Cybersecurity Researcher & Penetration Tester

Abdulmalik Adebayo

I find security vulnerabilities before attackers do. Specialising in web & API security, with real-world findings in responsible disclosure, authorised penetration tests, and bug bounty programmes. BSc Cybersecurity student at Uniosun — and builder of tools, CTF labs, and writeups that give back to the community.

See My Findings Work with me

Skills & Tooling

Web Vulnerabilities
SQLiXSSCSRF SSRFXXEFile Upload Bypass Business LogicBroken Auth HTTP Parameter PollutionCommand Injection IDORBroken Access Control
API Security
BOLABFLAMass Assignment JWT AttacksExcessive Data Exposure GraphQLSOAP Unrestricted Resource Consumption CORS MisconfigurationOWASP API Top 10
Other Techniques
Information DisclosureNo Rate Limiting Subdomain EnumerationDirectory Enumeration WordPress ReconHTTP Request Smuggling
Exploitation Tools
Burp SuiteParam Miner Turbo IntruderAutorize sqlmapXSStrikedalfox jwt_toolHashcat ffufArjun
API & GraphQL Tooling
PostmanInQLAltair graphql-copCrackQL clairvoyancebatchqlgraphw00f
Development & Infra
PythonNode / ExpressFlask JavaScriptKali Linux DockerCTFdVPS (OVH)

25+ vulnerability classes  ·  30+ tools used or built

Certifications

ASCP — API Security Certified Professional
APIsec University
Certified in Cybersecurity (CC)
ISC²
Junior Cybersecurity Analyst
Cisco NetAcad
Google Cybersecurity Certificate
Google / Coursera

Projects

RootPath Linux Learning Platform

An interactive Linux learning platform covering 28 lessons from Linux Basics for Hackers. Zero dependencies — pure HTML, CSS, and Vanilla JS with a live WebAssembly Linux kernel running entirely in the browser. Built for students on slow connections and low-end devices; no build step, no frameworks, no npm.

HTML5CSS3Vanilla JSWebAssemblylocalStorageVercel
VulnSchool CTF Lab

A deliberately vulnerable web application built for hands-on security training. Covers real-world vulnerability classes including SQLi, XSS, IDOR, JWT attacks, SSRF, mass assignment, and business logic flaws.

Node / ExpressMongoDBDockerRender
NACSS Bank CTF CTF Lab

A deliberately vulnerable banking application built to train the Uniosun cybersecurity club (NACSS). 14 flags spanning SQLi, XSS, IDOR, JWT attacks, SSRF, mass assignment, and business logic — hosted via Docker and CTFd.

FlaskSQLiteDockerCTFdGitHub
PassForge Security Tool

Cryptographically secure password generator using crypto.getRandomValues() — no Math.random() shortcuts. Entropy you can trust, deployed on Vercel.

JavaScriptWeb Crypto APIVercel

Security Findings

Laravel Debug Mode — Information Disclosure High
Identified exposed Ignition error pages on a private target leaking PII, bcrypt password hashes, full stack traces, filesystem paths, and SMTP credentials to unauthenticated users. Classified as CWE-200. Responsibly disclosed to the organisation.
Stored XSS & IDOR — Medical Application High
During an authorised assessment of a doctor/patient system, discovered persistent cross-site scripting in the patient notes field and an IDOR allowing any authenticated user to access other patients' records by manipulating IDs.
Excessive Data Exposure, CORS Misconfiguration & Missing Rate Limiting — POS Backend Medium
Authorised penetration test on a live FastAPI POS backend (Render-hosted). Confirmed three distinct vulnerabilities: API responses returning full internal objects, permissive CORS policy accepting arbitrary origins, and unenforced rate limits on authentication endpoints.
Responsible Disclosure — Microfinance Bank Medium
Identified and responsibly disclosed a security vulnerability to a Nigerian microfinance bank. Coordinated directly with the institution's technical team.

Writeups

GraphQL Security Assessment: From Exposed API Keys to SQL Injection Aug 2026

A walkthrough of a GraphQL API assessment on a business application — six confirmed findings including exposed API keys and SQL injection.

GraphQLSQLiAPI Security
ShopLite CTF — Full Web Penetration Test Writeup May 2026

Full penetration test writeup on the HIVE CONSULT infrastructure — 11 vulnerabilities identified and documented.

Web AppCTFPen Test
DVAPI CTF Walk Through Apr 2026

Complete walkthrough of the DVAPI deliberately vulnerable API lab using Burp Suite, XJWT.io, and Hashcat.

API SecurityJWTBurp SuiteHashcat
Penetration Test Report — Cyber Pride Security Group CTF Apr 2026

Formal penetration test report produced for the Cyber Pride Security Group CTF assessment.

Web AppCTFReport Writing
VulnBank Penetration Test Report Mar 2026

Penetration test report against VulnBank (vulnbank.org) — documenting vulnerabilities in a simulated banking environment.

Web AppBankingReport Writing
Lab Report: CSRF Testing on Banking Application Jan 2026

Hands-on lab report covering Cross-Site Request Forgery testing methodology applied to a banking application.

CSRFBankingLab Report
Lab Report: Business Logic Vulnerability in Money Transfer Jan 2026

Lab report documenting a business logic flaw in a money transfer flow and the real-world impact it would have.

Business LogicBankingLab Report

Get in touch

Open to freelance penetration testing engagements, bug bounty collaborations, and security consulting. Response within 24 hours.

Email olanrewajuabdulmalik42@gmail.com
LinkedIn malik-cybersec
GitHub AdebayoAbdulmalik
X / Twitter @malik_cybersec
Medium abdulmalikadebayo