01
eJPT
Junior Penetration Tester
Practical offensive-security foundation
Umut Can Yurdayardım · Penetration Tester
Security is neverjust the job.
I’m a penetration tester and vulnerability researcher with a genuine passion for security. I assess systems, validate vulnerabilities, and report findings clearly so they can be understood and fixed.
01 · Certifications
Certifications along the way.
eJPT, eWPTX, and CEH mark different stages of my development in offensive security, supported by the hands-on work I continue to do.
02
eWPTX
Web Application Penetration Tester eXtreme
Advanced web exploitation and assessment
03
CEH
Certified Ethical Hacker
Broad attack-surface and security methodology
02 · Vulnerability research
Research, documented.
Two CVE records assigned through independent vulnerability research and responsible coordination with the affected vendors.
CVE-2026-13432
VIEW RECORDPublished through the CVE Program following independent research and responsible disclosure.
CVE-2026-10029
VIEW RECORDPublished through the CVE Program following independent research and responsible disclosure.
03 · Selected projects
Built from the work.
Open-source security tooling shaped around practical assessment workflows, local control, and useful output.
GITHUB PUBLIC REPOSITORY
WIRELESS · LINUX
Airynox
A local-first wireless penetration testing dashboard that brings Wi-Fi analysis, handshake capture, rogue AP, and authorized lab workflows into one real-time interface.
- PYTHON
- FASTAPI
- WEBSOCKETS
- LINUX
GITHUB PUBLIC REPOSITORY
ANDROID · STATIC ANALYSIS
APKra
A fast, fully offline APK analyzer for triaging secrets, weak cryptography, unsafe manifests, network security issues, and other mobile risks.
- PYTHON
- JADX
- ANDROGUARD
- HTML REPORTS
04 · Attack surface
What I work on.
My main focus is web application and API security, alongside practical experience in network and mobile penetration testing.
Web Applications
Deep manual assessment of authorization, authentication, business logic, injection paths, and client-server trust.
API Security
Object- and function-level authorization, token handling, workflow abuse, schema behavior, and data exposure.
Network
Infrastructure discovery, service enumeration, segmentation review, and configuration testing.
Mobile
Android application assessment across storage, transport, platform configuration, and backend interaction.
05 · Security contributions
A record of responsible disclosure.
Selected organizations whose security I’ve contributed to by identifying and responsibly reporting vulnerabilities.
A selected view—not the full list.
06 · Contact
Let’s talk security.
For penetration testing, collaboration, or responsible disclosure, email is the best way to reach me. You can also find my work and updates through the channels below.