Skip to content
OPEN TO SECURITY & BACKEND INTERNSHIPS

Mohammad Sakawat Kabir

Security-Focused Backend & Systems Developer

Computer Science undergraduate building secure, real-world systems, with hands-on experience in penetration testing, networking, threat detection, backend engineering, and self-hosted AWS infrastructure.

core strengths

Penetration Testing LabsSecure Backend SystemsNetworkingLinux & Cloud InfrastructureCompetitive Programming
View résuméGitHubLinkedInEmail me

THM Rank

Top 4%

MAGE · 91-day streak

Hack The Box

8 owns

Script Kiddie rank

Problems

500+

solved online

Codeforces

Pupil

1201 rating · 1226 max

Identity

$ whoami

/usr/bin/whoami
$ whoami
> Handle       : Basilisk13
> Name         : Mohammad Sakawat Kabir
> Location     : Bangladesh
> Role         : Security-Focused Backend & Systems Developer
> Education    : Third-year B.Sc. student in Computer Science and Engineering
> Institution  : Chittagong University of Engineering & Technology (CUET)
> TryHackMe    : Basilisk13 (MAGE · Top 4%)
> Hack The Box : Basilisk13 (Script Kiddie)
> Availability : open to security & backend internships

$ cat mission.txt
I build dependable backend and infrastructure systems, then test and harden them through hands-on security work.

Platforms

Where I practice and compete

TryHackMe

Basilisk13

Tier: MAGE · Top 4%

Global rank: 96,056 · Streak: 91d

Rooms: 102 · Badges: 12

Hack The Box

Basilisk13

Rank: Script Kiddie

Points: 8 · User owns: 4

System owns: 4

Codeforces

s_kbr13

Rank: Pupil

Rating: 1201 · Max: 1226

Problems: 500+ across online judges

Technical Skills

Tools I use to build and secure systems

Languages

PythonCC++C#JavaTypeScriptBash

Backend & Data Engineering

FastAPIDjangoSpring BootPostgreSQLMySQLRedisSQLETLData ModelingData CleaningData Validation

Security & networking

Penetration TestingNetwork Traffic AnalysisThreat DetectionScapyeBPF/BCC

Systems & infrastructure

LinuxDockerAWS EC2GitNginx Proxy ManagerTwingate

Selected Work

Security, backend, and systems in practice

Security Platform

Real-Time Cyber Attack Monitoring & Threat Intelligence Platform

Self-hosted real-time cyber attack monitoring and threat intelligence platform. Detects SQLi, XSS, brute-force and DDoS with a hybrid rule + ML engine, ships via lightweight log agent, and streams events to a live dashboard.

Challenge
Security signals are fragmented across logs and difficult to triage in real time.
What I built
Built a self-hosted detection pipeline with a lightweight log agent, hybrid rule + ML engine, WebSocket event stream, and live dashboard.

Detects SQLi, XSS, brute-force, and DDoS activity.

TypeScriptWebSocketMLCybersecurity

Awarded Hackathon Project

CinemaSeat

A concurrency-safe movie-ticket booking platform built around one invariant: a seat is never sold twice, even under competing requests.

Challenge
Concurrent booking requests can sell the same seat twice.
What I built
Combined Redis atomic holds (SET NX EX) with PostgreSQL unique constraints so double-booking is structurally prevented.

1st Runner-Up · Zero to Production Hackathon 2026.

TypeScriptPostgreSQLRedisConcurrency

Infrastructure

Self-Hosted Cloud Server

A secure, containerized self-hosted cloud platform built with Nextcloud, MariaDB, Redis, Pi-hole, Nginx Proxy Manager, and Twingate — providing private file storage, sync, HTTPS access, local DNS, and zero-trust remote connectivity.

Challenge
Personal services needed private storage, local DNS, HTTPS, and secure remote access without relying on a single SaaS vendor.
What I built
Containerized Nextcloud, MariaDB, Redis, Pi-hole, and Nginx Proxy Manager, then exposed them through Twingate zero-trust access.

