Web & API Pentest • Secure Code Review • Offensive Research
Hi, I’m Soroush — a web penetration tester and cybersecurity researcher based in Tehran. I test enterprise B2B web apps and APIs, review code, and turn vulnerabilities into clear reports teams can actually fix.
$ whoami
>Soroush Babaei — Web Penetration Tester
$ pwd
>/home/soroush/web-api-pentest/research
$ grep -i "focus" profile.log
>focus: Web/API pentest, secure code review, Windows Internals
About Me
I work on web application and API penetration testing, secure code review, and vulnerability research. At Chargoon, I assess enterprise B2B products with a focus on authentication, authorization, access control, and critical business workflows.
Before moving deeper into offensive security, I worked as a deep learning engineer at Roshan, building Python-based models for time-series forecasting and market prediction. That mix of software, ML, and security shapes how I investigate problems today.
Skills & Certificates
Web and API testing across OWASP Top 10, authentication, access control, SQL injection, SSTI, XSS, IDOR, and business logic flaws.
Currently sharpening red team fundamentals, offensive workflows, reconnaissance habits, OPSEC thinking, and clear evidence collection.
Hands-on training around practical security hardware, attack surfaces, and gadget-assisted offensive security workflows.
Training and practice around Windows Internals, WinDbg, Volatility, Windows API, C/C++, and offensive programming concepts.
Work Experience
Testing enterprise B2B web applications and APIs, validating high-impact vulnerabilities, reviewing code, and preparing actionable reports with PoC evidence and remediation guidance.
Built and fine-tuned Python-based deep learning models for time-series forecasting, crypto market prediction, news-driven pipelines, and image data workflows.
Education
Thesis: extracting neural network model structures using side-channel attacks. I also hold a B.Sc. in Computer Science from the University of Gilan, with coursework in data structures, algorithms, operating systems, and networks.
Projects
A recon tool that combines passive sources with active DNS techniques and filters live assets with Httpx for more reliable web testing targets.
Project DetailsMy M.Sc. research explores techniques for inferring neural network architecture and model structure using side-channel attack ideas.
Project DetailsA TensorFlow multi-label classification project using image and text inputs to predict product attributes like gender, season, and category.
Project DetailsBlog
Contact
You can reach me by email at Soroushbbi@aut.ac.ir or by phone at 09303933787. I’m based in Tehran and happy to connect around web security, research, and practical tooling.
