p4p3r P4P3R-HAK

👋 About Me

CTF, 버그바운티, Red Teaming 기반의 웹 보안 및 취약점 연구를 중심으로 활동하고 있습니다.
K-Shield Jr. 보안사고 분석대응 과정 수료
차세대보안리더양성프로그램 (Best of the Best) 취약점 분석 트랙 수료
S-개발자 과정 수료
모의해킹 및 웹 애플리케이션 보안에 관심을 두고 지속적으로 연구하고 있습니다.
APT 공격 시나리오, 난독화/패킹 분석, BAS(Breach and Attack Simulation) 환경 구축 등 공격 시뮬레이션 기반 보안 연구를 수행하였습니다.
AI를 활용한 보안 프로젝트 경험 보유 (보이스피싱 탐지 감정 분석 모델, 랜섬웨어 악성코드 판별 시스템 등)

📚 Activities

BoB 총동문회 운영진 (2023.03 ~ 2026.03)
국제 사이버 훈련 프로그램 부멘토 (2024.09)
화이트햇스쿨 교육 조교 (2024.03 ~ 2024.04)
사이버가디언즈 보안캠프 멘토 (2023.09)
2023 하계 해킹캠프 참여 (2023.08)
BoB 12기 교육 조교 (2023.07 ~ 2023.08)

🚀 My Projects

📬 mail_trainer

mail APT 공격 훈련 솔루션
👉 바로가기

🎯 bobalkkagi

Themida 3.x Tiger Red 옵션 unpacking & unwrapping
👉 바로가기

⚔️ HTTPsBAS

APT 공격 시뮬레이션 BAS 프로젝트
👉 바로가기

🛡️ Security Research

🧠 CVEs & Vulnerabilities — (Solo Reports)

Year	CVE / KVE	Vendor	Product	Type	Url
2026	-	WordPress	wordpress.org	Stored XSS	https://hackerone.com/reports/3624450 (private)
2026	-	WordPress	bbpress.org	CSRF	https://hackerone.com/reports/3630002 (private)
2026	-	BandiSoft	Bandizip	Hard link resolution in file creation	https://kr.bandisoft.com/bandizip/history/
2026	KVE-2026-0580	chaewool	UTMP3	(private)	(private)
2026	KVE-2026-0851	SirSoft	Gnuboard7	(private)	(private)
2026	-	BandiSoft	Bandizip	Filename normalization in archive extraction	https://kr.bandisoft.com/bandizip/history/
2026	-	BandiSoft	Bandizip	File trust metadata handling (MoTW)	https://kr.bandisoft.com/bandizip/history/
2026	-	SirSoft	Gnuboard5	5.6.26 version RCE	https://github.com/gnuboard/gnuboard5/releases/tag/v5.6.27
2026	CVE-2026-42504	Google	Golang	MIME header decoding DoS	https://www.cve.org/CVERecord?id=CVE-2026-42504
2026	-	Google	Golang	X.509 certificate validation logic issue	golang/go#79833
2026	-	ScintillaOrg	Lexilla	Stack out-of-bounds write in lexer	ScintillaOrg/lexilla#364
2026	-	KOReader	KOReader	Command injection via PDF external link URI	koreader/koreader#15490
2026	CVE-2026-48142	F5 Inc	NGINX	Heap buffer over-read in charset module	https://www.cve.org/CVERecord?id=CVE-2026-48142
2026	-	WordPress	Create Block Theme	PHP RCE	https://github.com/WordPress/create-block-theme/releases/tag/v2.10.0
2026	-	WordPress	Create Block Theme	Media asset RCE	https://github.com/WordPress/create-block-theme/releases/tag/v2.10.0
2026	CVE-2026-59817	TryGhost	Ghost	Gift membership price bypass	https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf
2026	CVE-2026-57611	Apache	Commons JEXL	JexlPermissions.RESTRICTED sandbox bypass	https://www.cve.org/CVERecord?id=CVE-2026-57611
2026	CVE-2026-73250	Notepad++	Notepad++	Install path command injection	https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gp2r-262h-9hgf
2026	CVE-2026-56434	F5 Inc	NGINX	ngx_http_ssi_module Use After Free	https://my.f5.com/manage/s/article/K000162098
2026	-	WordPress	wordpress.org	REST API IDOR (removed from WordPress.org)	(private)
2026	-	WordPress	wordpress.org	Block Plugin Checker Stored XSS	https://hackerone.com/reports/3707610 (private)
2026	-	WordPress	secure-custom-fields	Unauthenticated Privilege Escalation	https://hackerone.com/reports/3815087 (private)
2026	CVE-2026-18757	Synology	DSM 7.4-90075	Public disclosure pending	Public disclosure pending
2026	CVE-2026-14681	PostgreSQL	PostgreSQL	GSSAPI/SSL encryption policy bypass	https://www.postgresql.org/docs/release/18.6/
2026	CVE-2026-74857	Synology	DSM 7.4.1-90080	Public disclosure pending	Public disclosure pending
2026	CVE-2026-86315	SAMSUNG	Escargot	Heap out-of-bounds write	https://vulnogram.org/seaview/?CVE-2026-86315

📊 Solo Statistics

🏆 CVEs/KVEs: 12
🎖️ Valid Reports: 25

🤝 CVEs & Vulnerabilities — (Team / Coordinated Reports)

Year	Team	CVE / KVE	Vendor	Product	Type	Url
2024	Vulzap	CVE-2024-24714	WordPress	Icons Font Loader (plugin)	Authenticated Arbitrary File Upload	https://www.cve.org/CVERecord?id=CVE-2024-24714

📊 Team Statistics

🏆 CVEs/KVEs: 1
🎖️ Valid Reports: 1

📚 Research Areas

Web Application Security
Source Code Review
Open Source Security
Bug Bounty
Vulnerability Research

🏆 CTF Achievements

CTF write-ups and participation history focusing on web exploitation, reverse engineering, and vulnerability research.

🥇 VishwaCTF 2026 — 1st Place (Global Ranking)

- Multiple CTF participations with competitive rankings

🧩 Competition Results

🥇 TS Security Vulnerability Finding Contest (2025)
- 🏆 Grand Prize (Team)
- 57 vulnerabilities discovered (21 personally identified)
- Focus: Web vulnerabilities
🥈 Honam Cybersecurity Conference CTF Finals (2025)
- Finalist
- 21 vulnerabilities discovered (6 personally identified)
- Focus: Web vulnerabilities

📫 Contact

GitHub: @P4P3R-HAK
Email: -

Navigation Menu