i
iqbal_latif

Iqbal

@iqbal_latif

Penetration Tester, DFIR, Cybersecurity Consultant

Pakistan
English, Urdu, Arabic
About me
Cybersecurity practitioner providing Penetration Testing, DFIR, and GRC support. I work with web and network security, vulnerability assessment, digital forensics, incident analysis, security hardening, risk assessments, and security documentation. CEH certified with hands-on experience using Burp Suite, Nmap, Metasploit, Wireshark, Splunk, Ghidra, and Linux. Focused on practical, clear, and actionable security deliverables. ... Read more

Skills

i
iqbal_latif
Iqbal
Offline • 
Average response time: 1 hour

See my services

Server Administration
I will configure wazuh siem detection rules
From$15 / projectMore details
Technical Writing
I will create soc incident response playbooks
From$10 / projectMore details

Portfolio

Work experience

Watchium_Security

Intern

Watchium Security • Part-time

Jun 2026 - Aug 2026 • 2 mos

Selected as a Top-Performing Intern within the Penetration Testing Team based on technical performance and quality of assessment work. Performed authorized black-box and grey-box web application and API penetration testing, across authentication, authorization, session management, access control, input validation, and application security controls. Conducted reconnaissance and attack-surface mapping, API enumeration, BOLA/IDOR and BFLA testing, CSRF validation, session and token analysis, rate-limit review. and controlled testing for SQL injection, XSS, command injection, and ReDoS behavior. Used Burp Suite Professional extensively for traffic interception, request manipulation, Repeater-based validation, site mapping, and evidence collection, supported by Nmap, ffuf, Nikto, curl, Browser DevTools, Kali Linux, and Fedora. Manually validated scanner observations to eliminate false positives and applied CVSS v3.1 scoring only to reproducible weaknesses with defensible impact. Identified a low-severity token-handling issue involving password-reset and email-verification tokens in URL query strings, along with several security-hardening observations. Produced an 87-page professional penetration testing report covering scope, methodology, technical evidence, findings, proof of concept, CVSS scoring, false-positive analysis, remediation recommendations, verification guidance, and final risk assessment.