Mizar Ismu Arief
Loading ThemeToggle...
Loading ThemeToggle...

    Loading...

    About Me

    I am a Red Team Specialist and Security Researcher focused on offensive security with an ethical hacking approach. Based in Indonesia, I have a deep passion for discovering system vulnerabilities, developing custom penetration testing tools, and competing in international CTF competitions.

    With a proven track record of discovering 7+ critical vulnerabilities including RCE exploitation and Admin Bypass in real-world systems, I combine theoretical knowledge with hands-on penetration testing experience. My specializations include Web Application Security, Vulnerability Research, Custom Tool Development, and Advanced Exploitation Techniques.

    I believe that the best security comes from understanding the attacker's mindset. Through a Red Team approach, I help organizations understand the real-world threat landscape and strengthen their defensive posture. Every vulnerability discovered is an opportunity to build more secure systems.

    Beyond penetration testing, I am actively involved in security research, open-source tool development, and knowledge sharing through CTF WriteUps and security Blog . I also maintain a fundamental understanding of Blue Team operations to provide a more comprehensive perspective in security assessments.

    Mizar

    Loading...

    Loading...

    Loading...

    Loading...

    Loading...

    Latest WriteUps

    View all WriteUps →Medium Blog →

    Loading...

    Mizar

    Cybersecurity researcher, CTF player, Gamer, and Web Developer based in Indonesia

    Quick Links

    • About
    • Projects
    • Experience
    • Blog

    Connect

    GitHubTwitterLinkedIn

    CTF Teams

    • TCP1P

    © 2025 Mizar. All rights reserved.

    Mizar

    Penetration Tester | CTF Player | Security Researcher

    Offensive security professional specializing in vulnerability discovery, custom tool development, and ethical hacking. Turning security weaknesses into organizational strength through comprehensive penetration testing.

    3+
    Years of Experience
    2+
    Security Tools
    root@kali:~# whoami
    
    
                                ╱(㇏⌃•۵•⌃ノ)╲
     _____ ___         ___     _   ___     
    | __  |_  |___ ___|_  |___| |_|   |___ 
    |    -|_  |- _| . |_  |  _|  _| | |  _|
    |__|__|___|___|  _|___|___|_| |___|_|  
                  |_|                           
    Penetration Tester | CTF Player | Web Developer
    
    root@kali:~# ls -la skills/
    
    total 42
    drwxr-xr-x  2 mizar mizar 4096 May 22 06:23 .
    drwxr-xr-x 10 mizar mizar 4096 May 22 06:23 ..
    -rwxr-xr-x  1 mizar mizar 8192 May 22 06:23 web_security.sh
    -rwxr-xr-x  1 mizar mizar 12288 Dec 19 15:23 web_exploitation.py
    -rwxr-xr-x  1 mizar mizar 8192 Dec 19 15:23 custom_pentest_tools.c
    -rwxr-xr-x  1 mizar mizar 6144 Dec 19 15:23 vulnerability_research.rb
    -rwxr-xr-x  1 mizar mizar 5120 Dec 19 15:23 ctf_exploits.go
    -rwxr-xr-x  1 mizar mizar 4096 Dec 19 15:23 security_automation.js
    -rw-r--r--  1 mizar mizar 2048 Dec 19 15:23 blue_team_knowledge.md
    
    root@kali:~# ./initialize_red_team_ops.sh
    
    [+] Loading penetration testing...
    [+] Initializing vulnerability scanners...
    [+] Custom tools ready for deployment...
    [+] Red Team operations: ACTIVE
    

    Skills & Expertise

    Red Team Core Skills

    Web Application Security

    SQL Injection
    Cross-Site Scripting (XSS)
    Remote Code Execution (RCE) Exploitation
    PHP disable_functions Bypass Techniques
    Authentication & Authorization Bypass
    File Upload Security Bypass
    IDOR (Insecure Direct Object Reference)
    Cross-Site Request Forgery (CSRF)
    Security Misconfiguration Exploitation

    Penetration Testing Methodologies

    Blackbox Penetration Testing
    Penetration Testing Execution Standard (PTES)
    OWASP Top 10 Assessment

    PENETRATION TESTING TOOLS & TECHNOLOGIES

    Primary Tools

    Burp Suite
    OWASP ZAP
    Nmap
    SQLMap
    Metasploit Framework
    Kali Linux Environment
    Additional tools and technologies are utilized as needed depending on specific penetration testing requirements and target environments.

