Skip to content

Resume

Hamza Elhadidy

Penetration tester and web engineer.

hamzaelhadidy04@gmail.com

Download PDF

Profile

Junior penetration tester with hands-on experience discovering and exploiting vulnerabilities across web, API and mobile application environments. Skilled in testing for OWASP Top 10, authentication flaws, business logic issues, API misconfigurations and Android application security vulnerabilities. Practical experience in Android application security including SMALI code modification, runtime hooking and network traffic analysis. Actively engaged in bug bounty platforms, with a focus on real-world vulnerabilities and clear, professional security reports.

Experience

  • Junior Penetration TesterJuly 2025 — present
    • Web and mobile application penetration testing, including static and dynamic analysis of Android applications.
    • Authenticated and unauthenticated testing of web and API environments, identifying SQL injection, XSS, CSRF, business logic flaws and insecure data storage in mobile apps.
    • Reverse engineered Android APKs with JADX and Ghidra; analysed and modified SMALI code for security testing and application logic manipulation.
    • Runtime instrumentation and hooking with Frida to test security mechanisms and exploit vulnerabilities.
    • Network traffic analysis for mobile applications, including intercepting encrypted communication and certificate pinning mechanisms.
    • Detailed proof-of-concept reports with recommended remediation steps.
    • Vulnerability assessments across various environments, working with developers to improve application security posture.
  • Freelance / bug bounty platforms
    • Web and API penetration testing against the OWASP Top 10.
    • Reported bugs on HackerOne and Bugcrowd.
    • Vulnerability assessments with detailed proof-of-concept reports.

Technical skills

  • Programming and scripting

    Python, C, C++, Java, JavaScript, Bash, HTML, CSS

  • Web and API security

    SQL injection, XSS, CSRF, authentication and authorisation flaws, OWASP Top 10, business logic, web cache vulnerabilities, WebSockets. PortSwigger Web Security Academy — 100+ labs. CTF challenges on RootMe.

  • Mobile security

    Android reverse engineering, SMALI code modification, runtime hooking with Frida, APK decompilation (JADX, Apktool), Ghidra, network traffic analysis, certificate pinning bypass

  • Tools and frameworks

    Burp Suite, Postman, Ghidra, Frida, JADX, Apktool, Nmap, Metasploit, automated vulnerability scanners

Education

  • Damietta UniversityComputer Science, Level 4Sep 2022 — June 2026