# Alexander Petrushchenkov

Alexander Petrushchenkov is a remote worker on Himalayas, Penetration Tester / Security Researcher at Freelance, based in Georgia.

Source: https://himalayas.app/@alexanderpetrushchen

```text
Penetration tester and security researcher at Freelance, uncovering SSRF chains and AI assistant data-exfiltration flaws.
```

| Detail | Value |
| --- | --- |
| Availability | Looking for a job |
| Location | Georgia |
| Authorized to work in | Georgia |
| Salary expectations | 35k+ USD |
| Job categories | Penetration Tester, Security Researcher |
| Skills | Penetration Testing, Web Application Security, API Security, Bug Bounty, Active Directory Security, AI Assistant Security, SSRF, IDOR BOLA, OAuth, Prompt Injection, AD CS Abuse (ESC1–ESC8), Kerberos Attacks, NTLM Capture and Relay, Digital Forensics, Incident Response |
| Website | https://cubit.blog |
| Portfolio | https://cubit.blog |

## About

```text
At Freelance, I test production targets through HackerOne, Bugcrowd, and Intigriti. I chained SSRF in a document export feature to file access through an exposed Chrome DevTools Protocol socket, recovering production database credentials.

I also investigate AI assistant security, including system prompt extraction, indirect prompt injection, and markdown-based data exfiltration. I publish working exploits on GitHub and technical write-ups at cubit.blog, and bring hands-on experience in Active Directory testing and defensive security.
```

## Experience

### Penetration Tester / Security Researcher (current)

Freelance. Feb 2024 - Present

```text
Conducts security testing on live production targets across HackerOne, Bugcrowd, and Intigriti, with accepted findings for Swiss Federal Railways and eToro. Develops working exploits from public advisories and performs AI assistant security assessments.
```

Skills: Burp-suite, OWASP-ZAP, Sqlmap, Ffuf, Nuclei, Katana, WPScan, OAuth, IDOR-BOLA, SSRF, Prompt-Injection, Chrome-DevTools-Protocol, Next.js, Curl\_cffi, Python, BASH, Vulnerability-Research, Exploit-Development

### CTF Player (current)

[Hack The Box](https://himalayas.app/companies/hack-the-box). Mar 2023 - Present

```text
Participates in CTF competitions with team PacketRippers and completes HTB Season challenges. Publishes technical write-ups and achieves full-chain compromise of multi-host Active Directory environments.
```

Skills: Active-Directory, NetExec, BloodHound, Impacket, BloodyAD, Certipy, Rubeus, Mimikatz, Power-View, SmbMap, Evil-WinRM, AD-CS-Abuse-(ESC1–ESC8), Kerberos-Attacks, NTLM-Capture-and-Relay, CTF

### Technical Translator (current)

Freelance. Mar 2023 - Present

```text
Provides Russian/English translation for industrial clients, covering infrared measurement, pyrometry, metrology, network equipment, procurement, and expert evaluation documentation.
```

Skills: Translation, Russian, English, Technical-Documentation, Industrial-Equipment, Pyrometry, Metrology

### Engineer

Diagnost Ltd. Sep 2009 - Feb 2023

```text
Designed, calibrated, integrated, and deployed industrial sensing, infrared/thermal measurement, and power control systems. Additionally handled IT and systems administration, including incident response for ransomware and malicious WordPress plugin removal.
```

Skills: Industrial-Sensing, Infrared-Measurement, Temperature-Measurement, Power-Control, Instrumentation, Calibration, Integration, Field-Deployment, IT-Administration, Incident-Response, Ransomware-Recovery, WordPress-Security

## Education

### Rochester Institute of Technology

MicroMasters, Cybersecurity. 2020 - 2022

```text
Completed a MicroMasters program in Cybersecurity with a capstone project and hands-on labs in network security, route construction, and digital forensics using EnCase.
```

### Moscow Aviation Institute (National Research University)

Master's degree, Aircraft Testing. 2003 - 2009

```text
Earned a Master's degree in Aircraft Testing, focusing on the testing and evaluation of aircraft systems.
```

## Tech stack

- Splunk
- cURL
- Python
- C#
- Kibana
- Snort
- Wireshark
- Linux
- Windows
- Docker
- Burp Suite
- sqlmap
- Nmap
- Metasploit
- OWASP ZAP
- Bash
- Nuclei
- Suricata

To contact Alexander, message them from this profile with a Himalayas employer account: [Hire on Himalayas](https://himalayas.app/hire).

## People also viewed

- [Daniel Iliaevi](https://himalayas.app/@danieliliaevi): Information Systems Penetration Testing Specialist, LEPL Pension Fund of Georgia
- [Evgenii Kashtanov](https://himalayas.app/@evgeniikashtanov): Information Security Trainer, Startrainer
- [riven ivern](https://himalayas.app/@rivenivern): Penetration Tester, Orient Logic
- [Ani Khmelidze](https://himalayas.app/@anikhmelidze): Cybersecurity Mentor, Business and Technology University
- [Lasha Tarkhnishvili](https://himalayas.app/@lashatarkhnishvili): Vulnerability Management Analyst, Flutter Central & Eastern Europe
- [Mikheili Keshelava](https://himalayas.app/@mikheilikeshelava): Information Security Specialist, Silk Hospitality
- [davit gvritishvili](https://himalayas.app/@davitgvritishvili): Security Analyst (SOC), National Defence Forces
- [Giorgi Shakarashvili](https://himalayas.app/@giorgishakarashvili): Software Quality Management, Security & Test Automation Engineer, Liberty Bank
- [Anton Kulikov](https://himalayas.app/@antonkulikov): Senior Specialist, Systems and Technical Support Department, Municipal Institution Center for Supporting the Activities o
- [Vladimir Kolosov](https://himalayas.app/@vladimirkolosov): Senior Python Developer / Anti Bot & DevOps Engineer, UMAX