💀 Initializing recon...

Ouguahi
IMAD.

Penetration tester, red team operator, and bug bounty hunter. I find vulnerabilities before they become incidents. Every finding comes with a proof-of-concept.

Get in Touch → Download CV ↓
CompTIA Security+
HTB CWES
CRTA
ISO 27001
🏴‍☠️ YesWeHack Bounty Hunter
Scroll
About

The mind behind the hunt.

I started hacking CTFs back in 2019 — placed 3rd nationally that same year and never looked back. After graduating and spending 4 years as a cybersecurity consultant hardening enterprise email systems and running pentests, I went all in on what I do best: breaking things.

Today I'm a full-time bug bounty hunter on YesWeHack, hunting authentication flaws, logic bugs, and API vulns in production systems. I recently earned my first paid bounty — an Improper Authentication vulnerability (CWE-287) rated Medium with a CVSS of 4.8.

I'm also the creator of CloudReaper, an open-source OSINT tool that exposes origin IPs behind Cloudflare, and I hold certifications including CompTIA Security+, HTB CWES, and CRTA.
hunt3r@kali — zsh
$ whoami
imad ouguahi // TH3_HUNT3R

$ cat /etc/status
Role: Bug Bounty Hunter
Platform: YesWeHack
Location: Casablanca, MA
Education: M2 Completed — SUPEMIR
Bootcamp: DataProtect Red Team
Status: Actively Hunting

$ cat /var/log/bounties.log
[2026-03-24] MEDIUM CWE-287
Improper Authentication | CVSS 4.8
Reward: €€ (+9 pts)

$ _
4+
Years in Security
20+
Domains Hardened
1st
CTF Placement
Certifications

Earned, not given.

Industry-recognized credentials that back up the skills.

Jan 2026
CompTIA Security+ (SY0-701)
CompTIA
Nov 2025
Certified Web Exploitation Specialist
HackTheBox — CWES
Mar 2025
Certified Red Team Analyst
CWL — CRTA
May 2025
ISO/IEC 27001:2022 Associate
SkillFront
Global Threat Intel Feed ● REC
Arsenal

Tools of the trade.

Every finding comes with a proof-of-concept script.

⚔️ Offensive Security

Red TeamingPentesting AD ExploitationBug Bounty OSINTAndroid RE

🌐 Web Security

OWASP Top 10XSS / SQLi / IDOR Burp Suite ProAPI Security Logic Flaws

💀 Exploitation

MetasploitCobalt Strike BloodHoundMimikatz Impacket

🔬 Reverse Engineering

GhidraIDA Pro x64dbgGDB Binwalk

🤖 AI & Automation

LangChainRAG Pipelines Pythonn8n AI-Assisted Recon

🛡️ Defense & Standards

MITRE ATT&CKISO 27001 NISTSplunk SIEM SOC
Experience

Battle-tested.

2026 — Present
Remote / Global

Independent

Bug Bounty Hunter — YesWeHack
  • Full-time bug bounty hunter targeting web applications on YesWeHack
  • First bounty: Improper Authentication (CWE-287), Medium severity, CVSS 4.8
  • Specializing in authentication bypasses, IDOR, API logic flaws, and access control issues
  • Building custom recon and automation tooling in Python
Bug BountyWeb Hacking YesWeHackCWE-287
Dec 2020 — Dec 2024
Tangier, Morocco

GM SARL

Cybersecurity Consultant & Email Security Specialist
  • Deployed email authentication (SPF/DKIM/DMARC) across 20+ enterprise domains — 90% phishing reduction
  • Conducted Black/Gray Box penetration tests on web apps and network infrastructure
  • Led OSINT investigations for threat profiling and developed countermeasures
  • Spearheaded new branch operations in Istanbul, Turkey
  • Delivered cybersecurity awareness training to 100+ employees
SPF/DKIM/DMARCPentesting OSINTSecurity Architecture
Aug 2019 — Feb 2020
Beni Mellal, Morocco

EcoSmart Business

Web Security Developer — Internship
  • Developed secure web applications following OWASP Top 10 and Security by Design
  • Remediated SQL Injection, XSS, and CSRF through comprehensive code reviews
  • Implemented SSL/TLS encryption and integrated security testing into CI/CD
Secure DevOWASP SSL/TLSCode Auditing
Projects

Work in the field.

01

CloudReaper

OSINT tool exposing origin IPs behind Cloudflare. Multi-source engine using DNS history, SSL CT logs, and SPF records with intelligent verification scoring.

Open Source
02

Bug Bounty Hunting

Active on YesWeHack. Targeting auth bypasses, IDOR, SQLi, XSS, and API logic flaws. First bounty earned March 2026.

Active
03

Red Team Operations

Full-scope adversary emulation and advanced pentesting. Simulating real-world attack chains to strengthen security postures.

Active
04

Email Security Hardening

SPF/DKIM/DMARC deployed across 20+ enterprise domains with measurable 90% phishing reduction.

Complete
05

CTF Competitions

1st place recently, 3rd national in 2019. Active on HackTheBox and TryHackMe platforms.

Ongoing

First Bounty Earned.

Discovered an Improper Authentication vulnerability on a live production target through YesWeHack. The flaw allowed unauthorized access through a flawed authentication mechanism — reported responsibly with full PoC and remediation guidance.

YesWeHack — TH3_HUNT3R Medium · CVSS 4.8
Improper Authentication
CWE: CWE-287 Date: Mar 24, 2026 Points: +9

Hackers move fast.
Move faster.

Can your security program keep up?

Talk to me →
Contact

Let's work together.

Available for pentests, security audits, and red team ops.

Freelance & contract. Based in Casablanca, operating globally. Also open to full-time offensive security roles.

Email ouguahii@gmail.com GitHub github.com/TH3-HUNT3R LinkedIn linkedin.com/in/imad-ouguahi X @TH3_HUNT3R_ HTB 69HUNT3R