Theodore Valentinus Bachri

Cyber Security Enthusiast / CTF Enjoyer

Securing digital architectures through offensive penetration testing, real-world exploit analysis, and proactive vulnerability research.

Connect & Verification:

Explore Assessments

bash - session://theodore-sec-ops

STATUS: ONLINE

theodore@sec-lab:~$ whoami --verbose

Name: Theodore Valentinus Bachri

Role: Cyber Security Enthusiast / CTF Enjoyer

Focus Areas: Web Pentest, Android Exploitation, Host Hardening

Frameworks: OWASP WSTG, OWASP MASTG, MITRE ATT&CK

Recent CVEs: CVE-2025-22131 (XSS), CVE-2024-28397 (RCE)

theodore@sec-lab:~$ cat security_methodology.md

[01] Reconnaissance & Attack Surface Mapping (Nmap, Subdomain Enum)

[02] Web & API Assessment (IDOR, Injection, XSS, CSRF, RFI)

[03] Mobile Static & Dynamic Analysis (Frida, APK Decompilation)

[04] Privilege Escalation (Sudo misconfigs, Linux bin exploits)

[05] Defensive Telemetry (Zabbix, Honeypots: Cowrie, Dionaea)

Competencies

Technical Skills & Security Arsenal

Core toolkits, programming languages, and monitoring frameworks leveraged across security assessments and infrastructure hardening.

Penetration Testing & Security

Methodical assessment of web applications, mobile binaries, network protocols, and security architectures.

Kali Linux BurpSuite Frida Threat Modelling Wireshark OWASP WSTG OWASP MASTG CVE Research & Analysis

Programming

Exploit writing, automation scripts, reverse engineering, and database query manipulation.

Python Bash Scripting C PHP SQL Java

Monitoring & Troubleshooting

Host health diagnostics, threat deception sensors, telemetry aggregation, and operating system triage.

Zabbix Honeypot Cowrie Dionaea Linux (Ubuntu) Linux Troubleshooting & Analysis

Proof Of Capability

Featured Projects

Documented penetration tests, vulnerability chain write-ups, mobile security audits, and infrastructure automation.

Web Application Pentest Hack The Box: Guardian

Team of 3 | Penetration Tester

Penetration Testing - Hack The Box: Guardian

Executed initial reconnaissance, target enumeration, and exploited IDOR/XSS vectors to compromise internal accounts and achieve full machine takeover.

Kali Linux Nmap Web Exploitation Bash

Initial Access

Chained multiple web vulnerabilities: leveraging IDOR to extract Gitea credentials, XSS for session hijacking (CVE-2025-22131), and CSRF paired with RFI to deploy an interactive reverse shell.

Lateral Movement

Extracted hardcoded MySQL credentials from an internal Gitea repository to authenticate and establish an SSH session as a privileged user.

Privilege Escalation

Exploited misconfigured sudo/user permissions and an execution flaw in safeapache2ctl to escalate privileges directly to root.

Read Full Write-up (PDF)

Web Application Pentest Hack The Box: CodePartTwo

Team of 3 | Pentester & Report Writer

Penetration Testing - Hack The Box: CodePartTwo

Conducted system enumeration, analyzed sandbox escapades in Python execution environments, and successfully achieved full machine root access.

Kali Linux Nmap Web Exploitation Bash

Initial Access

Exploited a sandbox escape vulnerability in the Js2py library (CVE-2024-28397) to execute arbitrary code (RCE) and establish an interactive reverse shell.

Lateral Movement

Extracted cleartext credentials discovered in the filesystem to authenticate via SSH and secure an interactive user shell.

Privilege Escalation

Modified and executed code through the privileged npbackup-cli binary to bypass restrictions and achieve root access.

Read Full Write-up (PDF)

Mobile Penetration Testing Play Store Production App

Team of 4 | Penetration Tester

Play Store App Penetration Testing

Assisted in conducting comprehensive penetration testing on an Android application from Google Play Store, identifying and validating critical attack vectors.

APK Decompiling Mobile Exploitation Java Burp Suite

High Severity Finding - Client-Side Control Bypass

Identified a Client-Side Security Control Bypass vulnerability that allowed for unauthorized data access and parameter tampering.
Medium Severity Finding - Session Identity Spoofing

Discovered a Security Control Bypass vulnerability that allowed for identity spoofing across application sessions.
Medium Severity Finding - Asset Secret Exposure

Found an unrestricted Google Maps API Key embedded in application assets that could be abused for excessive API quota exhaustion.

Evaluated under OWASP MASTG Framework

Infrastructure Monitoring Production Infrastructure

System Architect & Script Developer

Centralized Infrastructure Monitoring with Zabbix

Designed and implemented an end-to-end centralized monitoring solution to ensure infrastructure reliability, real-time alerting, and host uptime.

Bash Linux Zabbix Monitoring

Zabbix Server Deployment

Installed and configured Zabbix Server to act as the centralized monitoring hub for multi-host metrics.

Zabbix Agent Deployment

Developed custom shell/bash scripts to streamline the installation and configuration of Zabbix Agents across various Linux VMs via SSH.

Host Management

Managed and actively monitored the integrated hosts, ensuring reliable data collection, item triggers, and system health tracking.

View Repository Script (GitHub)

Credentials & Academics

Education & Certification

Formal university degree studies in cyber security paired with verified industry proficiencies in network infrastructure and applied artificial intelligence.

2024 - Present

Formal University Degree

BINUS University

School of Computer Science / Cyber Security

Pursuing undergraduate computer science studies specializing in cybersecurity, penetration testing methodologies, system hardening, and defensive security architectures.

Cyber Security Computer Science Network Defense Cryptography

Issued Sep 2026

Professional Certification

Networking Basics

Cisco / 22 Hours Course

ID: 02b61dc8-3ea8-4f9d-b864-ed05c49e10b5

Completed 22 hours of courses covering the foundation of networking and network devices, media, and protocols.

Network Devices Protocols Media & Cabling Routing & Switching

Issued Sep 2026

Professional Certification

Google AI Professional

Google / 8 Hours Course

ID: WR4AB67UVOH8

Completed 8 hours courses covering foundational and applied AI concepts, including prompt engineering, LLM integration, and model evaluation.

Prompt Engineering LLM Integration Model Evaluation Applied AI