Security Researcher

Tarek Nakkouch

Computer Science Student & Security Researcher

Hi I'm Tarek, a Final Year CS Student specializing in Offensive Security with a focus on vulnerability research, offensive security, and exploit development.

Key Achievements

Notable contributions to security research and vulnerability discovery

12

CVE Disclosures

Disclosed 12 CVEs across VS Code, Visual Studio, Django, Grav CMS, October CMS, listmonk, and YesWiki.

20+

Bug Bounties

Discovered vulnerabilities across NASA, SpaceX, Google, Microsoft, and Snapchat bug bounty programs.

MSRC #48

Leaderboard Rankings

Microsoft MSRC Q3 2025 (#60) and Q4 2025 (#48) Leaderboards, plus Google VRP Honorable Mention.

2

Metasploit Modules

Built a listmonk auxiliary module and a Grav CMS chain module that combines two CVEs.

CVE List

Here's a list of all disclosed vulnerabilities I discovered.

Visual Studio
Visual Studio & GitHub Copilot: Elevation of Privilege Vulnerability
CVE-2026-21257
Visual Studio
Visual Studio & GitHub Copilot: Remote Code Execution Vulnerability
CVE-2026-21256
Django
Django: SQL Injection in RasterField Band Index Parameter
CVE-2026-1207
Grav
Grav: Broken Access Control in Form Modification
CVE-2025-66301
Grav
Grav: Remote Code Execution via SSTI through Twig Sandbox Bypass
CVE-2025-66294
Visual Studio Code
VS Code & GitHub Copilot: Improper Access Control Leading to Remote Code Execution
CVE-2025-64660
Visual Studio
Visual Studio: Command Injection Leading to Local Code Execution
CVE-2025-62214
October CMS
October CMS: Stored XSS via Branding Styles
CVE-2025-61676
October CMS
October CMS: Stored XSS via Editor Settings
CVE-2025-61674
Visual Studio Code
VS Code & Agentic AI: Command Injection Leading to Remote Code Execution
CVE-2025-55319
YesWiki
YesWiki: Stored Cross-Site Scripting Vulnerability
CVE-2025-52277
Listmonk
Listmonk: Sprig Template Injection Leads to Environment Variable Disclosure
CVE-2025-49136

Experience

Cybersecurity Intern

Evidence Way, Casablanca
Mar 2025 – Apr 2025
Hardened Docker, Kubernetes, and Nginx using CIS benchmarks
Integrated automated vulnerability scanning into CI/CD pipelines

Manager of Intern Solutions Team

Microtech Leaders, Chicago (Remote)
Sep 2024 – Jan 2025
Assessed and benchmarked cybersecurity solutions for business needs
Led team development of training programs and secure testing environments

Cybersecurity Intern

CIH Bank, Casablanca
Feb 2024
Deployed Wazuh SIEM XDR with Suricata IDS for threat detection
Configured MISP CTI and developed threat hunting tool

Education

Master's in Computer Science

HEM Engineering School

Specializing in Cybersecurity
Casablanca • 2023 – Present

Bachelor's in Computer Science

HEM Engineering School

Casablanca • 2021 – 2023

Certifications

IBM Cybersecurity Analyst
Professional Certificate
Microsoft Azure
AZ-900 Fundamentals

Languages

Arabic
Native
French
Fluent • DALF C1
English
Fluent • Linguaskill C1

Technical Skills

Offensive Security

Penetration Testing • Exploit Development • Reverse Engineering • Malware Analysis

Programming

Python • C/C++ • Go • Assembly • PowerShell • JavaScript

Security Infrastructure

Splunk • Wazuh • Suricata • Snort • Fortigate • pfSense • Docker • Kubernetes

Databases & Cloud

MySQL • MongoDB • OracleDB • AWS • Azure

Projects

Cyber Homelab

Infrastructure

Security lab environment with Fortigate, pfSense, Splunk, Wazuh, ELK Stack, Snort, and Active Directory for security research and testing.

Custom C2 Framework

Go

Web-based Command & Control platform for Red Team operations with advanced persistence mechanisms.

Malware Crypter

C++

Obfuscation tool to evade modern antivirus detection using polymorphic techniques.

Disk Serial Spoofer

Kernel Driver

Windows kernel driver for hardware identification spoofing in controlled environments.

Process Hider

C++

Stealth tool using Windows API hooking to conceal process execution for research.

Contact

Available for Opportunities

Casablanca, Morocco • Open to remote and on-site positions