Looking for a job

Alexander Petrushchenkov

@alexanderpetrushchen

Penetration tester and security researcher at Freelance, uncovering SSRF chains and AI assistant data-exfiltration flaws.

Georgia

Message

At Freelance, I test production targets through HackerOne, Bugcrowd, and Intigriti. I chained SSRF in a document export feature to file access through an exposed Chrome DevTools Protocol socket, recovering production database credentials.

I also investigate AI assistant security, including system prompt extraction, indirect prompt injection, and markdown-based data exfiltration. I publish working exploits on GitHub and technical write-ups at cubit.blog, and bring hands-on experience in Active Directory testing and defensive security.

Experience

Work history, roles, and key accomplishments

Current

Penetration Tester / Security Researcher

Current

Freelance

Feb 2024 - Present (2 years 7 months)

Conducts security testing on live production targets across HackerOne, Bugcrowd, and Intigriti, with accepted findings for Swiss Federal Railways and eToro. Develops working exploits from public advisories and performs AI assistant security assessments.

Burp suite OWASP ZAP Sqlmap Ffuf Nuclei Katana WPScan OAuth IDOR BOLA SSRF Prompt Injection Chrome DevTools Protocol Next.js Curl_cffi Python BASH Vulnerability Research Exploit Development

Current

Technical Translator

Current

Freelance

Mar 2023 - Present (3 years 6 months)

Provides Russian/English translation for industrial clients, covering infrared measurement, pyrometry, metrology, network equipment, procurement, and expert evaluation documentation.

Translation Russian English Technical Documentation Industrial Equipment Pyrometry Metrology

Current

CTF Player

Current

Hack The Box

Mar 2023 - Present (3 years 6 months)

Participates in CTF competitions with team PacketRippers and completes HTB Season challenges. Publishes technical write-ups and achieves full-chain compromise of multi-host Active Directory environments.

Active Directory NetExec BloodHound Impacket BloodyAD Certipy Rubeus Mimikatz Power View SmbMap Evil WinRM AD CS Abuse (ESC1–ESC8)Kerberos Attacks NTLM Capture and Relay CTF

Engineer

Diagnost Ltd

Sep 2009 - Feb 2023 (13 years 5 months)

Designed, calibrated, integrated, and deployed industrial sensing, infrared/thermal measurement, and power control systems. Additionally handled IT and systems administration, including incident response for ransomware and malicious WordPress plugin removal.

Industrial Sensing Infrared Measurement Temperature Measurement Power Control Instrumentation Calibration Integration Field Deployment IT Administration Incident Response Ransomware Recovery WordPress Security

Education

Degrees, certifications, and relevant coursework

Rochester Institute of Technology

MicroMasters, Cybersecurity

2020 - 2022

Completed a MicroMasters program in Cybersecurity with a capstone project and hands-on labs in network security, route construction, and digital forensics using EnCase.