I'm Aymane Boualam, a Cybersecurity Analyst and Penetration Tester based in Rabat, Morocco, focused on offensive security, secure infrastructure design, and building tooling that makes security testing faster and more precise.
Role: Cybersecurity Analyst & Penetration TesterFocus: Offensive Security / AppSec / Secure InfrastructureFrameworks: NIST · ISO/IEC 27001 · OWASP Top 10Mindset: Build it secure. Break it properly. Document it clearly.🎯 Open To: Penetration Testing roles · SOC / Security Analyst positions · AppSec Engineering · Freelance security assessments · Collaboration on open-source security tooling
Languages
Frontend
Backend & Databases
Cloud, DevOps & Security Tooling
🛡️ BrovanaRange — Secure Open-Source Cyber Range Platform
A full-stack offensive security training platform supporting isolated labs, in-browser terminal access, dynamic flags, and live scoring.
| Stack | React · FastAPI · PostgreSQL · Docker · Nginx |
| Scale | Multi-tenant, per-user isolated lab environments |
| Performance | Containerized lab spin-up with network segmentation |
| Security | HTTPS reverse proxy, UFW firewalling, Docker network segmentation, JWT auth, RBAC, rate limiting, security headers, audit logs |
| Impact | OWASP WSTG-inspired control validation; Suricata & Zeek IDS monitoring with custom alert rules |
| Repository | github.com/Aymwvn/BrovanaRange |
Designed and hardened as a real deployable platform rather than a demo — every exposed service was validated with Nmap, curl, and Gobuster-style testing, and network isolation was independently verified via Docker network inspection.
🤖 AI-Assisted Pentest Co-Pilot
A CLI tool that fuses traditional recon tooling with LLM-based analysis (Claude API or local models) to accelerate the pentesting workflow.
| Stack | Python · Claude API / Local LLM · CLI |
| Scale | Multi-tool ingestion (Nmap, Gobuster, Whatweb, ffuf, Nikto) |
| Performance | Automated cross-tool finding correlation |
| Security | NVD-based CVE lookups with CVSS scoring |
| Impact | MITRE ATT&CK technique mapping; auto-generated DOCX/PDF/Markdown reports |
| Repository | github.com/Aymwvn/AI-Assisted-Pentest-Co-Pilot |
Built to close the gap between raw scan output and a client-ready report — reducing manual triage time while keeping every finding traceable to evidence.
🏴 CTF Writeups
A structured collection of cybersecurity writeups documenting the methodology, exploitation process, privilege escalation techniques, and lessons learned from Capture The Flag (CTF) challenges across multiple security domains.
| Stack | Markdown · Kali Linux · Burp Suite · Nmap · Gobuster · Metasploit · Wireshark |
| Coverage | Web · Pwn · Reverse Engineering · Cryptography · DFIR · OSINT · Steganography · Networking · Hardware · AI |
| Methodology | Reconnaissance → Enumeration → Exploitation → Privilege Escalation → Post-Exploitation → Documentation |
| Security Focus | OWASP, Active Directory, Linux Privilege Escalation, Web Exploitation, Binary Exploitation, Digital Forensics |
| Impact | Demonstrates practical offensive security skills, structured reporting, and reproducible attack methodologies |
| Repository | github.com/Aymwvn/CTF-Writeups |
Each writeup follows a consistent methodology, documenting reconnaissance, attack vectors, exploitation steps, privilege escalation techniques, evidence collection, and remediation insights. The repository serves as both a personal knowledge base and a public portfolio showcasing hands-on offensive security experience.
🖥️ Enterprise Virtual Lab — System & Network Security Setup
A self-built multi-machine infrastructure simulating an enterprise network for security practice and monitoring.
| Stack | VirtualBox · CentOS · Windows Server 2022 · Windows 10 |
| Scale | Multi-VM domain environment |
| Performance | Active Directory, DNS, SSH/RDP, iSCSI storage configured end-to-end |
| Security | Log analysis, basic incident detection, access control configuration |
| Impact | Zabbix monitoring across Apache/PHP/MariaDB and FTP services |
| Repository | Self-hosted lab environment |
Replicates a realistic corporate network to practice detection and hardening beyond isolated CTF-style targets.
🕸️ Web Application Penetration Testing Lab — OWASP Juice Shop
Hands-on offensive testing lab targeting the intentionally vulnerable OWASP Juice Shop application.
| Stack | Kali Linux · Nmap · Burp Suite · Gobuster |
| Scale | Full application surface enumeration |
| Performance | Manual + tool-assisted vulnerability discovery |
| Security | Identified and exploited SQL Injection, XSS, and IDOR vulnerabilities |
| Impact | Professional penetration test report with PoC evidence |
| Repository | Lab environment |
Used as a structured exercise to practice professional report writing alongside exploitation technique.
"Security isn't a feature you bolt on — it's a discipline you build in from the first line of code."