Sheraz Khalid
Cyber Security Consultant
Sheraz Khalid
👋 Welcome to My Blog
I'm a Cybersecurity Consultant with over 6 years of hands-on experience in offensive security, covering web applications, mobile apps, APIs, and Active Directory environments. I work with companies to find and fix real-world vulnerabilities through focused VAPT engagements, bringing an attacker's mindset to every assessment.
Since 2020, I've been actively hunting bugs on Bugcrowd, where I currently rank #1 in Pakistan for critical and high severity findings and hold a 164th global ranking. That experience feeds directly into my consulting work at GBM, where I've been delivering end-to-end security assessments since 2023.
This blog is where I document the journey, bug bounty write-ups, CTF walkthroughs, and things I've picked up along the way. If something here helps you, that's the whole point.
Feel free to explore, and reach out if you'd like to connect or work together.
- Age 28
- Residence Islamabad, Pakistan
- e-mail daimbutt70@gmail.com
What I Do
Progress Reports
Valid Reports
400+Hall of Fames
50+Experience
6+ YearsCareer Objective
My goal is to help organizations find and fix the security flaws that actually matter, across web, mobile, APIs, network, and infrastructure. Cybersecurity is not just a profession for me. It's what I genuinely enjoy, and that curiosity drives everything from client engagements to late night lab sessions and bug bounty hunting.
Resume
Education
2016 - 2018
University of Central PunjabADP IT Management
The program brings together key elements of IT and business management. With a strong focus on real-world projects and hands-on learning, it prepares students to tackle modern business challenges using practical technology solutions.
Experience
2023 - Present
Gulf Business Machine (GBM)Cyber Security Consultant
- Led and delivered end-to-end VAPT projects covering web apps, APIs, mobile apps, and IP infrastructure.
- Collaborated with teammates on phishing simulations and red team engagements.
- Acted as a primary point of contact for clients — from scoping to delivery.
- Helped clients understand risk reports clearly and guided them in remediation efforts.
- Ensured timely delivery of assessments with actionable recommendations.
2019 - Present
BugcrowdBug Bounty Hunter
- Actively hunting security vulnerabilities since 2019 — here’s my profile
- Reported 390+ valid bugs across multiple private and public programs
- Earned over 3,100 reputation points and currently ranked #174 worldwide
- Specialize in identifying high-impact issues such as XSS, IDOR, SQLi, and authentication flaws
- Received multiple Hall of Fame mentions and program-specific recognitions
2021 - 2023
SynackSynack Red Teamer
- Conducted private, high-impact security assessments across various enterprise assets
- Identified and reported vulnerabilities with detailed PoCs through the Synack platform
- Maintained a strong acceptance rate and contributed to high-signal research efforts
Certifications
2025 - 2028
Altered SecurityCRTP (Certified Red Team Professional)
Focused on Active Directory exploitation techniques from a red teamer's perspective.
View Certificate
Research
2020 - Present
Personal / CommunityPublished CVEs
Published multiple CVEs for vulnerabilities identified in third-party software:
Pentesting Skills
Web Application Pentesting
API Pentesting
Network Pentesting
Active Directory Pentesting
Coding / Other Skills
Bash
Python
HTML/CSS
Linux
Googling
Tools
- Burp Suite
- SQLMap
- FFUF
- Metasploit
- Linux
- Wireshark
- BloodHound
- CrackMapExec
- Impacket
Acknowledgement
- Ebay
- Fedex
- Dell
- Under Armour
- Wise
- Indeed
- Upwork
- Bugcrwd
- Bugcrowd MVP - Multiple quarters
- Top 10 on Bugcrowd Leaderboard - January 2024
- CRTP
- Ranked #174 Globally on Bugcrowd
