Hi, I’m Zahidul Islam 👋

Security researcher and bug bounty hunter based in Dhaka, Bangladesh.

I focus on web application and API security — finding vulnerabilities that matter, reporting them responsibly, and documenting the process so others can learn from it.

What I do

• Bug Bounty & Vulnerability Research — Active across private programs and responsible disclosure channels. Specialising in authentication bypasses, IDORs, CORS misconfigurations, and business logic flaws.
• CTF Competitions — Top 7 (Preliminary) and Top 22 (Final) at MIST CYBERRAID CTF 2025 (Bangladesh Army); Top 10 at BUET CTF 2024 and EWU CTF 2024; HackerOne BugHunt finalist 2023 & 2024.
• Security Tooling — Author of RaidScanner, an automated web scanner for SQLi, XSS, LFI and Open Redirect detection.
• Open Source — Maintainer of ShadowCam, an Android virtual camera controller (LSPosed + Kotlin).

Background

BSc in Computer Science and Engineering from IST/National University of Bangladesh. Previously worked as a Web Developer at Quanteron (USA, remote) and as an IT Support Specialist at Shaolin Science.

This Blog

Write-ups from HackTheBox, CTF competitions, and security research notes. The goal is to be useful — not just a flag dump.

Find me elsewhere

• 🌐 Portfolio
• 💼 Resume
• 🐙 GitHub
• 🔗 LinkedIn
• 📦 HackTheBox
• 🛡️ TryHackMe