Python execution environments, and successfully achieved full machine root access.

Kali Linux Nmap Web Exploitation Bash
01
Initial Access

Exploited a sandbox escape vulnerability in the Js2py library (CVE-2024-28397) to execute arbitrary code (RCE) and establish an interactive reverse shell.

02
Lateral Movement

Extracted cleartext credentials discovered in the filesystem to authenticate via SSH and secure an interactive user shell.

03
Privilege Escalation

Modified and executed code through the privileged npbackup-cli binary to bypass restrictions and achieve root access.

Read Full Write-up (PDF)
Mobile Penetration Testing Play Store Production App
Team of 4 | Penetration Tester

Play Store App Penetration Testing

Assisted in conducting comprehensive penetration testing on an Android application from Google Play Store, identifying and validating critical attack vectors.

APK Decompiling Mobile Exploitation Java Burp Suite
High Severity Finding Client-Side Control Bypass

Identified a Client-Side Security Control Bypass vulnerability that allowed for unauthorized data access and parameter tampering.

Medium Severity Finding Session Identity Spoofing

Discovered a Security Control Bypass vulnerability that allowed for identity spoofing across application sessions.

Medium Severity Finding Asset Secret Exposure

Found an unrestricted Google Maps API Key embedded in application assets that could be abused for excessive API quota exhaustion.

Evaluated under OWASP MASTG Framework
Infrastructure Monitoring Production Infrastructure
System Architect & Script Developer

Centralized Infrastructure Monitoring with Zabbix

Designed and implemented an end-to-end centralized monitoring solution to ensure infrastructure reliability, real-time alerting, and host uptime.

Bash Linux Zabbix Monitoring
01
Zabbix Server Deployment

Installed and configured Zabbix Server to act as the centralized monitoring hub for multi-host metrics.

02
Zabbix Agent Deployment

Developed custom shell/bash scripts to streamline the installation and configuration of Zabbix Agents across various Linux VMs via SSH.

03
Host Management

Managed and actively monitored the integrated hosts, ensuring reliable data collection, item triggers, and system health tracking.

View Repository Script (GitHub)