    Custom Developed Tools

    KEDEF - KODExplorer Credential Tester
    WormHole - Network Access Optimization
    ListSlicerDork - Advanced Target Filtering
    [Private Tools] - Specialized Vulnerability Scanners

    Technical Foundations

    Programming & Scripting

    Python
    Bash
    PHP
    JavaScript
    C++
    GO

    Operating Systems & Infrastructure

    Linux
    Windows
    Docker
    Virtual Machines
    Web Servers (Apache, Nginx)

    Databases & Data Management

    MySQL
    PostgreSQL
    SQLite
    NoSQL (MongoDB)

    CTF Competition Specializations

    Web Exploitation
    OSINT
    Boot2Root
    Cryptography
    Miscellaneous
    Digital Forensics
    Reverse Engineering (basic)

    Professional Security Practices

    CVSS Scoring & Risk Assessment
    Professional Penetration Testing Reports
    Executive Summary Presentations
    Technical Remediation Guidance
    Ethical Disclosure Procedures

    Defensive Security Awareness

    Wazuh SIEM Implementation
    Security Monitoring Principles
    Incident Response Fundamentals
    Log Analysis Techniques
    Threat Hunting Basics

    Security Research & Development

    Academic Research Collaboration
    Open Source Security Tool Contribution
    Vulnerability Discovery & Reporting
    Security Community Knowledge Sharing
    Continuous Learning & Skill Development

    Professional Experience

    My journey in the cybersecurity realm

    Penetrasi Testing website client
    Freelance
    18 Januari 2025 - 19 Januari 2025
    Remote
    • Metode pentest yang digunakan adalah blackbox, karena client hanya mengirimkan url website saja.
    • Website target menggunakan teknologi CodeIgniter 3.
    • Dari hasil pentest, berhasil menemukan sebuah celah keamanan, seperti ada kerentanan pada library Dompdf (Versi 1.2.0), PhpSpreadSheet (Versi 1.0.1). Kedua kerentanan tersebut bisa diexploitasi ketika berhasil masuk kedalam dashboard.
    • Selain itu juga menemukan kerentanan PHPUnit (Versi 4.8.36), dimana kerentanan tersebut memiliki kerentanan RCE tanpa perlu login (CVE-2017-9841). Client meminta untuk coba exploitasi nya, dan ditahap exploitasi CVE-2017-9841 ini, karena website client dideploy menggunakan salah satu layanan hosting di indonesia, dari pihak hosting melakukan pencegahan seperti RCE. Namun dari berbagai cara, berhasil melakukan bypass nya dan berhasil melakukan RCE seperti hanya menampilkan id server saja yang cukup untuk dibuktikan sebagai kerentanan. Selain itu juga saya buatkan rekomendasi dan saran pencegahan nya
    Blackbox Pentest
    Web Exploitation
    Reporting
    Penetrasi Testing pada salah satu subdomain Universitas Perjuangan Tasikmalaya
    Universitas Perjuangan Tasikmalaya
    -
    Remote
    • Metode Menemukan celah URL Parameter Manajemen Keuangan. Halaman tersebut untuk mengelola Master Keuangan dengan hak akses admin atau akses tingkat tinggi. Tetapi saya bisa mengelola master keuangan dengan hak ases sebagai user biasa atau mahasiswa.
    • Melakukan Pentest pada fitur cetak kartu UTS/UAS. Dengan melakukan pentest tersebut dapat ditemukan cara bypass dengan manipulation URL untuk melakukan cetak kartu UTS/UAS meskipun ada tunggakan.
    • Melakukan Pentest pada halaman TA/Skripsi. Pada halaman tersebut terdapat celah pada form upload dokumen TA/Skripsi yang bisa diexploitasi dengan cara bypass pada saat upload dokumen dengan ektensi php.
    • Membuat laporan atas penemuan bug pada sistem Universitas Perjuangan Tasikmalaya dan laporan tersebut diserahkan kepada TIK
    Blackbox Pentest
    Web Exploitation
    Reporting

