Senior Cyber Security Consultant at PwC · Offensive Security & Vulnerability Researcher
With 5+ years of corporate consulting experience and 14+ years of hands-on offensive security research, I have conducted 400+ enterprise-grade penetration tests and adversary simulations and discovered 100+ zero-day vulnerabilities across critical infrastructure, enterprise software, and open-source ecosystems.
- Vulnerability Research: Root-cause analysis, reverse engineering, variant hunting, and coordinated vulnerability disclosure (CVD) across diverse software architectures, network protocols, and enterprise bug bounty programs.
- Offensive Security: End-to-end adversary simulation, red team operations, covert command-and-control (C2) engineering, and offensive capability development across modern enterprise defense perimeters.
- Penetration Testing: Full-scope security assessments spanning web & mobile applications (iOS/Android internals), internal/external networks, Active Directory & identity infrastructures, cloud environments, and AI agent surfaces.
| Project | Focus & Capabilities | ★ Stars |
|---|---|---|
| macharden | Read-only macOS security audit, baseline drift & hardening engine (54 CIS, NIST SP 800-53 & MITRE ATT&CK checks, OASIS SARIF v2.1.0, CI gates, HTML5 dashboard, zero dependencies). | |
| ghostlink | Multi-channel Out-of-Band (OOB) covert C2 and data exfiltration framework (9 covert channels, ECDHE/AES-256-GCM, XOR FEC parity, dead-drop & SQLi OOB bridge). | |
| driftnet2 | Kernel-level network sniffer, protocol dissector & credential interceptor powered by eBPF/XDP and libpcap (9 protocol engines, Hashcat-ready NTLMv2, exposure audit). | |
| mcpbait | In-process adversarial red-teaming framework for AI agents & Model Context Protocol (MCP) servers (13 MITRE ATLAS modules, canary traps, memory & schema poisoning, SARIF). | |
| evilcorp-ios | Intentionally vulnerable iOS benchmark application featuring 30 hands-on challenges mapped to OWASP MASVS v2, MASWE & CWE with embedded Frida scripts. | |
| evilcorp-android | Intentionally vulnerable Android benchmark application featuring 42 hands-on challenges mapped to OWASP MASVS v2, MASTG, MASWE & CWE with embedded Frida/ADB/jadx scripts. |
- OWASP Foundation: Contributor to the Web Security Testing Guide (WSTG), Cheat Sheet Series, and API Security Project.
- Open Source Security Tooling: Contributor to Metasploit Framework, Aqua Security Trivy, ProjectDiscovery Nuclei, and open-source security projects.
- Vulnerability Research & Disclosures: Credited author of multiple CVEs across open-source packages, enterprise software, and network appliances (tracked via GitHub CNA / GHSA, NVD, and TR-CERT), alongside a proven coordinated disclosure track record across global bug bounty programs.
Coordinated disclosures and signed communications:
Identity : Sevban Dönmez (jankesec)
PGP Fingerprint : FF0A 7D83 6751 CCE3 F9CC F574 FCF8 39FB 7F00 4626
Key ID : FCF839FB7F004626
Public Key : https://jankesec.com/pgp-key.txt
Verification : https://jankesec.com/pgp/
Signed Comms : [email protected]