Imrane T.

Brussels, Belgium · Offensive Security | Attack Chains & Business Logic · Detectify

29 followers

About

I focus on how authorization, identity and business logic break across API-driven systems.

Most of my work starts with a simple question: what happens when the backend trusts something it shouldn't?

I test authentication flows, object ownership, multi-tenant boundaries and API behavior, then look at how individual weaknesses can connect into larger attack paths.

Focused on SaaS, API-first systems and Web3 infrastructure.

Specialties

  • Blockchain Security
  • Ethical Hacking
  • Penetration Testing
  • Security Automation
  • Web Application Testing

Skills

  • Web/API Pentesting
  • Attack Surface Mapping
  • Recon Automation
  • Vulnerability Chaining
  • OSINT
  • Infra Analysis
  • Burp Suite
  • DevTools
  • Python
  • PowerShell

41 skills in total

Experience

  • Security Researcher - Crowdsource

    Detectify

    Jul 2026 — Present

  • Offensive Security Researcher

    SentryTrace

    Feb 2025 — Present

    Brussels, Belgium

Repositories

  • SentryTrace/attacksaga

    Autonomous pentest agent that discovers, exploits and proves real impact in a controlled lab (OWASP Juice Shop)

    Python · 3 stars

  • SentryTrace/sentry-tools

    AI-assisted security workflow automation for authorized attack surface analysis, exposure validation, signal correlation, risk prioritization, and remediation reporting.

    Python

  • SentryTrace/sentrytrace-research

    External attack surface research and exposure analysis for SaaS and fintech infrastructures.

    1 star

Recent posts

One authenticated session. One changed member ID. One missing ownership check.

While testing an API flow, I found that changing a client-controlled memberId allowed the session to resolve another account’s preference state.

Same session.

Different account object.

HTTP 200.

The returned data itself wasn’t highly sensitive. The interesting part was the authorization boundary behind it.

I broke down the validation process, root cause and remediation here:

https://medium.com/@insid_e/when-one-integer-crosses-the-authorization-boundary-60f782538213

#APISecurity #IDOR #Authorization #AppSec

View post

**Found a GraphQL API where small issues chained into full cross-tenant compromise.**

Leaked workspace ID (client-side)

Unauth mutations (invite / waitlist)

No rate limit + batching abuse

IDOR on workspaceId (read + write)

**Impact: API keys, secrets, payments + full tenant takeover**

Write-up: https://medium.com/@insid_e/from-graphql-enumeration-to-cross-workspace-takeover-8e5a63edfcd0

View post

**Started with a JS credential leak.**

Ended with:

cross-tenant payments + webhook interception.

Fintech APIs still break the same way:

auth is there, isolation isn’t.

Write-up (sanitized):

https://medium.com/@insid_e/how-i-chained-a-hardcoded-password-into-a-cross-merchant-payment-takeover-48294c608f03

View post

**Built AttackSaga - an autonomous attack-chain agent for authorized lab environments.**

It doesn’t stop at finding bugs, it validates the full path to impact:

• authentication robustness

• access control weaknesses (IDOR)

• real data exposure proof

• structured report generation

End-to-end, from discovery → impact.

Localhost only. ScopeGuard enforced.

Repo: https://github.com/SentryTrace/attacksaga

View post

**Blind SSRF → internal services → metadata exposure**

**Small input. Real infra risk.**

View post

View Imrane T.'s profile on Cyberr