Yu-Hsiang Huang

Associate Technical Manager

Obtained MCP certification in server management, proficient in Microsoft operating system. Familiar with server operations such as AD, DNS, DHCP, and IIS.

--------------------

Proficient in system development using PHP/Laravel, Python, as well as other languages like VB.net, Rust, etc. The technologies used include but are not limited to:

[

console, Redis, relational database, multi-thread, multi-process, dependency injection, restful API, schedule, queue, broadcast, i18n, unit test, Selenium, mock, one-click installation.

]

Completed projects:

1. Independently developed CMS for many companies.
2. Used GitLab API and Docker SDK, and integrated Nessus and other security tools to develop an automated security assessment system.
3. Independently developed a security automation framework for reproduction and revalidation.
4. Independently weaponized the Python package <TFTPY> as a penetration testing tool.

Side projects & special achievements:

1. Independently developed a program to receive the network traffic information using the SNMP protocol and visualize it graphically.
2. Independently developed a hexagonal menu and a moving light bar using JavaScript and other technologies.
3. Independently developed a multi-threaded websocket server using PHP & VB.Net.
4. Independently developed malicious programs such as brute-force tools, vulnerability PoCs, webshells, packet manipulators, and used WinAPI to control the operating system.
5. Independently used and modified the Python package <BooFuzz> to develpoed a fuzzer.
6. Independently developed Nessus plugins.
7. Independently developed the legal programs to save on cybersecurity software licenses, which can save tens of thousands to hundreds of thousands of New Taiwan Dollars per year, depending on the scale of usage.

--------------------

In the field of cybersecurity, I have obtained the ECSA certification and referred to OSWE study materials, considering myself to have a level of expertise above that of OSWE.

Completed projects:

1. Participated in the handling of major cybersecurity incidents for government agencies.
2. Completed numerous penetration testing tasks for many companies, identifying high, medium, and low-risk vulnerabilities, totaling hundreds of system vulnerabilities. Even obtained the RCE vulnerabilities in several commercial products.
3. Assisted two employers in conducting security regulation-related tests, writing test cases, etc. For example, tests related to IEC 62443 SVV 1-4, such as compliance testing, mitigation plan testing, vulnerability scanning, fuzz testing, penetration testing, and various other tests.
4. Assisted in manually reproducing and revalidating vulnerabilities, including fixing and developing PoCs.

Side projects & special achievements:

1. Ranked 344th individually, and 153rd as a team in HTB within four months.
2. Independently obtained over 40 CVEs, including some in well-known software. Some of the CVEs have been inquired about by an antivirus software company and other unspecified individuals.
3. Disclosed vulnerabilities without requesting CVEs afterwards, totaling 5 or more.
4. Undisclosed vulnerabilities total more than 16, including vulnerabilities in NETGEAR, Alcatel, Discuz! X3.4, RCE vulnerabilities in many schools, vulnerabilities in internal systems of many companies, vulnerabilities in many well-known shopping websites, and others.
5. Participated in patching the security vulnerability in the open-source project phpMyAdmin.
6. Independently created the p12 file to reproduce CVE-2022-0778 (the p12 file has been saved on GitHub and listed on cvexploits).
7. Reported a vulnerability in ZyXEL products and received a letter of appreciation.
8. Reported an information system vulnerability in Realtek and received a reward.
9. Reported the vulnerability in a company's product serial number rules to prevent the company from suffering losses.

Zhongli District, Taoyuan City, Taiwan
[email protected]

https://github.com/HuangYuHsiangPhone