# isra mabrouk

isra mabrouk is a remote worker on Himalayas, Python Developer Intern at Gexpertise, based in Tunisia.

Source: https://himalayas.app/@isramabrouk

```text
I test web applications and APIs, uncovering OAuth2, JWT, and authorization vulnerabilities.
```

| Detail | Value |
| --- | --- |
| Availability | Looking for a job |
| Location | Tunisia |
| Authorized to work in | Tunisia |
| Salary expectations | 30k+ USD |
| Job categories | Penetration Tester, Cybersecurity Engineer, Application Security Engineer, API Security Engineering, Backend Engineer, Python Developer |
| Skills | Web Application Penetration Testing (WAPT), API Security Testing, Burp suite, Web Application Testing, Manual API Testing, OWASP API Security Top 10, BOLA, Mass Assignment, Broken Function Level Authorization, OAuth, OpenID Connect, Authorization Code Flow, JWT, JWS, JWT Algorithm Confusion, JWKS, Token Forgery, REST API Authorization, RBAC, Python, requests, Threading, PyJWT, BASH, JavaScript, TypeScript, NestJS, Linux, Ubuntu, Docker, Docker Compose, Git, GitHub, Postman, fastAPI, Keycloak, MongoDB, Potree, Open3D |
| Portfolio | https://github.com/isramabrouk1/oauthoidc2026 |
| LinkedIn | https://linkedin.com/in/isra-mabrouk |
| GitHub | https://github.com/isra-mabrouk1 |

## What I'm looking for

```text
I'm seeking a short-term cybersecurity internship immediately or a longer-term PFE placement from January 2027, focused on web application and API penetration testing.
```

## About

```text
I'm a cybersecurity engineering student focused on web application and API penetration testing. I built and attacked a self-hosted OAuth2/OIDC lab, chaining an open redirect with JWT algorithm confusion to bypass authentication.

I created a concurrent Python fuzzer that surfaced BOLA, mass assignment, and broken function-level authorization issues, then documented exploit chains and remediation guidance in a penetration-test-style report.

My software engineering internships at Retalk and Gexpertise gave me practical experience building REST APIs, Python automation, MongoDB-backed tools, and systems I now approach from a security-testing perspective.
```

## Experience

### Python Developer Intern

Gexpertise. Jun 2025 - Aug 2025

```text
Part of a 2-person team building GexApp, an internal tool for processing 3D floor-plan/point-cloud data using Python, Potree, and Open3D, backed by MongoDB. Developed Python scripts to automate parts of the 3D floor-plan processing pipeline, including validation and handling of malformed input files.
```

Skills: Python, Potree, Open3D, MongoDB, Automation

### Backend Developer Intern

Retalk. Jan 2024 - May 2024

```text
Built backend REST APIs in NestJS (TypeScript) with MongoDB for a web-based page builder, enabling users to drag-and-drop UI components to construct pages dynamically.
```

Skills: NestJS, TypeScript, MongoDB, REST-APIs

## Education

### Polytech Monastir

Engineering Degree, Cybersecurity & Systems. 2024 - Present

```text
Pursuing an Engineering Degree in Cybersecurity and Systems, with a focus on web and API penetration testing.
```

### ISSAT Sousse

Bachelor of Science, Computer Science. 2021 - 2024

```text
Completed a Bachelor of Science in Computer Science, gaining foundational knowledge in software development and systems.
```

## Tech stack

- Postman
- GitHub
- Docker Compose
- MongoDB
- NestJS
- JavaScript
- Python
- FastAPI
- Ubuntu
- Linux
- TypeScript
- Keycloak
- OAuth2
- Git
- Docker
- Burp Suite
- Bash

To contact isra, message them from this profile with a Himalayas employer account: [Hire on Himalayas](https://himalayas.app/hire).

## People also viewed

- [Tlili Wijden](https://himalayas.app/@tliliwijden): Graduation Intern, Defensy
- [Bouabidi Bilel](https://himalayas.app/@bouabidibilel): Full Stack Developer, Red Sys
- [Mohamed Malek Wertatani](https://himalayas.app/@mohamedmalekwertatan): Junior Red Teamer, DefensyLab
- [Amel Ben Khalifa](https://himalayas.app/@amelbenkhalifa): Security & Backend Engineer, Sup'Com
- [Asma Neji](https://himalayas.app/@asmaneji): Cyber Threat Intelligence Intern, TudigiSec by Nomios
- [Mehdi Belhaj Amor](https://himalayas.app/@mehdibelhajamor): Cyber Security Consultant, Forvis Mazars
- [anwer saad](https://himalayas.app/@anwersaad): Cybersecurity Analyst, Kubekloud
- [Mohamed Bilel Hrizi](https://himalayas.app/@mohamedbilelhrizi): Computer Science Student, National School of Computer Science (ENSI)
- [Khayem Zribi](https://himalayas.app/@khayemzribi): Software Engineering Intern, Digitalize
- [youssef ben chaouacha](https://himalayas.app/@youssefbenchaouacha): Intern, Security Platform Development, VadaSoft