- OPERATOR
- Ataberk · ataberk-xyz
- ROLE
- Senior Security Engineer @ Midas
- CONTRACTS
- Solidity · EVM · Move (Aptos, Sui)
- OFFENSIVE
- Active Directory · web & network
- LLM & AGENTS
- gossipcat · MCP · Claude Code · LLM & agent pentest
- TOOLING
- Foundry · Python · TypeScript
- CERTS
- OSCP · OSWE · CRTP · C-AI/MLPen
- TRACK
- ex-Hacken (Principal) · ex-Halborn (Lead)
- SINCE
- August 2026 · İstanbul
- STATUS
- BREAKING THINGS ✓
I'm a Senior Security Engineer at Midas. Before that, Principal Smart Contract Auditor at Hacken (2023–2026) and Lead Offensive Security Engineer at Halborn. I started out in penetration testing — web apps, networks, Active Directory — and moved into smart contract security. I also build tooling like gossipcat-ai.
Certifications
Offensive Security Certified ProfessionalOSCP
Offensive Security Web ExpertOSWE
Certified Red Team ProfessionalCRTP
Certified AI/ML PentesterC-AI/MLPen
Recognition
n-day research on a Microsoft SQL Server stack overflow — analyzed the bug, wrote a working exploit (writeup)CVE-2019-1068
T-Mobile Hall of Fame — XSS, SQLi, RCEHOF
Mail.ru Hall of Fame — Cross-Site ScriptingHOF
gossipcat-ai — multi-agent code-review orchestrator (TypeScript / MCP); agents cross-verify findings against real code to filter hallucinationsOSS
Security advisories
Found and responsibly disclosed in widely-used software. Full writeups and PoCs: Arsenal →
Kata Containers — Dragonball guest-to-host escape via virtio OOB writeGHSA-ppr3-83x7-g97w
Apple macOS — cd9660 kernel crash via crafted disk imageCVE-2026-84567
install-artifact-from-github — install-time RCE, no integrity checkCVE-2026-73864
stream-json — quadratic path filters block the event loopCVE-2026-71429
node-re2 — global match infinite loop, unbounded memoryCVE-2026-68499
node-re2 — OOB heap read via lastIndex, uncatchable crashCVE-2026-67550
node-re2 — process abort in replace()CVE-2026-71430
Kentico CMS — stored XSS via avatar uploadCVE-2019-19493
Skills
- Offensive
- Internal & external pentest · Active Directory attack paths (Kerberoasting, NTLM relaying, Pass-the-Hash) · phishing & social engineering
- Smart contracts
- Audit delivery · DeFi threat modeling · invariant & PoC development
- Vuln research
- n-day research · patch diffing · fuzzing & crash minimisation · coordinated disclosure
- Orchestration
- Multi-agent review pipelines · consensus verification & hallucination filtering