    Featured Projects

    Level up your knowledge with my latest creations

    LVL 42
    AntiSlotV8
    Craft engaging XSS challenges effortlessly with CTF-XSS-BOT. This template simplifies setting up an environment for Capture The Flag competitions.
    XP8500 / 10000
    Defensive
    Web
    Security
    Malware Scanner

    June 2024 - Present

    LVL 38
    WormHole
    Shortcut to the core. WormHole is your personal portal to any system. It bypasses all those pesky redirects and dives straight into the heart of a network.
    XP7600 / 10000
    Pentest
    Bruteforce

    Dec 2024 - Present

    LVL 35
    LISTSLICERDORK
    listslicerdork is a powerful Bash script designed to streamline the process of filtering large lists of targets generated by dork generators
    XP7000 / 10000
    Docker
    Containerization
    PHP
    WordPress

    Sep 2024 - Present

    Swipe left or right to navigate

    CTF Achievements

    Battle-tested in the digital arena

    Achievement Board

    Rank 4
    Legendary
    Event: 0ByteCTF 2024
    Team: Individual
    Top 1
    Legendary
    Event: CyberAcademy CTF Agustus 2025
    Team: Individual
    Top 1
    Legendary
    Event: CyberAcademy CTF September 2025
    Team: Individual
    Best Write Up
    Epic
    Event: CTF Cyber Specters
    Team: Individual
    Multiple Solutions
    Epic
    Event: CyberAcademy Challenges
    Team: Individual
    View more achievements

    CTF Guilds

    TCP1P
    Member
    LVL

    TCP1P is Indonesian CTF community dedicated to organizing engaging Capture The Flag events and collaborating with local competitions. Our mission is to elevate the quality of CTF challenges in Indonesia and foster a thriving cybersecurity ecosystem through knowledge sharing.

    Members
    -
    Specialties
    8
    Web Security
    Binary Exploitation
    Cryptography
    Forensics
    Reverse Engineering
    Blockchain
    OSINT
    Mobile Security
    Anon Cyber Team (ACT) - Region Jawa Barat
    Member
    LVL

    AnonCyberTeam adalah komunita IT Security Indonesia yang terbentuk tahun 2015 tepatnya tanggal 21 January. ACT komunitas IT Security yang membahas tentang Exploit , Web Developer , Network Infrasturktur , Dan juga kejahatan kejahatan dalam dunia internet.

    Members
    -
    Specialties
    8
    Web Security
    Binary Exploitation
    Cryptography
    Forensics
    Reverse Engineering
    Blockchain
    OSINT
    Mobile Security
    View more guilds

    Notable Achievements

    Key accomplishments and contributions in cybersecurity

    🏆 Key Accomplishments

    7+ Critical Vulnerabilities Discovered
    Vulnerability Research
    Real-world systems including university and e-commerce platforms
    RCE with Function Bypass
    Advanced Exploitation
    Successfully bypassed PHP disable_functions (system, exec, shell_exec)
    Git Exposure Research
    Information Disclosure
    Identified sensitive information disclosure on multiple Indonesian platforms
    Custom Tool Development
    Tool Development
    3 published GitHub tools with community adoption
    Academic Research
    Research & Development
    Defacement detection system with measurable security improvements

    🔬 Current Research Focus

    Advanced Web Application Exploitation Techniques

    Researching new methods for identifying and exploiting web vulnerabilities

    Automated Vulnerability Discovery & Validation

    Developing tools for automated security testing and validation

    Custom Penetration Testing Tool Enhancement

    Improving existing tools and creating new specialized utilities

    CTF Challenge Creation & Security Education

    Creating educational content and challenges for the security community

    Ethical Hacking Methodology Optimization

    Refining penetration testing methodologies and best practices

    📝 Knowledge Sharing

    CTF Write-ups

    Detailed technical solutions for complex security challenges

    Security Blogs

    Practical penetration testing insights and methodologies

    Tool Documentation

    Comprehensive guides for custom security utilities

    Community Contribution

    Open source security tool development and maintenance