Stanford University

PhD student

Stanford, California, United States

Hack Lab (INTLPOL 268) Teaching Assistant

- Lab: Zakir Durumeric (Assistant Professor, Author of Zmap, Co-founder of Censys)
-  Research: Developing mass internet scanning tools to illuminate causes for insecure servers. Patching existing research libraries such as zcrypto & zgrab2. Maintaining custom network scanning infrastructure

Undergraduate Research Assistant

- Conducted vulnerability research on Firebase, and analyzed its security properties. Worked with Firebase teams to resolve vulnerabilities, and make aware security & design level issues. Developed signals to detect dangerous Firebase configurations
-  Performed product security reviews and worked with teams to remediate vulnerabilities
-  Conducted an internal security engagement modeling insider threat

Google

Security Engineering Intern

Purpose: to guide students through hands-on labs meant to give a solid understanding of the most common types of attacks used in cybercrime and cyberwarfare. In these lab sections, students attack a known insecure system using techniques and tools seen in the field. By the end of the course, students are expected to have a working knowledge of the most popular hacking techniques seen in the wild and the skills necessary to power further exploration.

Hack Lab (IPS 268) Teaching Assistant

Conducted penetration testing on client companies’ commercial and staging environments
-  External penetration tests:
Compromised publicly exposed client infrastructure including web servers, application hosts, etc
Phishing engagements through Gophish Framework, open source intelligence, and Cobalt Strike for C2
-  Internal penetration tests:
Spread laterally through Active Directory domains and obtained system level control of domain
controllers
Performed security assessments on client software, web and mobile applications
-  White box testing: reviewed client source code for improper implementation or logical flaws
-  Black box testing: examined traffic through Burp, probed user input & upload, OWASP top 10

Wilson Nguyen