Hi there, I’m Khaled Karimeldin aka "xElkomy" 👋
Bug Hunter · Security Researcher · Pentester
🧠 About Me
I’m a passionate Information Security professional based in Egypt, specialising in 🐞 Bug Bounty (HackerOne, Detectify Crowdsource), and hands-on penetration testing across Web, Mobile & Infrastructure.
I thrive on solving hard challenges, writing detailed exploit write-ups, and sharing what I learn with the community.
🚀 What I Do
- Participate actively in bug-bounty platforms (HackerOne, Detectify) and produce high-impact reports.
- Explore advanced mobile/Android attack surfaces (e.g., AIDL-based IPC: Root Bypassing, Intent Hacking).
- Dive deep into Windows authentication protocols (NTLM v1/v2, Kerberos, MSCache2) as part of infrastructure pentesting.
- Create PoCs, publish write-ups and open-source vulnerable machines / CTF repos to help others learn.
🧰 Skills & Technologies
Pentesting focus: Web Applications (JSF, XHTML, APIs), Mobile (Android AIDL, Messenger IPC), Infrastructure (Active Directory, NTLM, Kerberos)
Tools & Languages:
📂 Featured Projects
| Project | Description |
|---------|-------------|
| Workflow-Bug-Bounty | A curated toolkit for bug hunters: custom fuzzers, recon scripts & documentation to accelerate vulnerability discoveries. |
| FindSomething-arabic | Browser extension (Arabic language) to aid pentesters in discovering important paths/info in webpages & JS files — works passively (no outbound requests). |
| Monitorizer | Multithreaded monitoring and alert framework for subdomain discovery & scanning (supports Nuclei, Acunetix) — built for infrastructure-/automation-focused pentests. |
| check-put.sh (Gist) | Lightweight bash script example to test HTTP PUT method on target hosts — demonstrates scripting for quick reconnaissance checks. |
📣 Currently Learning / Working On
- Exploring post‐exploitation on Android via Binder & AIDL services.
- Writing a blog series on Windows authentication vulnerabilities (NTLM, Kerberos, domain trust chasing).
- Preparing for advanced pentest engagements: business-impact testing, cross-stack (web/mobile/infra) for 2025.
📫 Let’s Connect
✉️ xelkomy@duck.com
🌐 Languages
🇬🇧 English (Professional) · 🇪🇬 العربية (Native)
📌 Quick Stats
“Always be learning. Always be hunting.”