Application security
Web, APIs, Android and iOS. Threat modelling, secure code review, authentication, authorization, and security architecture.
Information Security Specialist · Researcher · Builder
Stay curious.
Look closer.
Build better.
I’m Muzkkir Husseni, an information security specialist, penetration tester, and founder of Zsecures. I test applications and APIs, build security tools, and teach through hands-on labs. I also research how to assess and secure AI and LLM applications.
Muzkkir Husseni
Application security. Useful tools.
Knowledge worth sharing.
Curiosity, with a practical purpose.
~/always-learning
observe → question → investigate
observe → question → investigate
01 / A little context
Find the flaw.
Understand the reason.
I’m a penetration tester with more than seven years in security testing, spanning web applications, APIs, networks, mobile apps, and code review. For more than three years, I’ve also explored how machine learning can support the work.
I like following a finding back to the assumption that made it possible. Then I work on the part that makes it useful: clear evidence, an honest explanation of the risk, and remediation a team can put into practice.
Outside an assessment, that curiosity usually becomes a tool, a lab, or a set of notes. I learn well by building something, explaining it to someone else, and letting their questions sharpen my understanding.
AI & LLM security
AI applications and agents, prompt injection, model risk, and machine learning for security testing. PyTorch and TensorFlow.
Offensive testing
Network and Active Directory assessments, red teaming, and vulnerability validation. Burp Suite, OWASP ZAP, Nmap, and Wireshark.
Cloud & identity
AWS, Azure, containers, and Kubernetes. IAM, OAuth 2.0, OpenID Connect, and SAML.
Engineering & automation
Python, Java, Node.js, C#/.NET, Bash, and PowerShell. Security tooling, API integrations, and n8n workflows.
Assessment & advice
Secure SDLC, SAST/DAST, CVSS, and practical remediation. OWASP ASVS, NIST CSF, CIS Controls, ISO 27001, and PCI DSS.
02 / The work behind the perspective
A few chapters
along the way.
Different roles have given me different ways to look at the same question: how do we make this safer, and help the people building it?
Information Security Specialist
Enterprise security
My work brings technical assessment and security advice together. I focus on understanding application risk and making findings clear enough for teams to act on.
Penetration Tester
Contract work
I assessed applications and explained the impact of the issues I found. Clear evidence and practical remediation were central to how I approached the work.
Security Analyst
Security consulting
I developed my foundation in hands-on security testing and vulnerability analysis. That work shaped my interest in following an issue from its root cause to a useful fix.
Still a student of the work.
- RECENT TRAINING · 2026
- Completed Hack The Box’s AI Red Teamer course.
- IN PROGRESS
- OSCP+ and Hack The Box CPTS. These are current study goals, not completed credentials.
- FOUNDATION
- A postgraduate diploma in cybersecurity and a bachelor’s degree in engineering.
- EARLIER CREDENTIALS · 2021
- CEH, CHFI, CCNA Routing and Switching, MCSA, CompTIA Network+, and CompTIA A+.
03 / Ideas made useful
Built to investigate.
Made to be used.
OutBandit
I built OutBandit to help investigate application behaviour that does not show up in a normal response. It’s a Java extension for Burp Suite for out-of-band testing with HTTP and DNS interactions.
Explore OutBandit
Desktop utility
Vellum
An offline PDF editor for macOS, Windows, and Linux. Merge, split, crop, rotate, and organize documents locally, without uploading them to a service.
CTF · VulnHub
MuzzyBox
A practical lab built around injection flaws and Linux privilege boundaries. A place to investigate NoSQL injection, Python evaluation, and server-side template injection.
CTF · VulnHub
FinitHicDeo
A challenge I co-created around protocol behaviour, HTTP request smuggling, and socket programming. Built for people who enjoy understanding why a request behaves differently.
05 / Outside the terminal
Good conversations.
Better questions.
I enjoy the part of security that happens between people: a useful question after a talk, a shared lab, or an explanation that makes something click.
OWASP Ahmedabad · Speaker
Two talks.
A shared curiosity.
- Malware analysis
Understanding a sample’s behaviour and the evidence behind an analysis.
- Advanced deserialization
Looking at how serialized data crosses application trust boundaries.
Sharing what I know.
Learning what I don’t.
I make time for mentoring, tutoring, and knowledge-sharing. I also organize CTF activities to bring people together around a technical problem and give everyone room to contribute.
- DEF CON · 2025Attending, listening, and exchanging ideas.
- OWASP AhmedabadSpeaking about malware analysis and deserialization.
- null GoaCommunity participation and conversations.
- Mentoring & tutoringHelping others work through technical questions.
06 / The next chapter
More questions
worth working on.
I’m continuing to study AI red teaming, LLM applications, and the security of agents. Alongside that, I’m working toward OSCP+ and CPTS, building useful tools, and turning what I learn into clearer notes.
If you’re exploring a related research question, planning a practical workshop, or want to talk about application security, I’d be glad to compare notes.
Start a conversation
Security work. Open source. Shared learning.
Courses and writing
More to explore
Udemy course
AI Red Teaming Mastery
My published course on LLM security testing, prompt injection, and defensive techniques through hands-on labs.
View on Udemy Watch on YouTubeCheatsheets and Checklists
iOS Penetration Testing Cheatsheet
A hands-on guide to testing iOS app security using Frida, Objection, jailbreak detection bypass, SSL pinning, and runtime instrumentation—no fluff, just real techniques.
Read postCheatsheets and Checklists
Smali Debug Cheatsheet
A practical cheatsheet for reading, editing, debugging, and rebuilding Android apps at the Smali level, including Frida Gadget injection and Logcat printing.
Read postVulnerability
DNS Zone Transfers: Finding and Fixing Unrestricted AXFR
How I test DNS zone-transfer permissions, interpret the response, and restrict transfers without breaking secondary DNS servers.
Read postVulnerability
SNMP Exposure: Using Nmap and snmpwalk to Check Access
How I check SNMP exposure, interpret UDP scan results, and distinguish read access from dangerous management permissions.
Read postVulnerability
Kerberoasting, Silver Tickets, and Golden Tickets: Different Keys, Different Risks
How I separate Kerberoasting from Kerberos ticket forgery, check the prerequisites, and collect evidence that supports each finding.
Read postBlog archive
Security notes and write-ups
Explore lab walkthroughs, cheatsheets, tools, and vulnerability research.
Browse all posts