Tarek Nakkouch
Computer Science Student & Security Researcher
Hi I'm Tarek, a Final Year CS Student specializing in Offensive Security with a focus on vulnerability research, offensive security, and exploit development.
Key Achievements
Notable contributions to security research and vulnerability discovery
CVE Disclosures
Disclosed 12 CVEs across VS Code, Visual Studio, Django, Grav CMS, October CMS, listmonk, and YesWiki.
Bug Bounties
Discovered vulnerabilities across NASA, SpaceX, Google, Microsoft, and Snapchat bug bounty programs.
Leaderboard Rankings
Microsoft MSRC Q3 2025 (#60) and Q4 2025 (#48) Leaderboards, plus Google VRP Honorable Mention.
Metasploit Modules
Built a listmonk auxiliary module and a Grav CMS chain module that combines two CVEs.
CVE List
Here's a list of all disclosed vulnerabilities I discovered.
Experience
Cybersecurity Intern
Manager of Intern Solutions Team
Cybersecurity Intern
Education
Master's in Computer Science
Specializing in Cybersecurity
Casablanca • 2023 – Present
Bachelor's in Computer Science
Casablanca • 2021 – 2023
Certifications
Languages
Technical Skills
Offensive Security
Programming
Security Infrastructure
Databases & Cloud
Articles
Technical writing and security research insights
From Zero to SOC Homelab: My Journey to Defense-in-Depth and Full Security Automation
A comprehensive guide detailing the construction of a fully integrated Security Operations Center from scratch. Covers network architecture, active defenses, security automation, and how defensive technologies like WAF, EDR, and XDR work together in real-world scenarios.
Read on MediumWindows Hooking Explained
An in-depth exploration of Windows API hooking techniques, covering the fundamentals of function interception, inline hooks, IAT/EAT manipulation, and practical applications in both offensive and defensive security contexts. Includes code examples and real-world use cases.
Read on MediumProjects
Cyber Homelab
InfrastructureSecurity lab environment with Fortigate, pfSense, Splunk, Wazuh, ELK Stack, Snort, and Active Directory for security research and testing.
Custom C2 Framework
GoWeb-based Command & Control platform for Red Team operations with advanced persistence mechanisms.
Malware Crypter
C++Obfuscation tool to evade modern antivirus detection using polymorphic techniques.
Disk Serial Spoofer
Kernel DriverWindows kernel driver for hardware identification spoofing in controlled environments.
Process Hider
C++Stealth tool using Windows API hooking to conceal process execution for research.
Contact
Available for Opportunities
Casablanca, Morocco • Open to remote and on-site positions