ROBINX0
OFFENSIVE SECURITY · RED TEAM
IRFANUL MONTASIR.
OFFENSIVE SECURITY ENGINEER
//
SHORBORNO HOLDINGS
//
DUBAI, UAE
I work in offensive security - penetration testing, Active Directory exploitation, EDR bypass & AV evasion, source-code review, and building open-source offensive tooling for authorized engagements at Bangladesh's largest telco.
OPERATOR-PROFILE.ini
name
Irfanul Montasir
handle
robinx0
role
Offensive Security Eng.
company
Shorborno · Grameenphone
location
Dubai, UAE · UTC+4
education
B.Sc. CSE · IIUC '23
status
open to collab
CLICK CARD TO VIEW PHOTO
IM
75+
Machines pwned
06
Certifications
OSCP · CRTO · CPTS
eWPTX · eCPPT · eJPT
eWPTX · eCPPT · eJPT
04
HTB pro labs
APT · Dante · Rasta · Asc.
#1·#2
CyberDrill ntl.
#31
BlackHat MEA '23
02
Publications
Featured projects
Open-source releases & research I'm shipping
Lacunex CE
LACUNEX · 2026
The Community edition holds Local-first desktop report builder for pentesters, auditors, and consultants. Block editor, severity-aware findings, 10 ready-made templates, 6 cover designs, optional local Ollama AI. Exports to PDF, HTML, Markdown, Word, and JSON. Reports stay on your machine - no cloud, no telemetry, no account.
- Local-first pentest report builder
- Block-style editor for findings and evidence
- Severity-aware vulnerability tracking
- Built-in report templates for audits, incidents, and exams
- One-click export to PDF, HTML, Markdown, DOCX, and JSON
- Custom cover pages with live preview
- Screenshot and attachment handling
- Optional local AI assist through Ollama
ElectronReactViteTypeScript
allspray
ALLSPRAY · 2026
Web-based SSH credential spray and post-exploitation tool. CSV-driven scan, dedicated PE tab, AutoRoot with command placeholders, air-gapped compatible. Currently at v5.2.
- FastAPI + WebSocket backend
- CSV target ingestion
- AutoRoot with _CMD_ placeholder
- Air-gapped deployment
PythonFastAPIJavaScript
Recent writeups
Technique & methodology walkthroughs
#001
Apr 19
›
#002
Apr 18
›
#003
Apr 17
›
#004
Apr 17
›
#005
Apr 16
›
#006
Apr 14
›
AD Privilege Escalation Primitives: Kerberoasting, Shadow Credentials, RBCD, Injection, and BOFs
Server-Side Web Pentest Playbook: Prototype Pollution, OAuth Flaws, SQLi-to-RCE, and SSRF
The Userland EDR Bypass Stack: Unhooking, Syscalls, ETW/AMSI, and Kernel Callbacks
Building a C2 Stack: Implants, BOF Loaders, Redirectors, and DoH Channels
DCSync and DCShadow: Abusing Replication Rights for Credential Theft and Persistence
Hardware Breakpoint Hooking: Bypassing Inline EDR Hooks Without Touching Memory
Browse by category