Offensive Security Operator @ Armadin

Derek Haber

~/ _

Breaking things
before others do.

I'm an offensive security professional specializing in web application security and adversarial consulting. At Armadin, I conduct offensive assessments that uncover real-world vulnerabilities and provide organizations with actionable risk intelligence.

With a background in application security engineering, I bridge the gap between builder and breaker, bringing a developer's intuition to offensive work. I also integrate AI tooling into security workflows for enhanced efficiency and coverage.

Focus Area
Web Application Security
Engagement Type
Offensive Consulting
Employer
Armadin
Specialization
AI-Augmented Assessments

What I Do

Offensive Security Consulting

Adversarial assessments that go beyond automated scanning. I simulate real-world threat actors, giving organizations an unfiltered view of their attack surface and true risk exposure.

Red Teaming Threat Modeling Attack Simulation Risk Assessment

AI-Augmented Assessments

Leveraging large language models and AI tooling to enhance offensive security workflows — from intelligent reconnaissance to automated vulnerability analysis and coverage at scale.

LLM-Assisted Recon Intelligent Fuzzing Automated Analysis AI Security

Vulnerability Research

Independent research into real-world projects — auditing source code and developing proof-of-concept exploits in open source and closed source applications.

Code Auditing Exploit Development Responsible Disclosure CVE Research

Public Projects

01

Atlas ASM

Open source attack surface management platform built on free tooling. Discovers subdomains, validates live hosts, scans open ports, runs Nuclei templates, and pulls known emails and breached credentials from public sources.

Python ASM Recon OSINT
02

Argus Proxy

Lightweight Java-based HTTP intercepting proxy and web application security scanner. Features real-time traffic interception, active/passive scanning (XSS, CSRF, SQLi), and request manipulation for offensive testing.

Java Proxy Web Security Scanner
03

Candid

Mobile app for sharing vintage-filtered photos exclusively with your close friend group. No public feeds, no algorithmic discovery — only your circle can see your moments.

TypeScript Mobile Social

Upcoming Talks & Events

Loading schedule…

Research & Writing

// CVEs

CVE-2026-47182 May 2026

Broken Access Control on Private Files — Frappe

Any authenticated user can access private files by guessing the file path, bypassing access control restrictions on the Frappe Framework.

View Advisory →
CVE-2026-44205 May 2026

Stored Cross-Site Scripting (XSS) in User Profile — Frappe

A stored XSS vulnerability in the user profile image section allows attackers to execute malicious scripts in the browsers of other users through image uploads.

View Advisory →
CVE-2026-44448 May 2026

Missing Authorization in ERPNext — Frappe

Missing authorization checks on administrative API endpoints allowed low-level users to edit purchase order (PO) status and assign users to customer profiles beyond their permitted role. Affects versions prior to 14.28.0.

View Advisory →
CVE-2025-52888 Jun 2025

XXE Injection in Allure 2 XML Parsing Plugins — Allure Framework

XML External Entity injection in Allure 2's xunit, JUnit, and TRX result-processing plugins. Unsafe DocumentBuilderFactory configuration allows remote code execution via malicious test reports.

View Advisory →