Hello, I'm

Mohamed Aziz
Haddadi

DFIR Specialist / Blue Team Analyst / CTF Player

Get In Touch Explore My Work
Mohamed Aziz Haddadi
pulgaa@kali
$
$
$ _
Scroll
01

About

I'm a cybersecurity enthusiast specializing in Digital Forensics & Incident Response and Blue Team operations.

My expertise includes malware analysis, threat intelligence, and SOC analysis. Ranked in the top 1% on TryHackMe, I've consistently achieved top placements in competitive CTFs including Top 4 in Securinets Qualifications, Top 10 in Cybertek, Top 5 in Darkest Hour 2026, and notable achievements in Tio CTF. Currently seeking opportunities in cybersecurity roles and internships where I can apply my defensive security skills to protect organizations from evolving threats.

Top 1% TryHackMe Global
10+ CTFs Competed
3 Certifications
02

Writeups

CTF solutions and security deep-dives

Walkthrough

Memory Forensics with Volatility 2 & 3

A complete memory forensics guide: Volatility 2 vs Volatility 3 and when to use each, installation, acquisition, and a full Windows investigation workflow with side-by-side commands for processes, network, injection, files, registry, credentials, timelines, and Linux memory.

Memory Forensics Volatility Volatility 3 Volatility 2 +2
Beginner → Advanced • ~45 min read · ⏱ 37 min Read
Walkthrough

Steganography for CTFs & Forensics

A practical steganography guide: a repeatable methodology, then images (PNG/JPEG/GIF/BMP), audio (spectrograms, LSB, DTMF, SSTV), text and whitespace, documents, and password attacks, with the real commands and small Python scripts for each technique.

Steganography Forensics Image Forensics Audio Forensics +1
Beginner → Advanced • ~35 min read · ⏱ 27 min Read
5 writeups

Friendly Securinets CTF 2026

Walkthroughs for 41 Friendly Securinets CTF 2026 challenges: forensics from file repair to memory, TLS, cloud and hardware analysis, plus one reverse-engineering and one web challenge.

Friendly Securinets CTF 2026 Forensics Reverse Engineering Web Security
41 Challenges • Forensics • RE • Web · ⏱ 2 min Read
Hard

Cybertek CTF — Malsou9a

Full analysis of a .NET malware implant found in a memory dump — from DLL extraction and AES key recovery to C2 communication, PDF payload analysis, and JavaScript deobfuscation to retrieve the flag from Azure Blob Storage.

Memory Forensics Malware Analysis AES Encryption C2 Analysis +3
Memory Forensics • Malware Analysis · ⏱ 7 min Read
View All Writeups
03

Projects

Personal security tools and research

Security Research

Continuous Adversary-Emulation Lab

A summer-internship platform that continuously validates whether real CVEs in an organization's own software are actually exploitable — and whether the SOC detects them — by safely reproducing each finding in a disposable, network-isolated sandbox behind strict human approval gates.

Purple Team Detection Engineering Zero Trust Vulnerability Management +2
View Details
Tool

Paravizor — Recon Orchestration Platform

A terminal-native recon copilot for bug bounty and offensive security: a Go pipeline engine that orchestrates external tools into reproducible, crash-safe campaigns, normalizes and triages the results into one SQLite datastore, and keeps the human in control of every decision.

Reconnaissance Bug Bounty Automation Go +2
View Details
Security Research

XWorm v3.1 — Malware Analysis & Config Decryption

A deep-dive technical analysis of the XWorm RAT (v3.1), covering its layered loading mechanism, AES-256 configuration decryption, C2 protocol, and multi-component persistence strategies.

Malware Analysis Reverse Engineering .NET Cryptography +2
View Details
Tool

PackDetect — Packer Detection & Unpacking Tool

A Python CLI tool that identifies packed malware using Shannon entropy analysis, a signature database of 9 known packers, and structural heuristics that catch unknown packers — then attempts automatic unpacking via UPX and MPRESS.

Reverse Engineering Malware Analysis PE Format Entropy Analysis +2
View Details
Tool

ZipKrack — ZIP Password Cracker

A fast, lightweight Python CLI tool for cracking encrypted ZIP file passwords using dictionary attacks — featuring real-time feedback, auto-extraction, password logging, and both interactive and command-line modes.

Password Cracking Python CLI Dictionary Attack +1
View Details
04

Journey

Key milestones and achievements

2027

Technical Team Instructor — Securinets INSAT

  • Serving as a Technical Team Instructor at Securinets INSAT, teaching DFIR and forensics to club members and mentoring newcomers through hands-on labs
  • Designing and delivering hands-on workshops and CTF-style exercises to grow the club's defensive-security bench
🎓 Securinets INSAT Instructor
2026

Technical Team Member — Securinets FST

  • Joined the Securinets FST Technical Team, leading forensics workshop sessions for 30+ club members and coordinating CTF logistics
  • Secured 1st place at QnQSec CTF and Top 5 at Darkest Hour 2026, outperforming 150+ competing teams across both events
  • Reached Top 1% globally on TryHackMe (out of 3M+ users), completing 100+ rooms focused on DFIR, malware analysis, and threat intelligence
🥇 1st · QnQSec CTF 🏅 Top 5 Darkest Hour ⭐ Top 1% TryHackMe 🛡️ Securinets FST Tech Team
2025

CTF Competitor & Challenge Author — MOJO-JOJO

  • Placed Top 4 out of 200+ teams in Securinets National Qualifications and Top 7 in Finals, solving 85% of DFIR challenges
  • Joined MOJO-JOJO as a core team player and authored 4 original forensics challenges used in competitive CTF events
  • Completed the TryHackMe SOC Level 1 certification path, mastering Splunk, YARA rules, and Sysmon log analysis
🏅 Top 4 Securinets ⚔️ MOJO-JOJO
2024

Cybersecurity Foundation & Securinets Member

  • Earned the Google Cybersecurity Professional Certificate, completing 8 courses covering SIEM tools, incident response, and Linux security in under 3 months
  • Joined Securinets INSAT as an active member, participating in 5+ internal training sessions on web exploitation and forensics
  • Built and deployed 3 personal security lab environments to practice malware analysis and network traffic investigation
🛡️ Google Certified
2023

Software Engineering Student — INSAT

  • Enrolled in the National Institute of Applied Science and Technology, building a foundation in software engineering and systems architecture
  • Completed 15+ coursework modules spanning networking, OS fundamentals, and programming, scoring top 10% in core CS subjects
  • Developed initial interest in cybersecurity by self-studying 50+ hours of defensive security content on TryHackMe
05

Skills

Tools and technologies I work with daily

DFIR & Forensics

Volatility Autopsy Wireshark FTK Imager KAPE Velociraptor

Blue Team & SOC

Splunk YARA Snort ELK Stack Sysmon TheHive

Programming

Python Bash JavaScript SQL PowerShell

Tools & Platforms

Ghidra Burp Suite Git Docker Linux
06

Certifications

Google Cybersecurity

Google Cybersecurity Professional Certificate

Google · 2024
TryHackMe SOC Level 1

TryHackMe SOC Level 1

TryHackMe · Certified
Top 1% TryHackMe

Top 1% on TryHackMe

Global Ranking