Private file sync, HTTPS access, local DNS, and remote connectivity on a self-hosted stack.

DockerNextcloudPi-holeTwingate

Security Lab

Full Custom DNS Spoofer with Scapy

An educational Python toolkit for custom DNS spoofing with Scapy: MAC manipulation, network scanning, ARP spoofing, packet sniffing, and targeted DNS response interception in authorized lab environments.

Challenge
Understanding DNS interception requires seeing the complete packet path rather than treating spoofing as a black box.
What I built
Built an authorized-lab toolkit covering MAC manipulation, discovery, ARP spoofing, packet sniffing, and targeted DNS responses.

End-to-end Scapy workflow for isolated DNS-spoofing labs.

PythonScapyARPKali Linux

Automation

Basilisk Shell

An AI-powered Linux terminal assistant that converts natural-language requests into audited Bash commands with layered safety checks, risk-gated execution, multilingual understanding, and command history logging.

Challenge
Natural-language shell assistants can turn ambiguous requests into unsafe commands.
What I built
Added audited command generation, layered safety checks, risk-gated execution, multilingual input, and command-history logging.

Commands remain reviewable before execution instead of being run blindly.

PythonBashNLPLinux

Full-Stack

CUET Insights

A Spring Boot + MySQL platform for CUET students, faculty & alumni — complaint tracking, innovation showcase, resource sharing, JWT-secured auth.

Challenge
CUET community workflows for complaints, ideas, and shared resources were scattered across disconnected channels.
What I built
Built a Spring Boot and MySQL platform with JWT-secured access, complaint tracking, innovation showcases, and resource sharing.

One role-aware platform for students, faculty, and alumni.

JavaSpring BootMySQLJWT
View all projects

GitHub Activity

@sakawatkabir13 at a glance

active

16

Public repositories

stars

5

Across all public repos

followers

2

Following 3 accounts

Live GitHub statistics · refreshed hourly

language ticker

primary languages

PythonTypeScriptJavaCSSShell

Languages ranked by the number of public repositories where they are the primary language on github.com/sakawatkabir13.

achievement chips

unlocked

YOLOPull Shark

contribution heatmap

last 12 months

AugSepOctNovDecJanFebMarAprMayJunJul
81 contributions in the last year
LessMore

Live commit activity scraped directly from github.com/sakawatkabir13.

Achievements

Competition and hackathon highlights

1st Runner-Up — Zero to Production

IEEE Computer Society CUET × Poridhi.io · Aug 2026

Built CinemaSeat with team Cuet cryptic_knights: a concurrency-safe booking system designed so the same seat cannot be sold twice.

View supplied certificate →

Team rank 111 — CUET IUPC 2025

CUET CSE FEST · Dec 2025

Competed against university teams from across Bangladesh in the CUET CSE FEST 2025 Inter-University Programming Contest, earning team rank 111.

ICPC Asia Dhaka Preliminary

ICPC · Nov 2024

Competed in the ICPC Asia Dhaka Preliminary 2024.

View supplied certificate →

7th Place — Junior Programming Contest

CUET Computer Club · Mar 2024

Placed seventh in the intra-university Junior Programming Contest organized by the CUET Computer Club.

Certifications

Verified credentials

Hacker Holidays

TryHackMe · Aug 2026

Seasonal red-team / blue-team challenge rooms covering web exploitation, forensics, networking, and cryptography.

View credential

Associate Data Engineer

DataCamp · Feb 2026

SQL fluency for log analysis — reading and writing the queries that surface SQLi, brute-force, and exfiltration patterns in security data.

View credential

CompTIA Network+ (N10-009) — Certificate of Completion

CBT Nuggets · Dec 2025

Certificate of completion issued by CBT Nuggets for the CompTIA Network+ (N10-009) course — covering OSI & TCP/IP, subnetting, routing & switching, wireless, and network security troubleshooting.

View credential

Journey

Recent milestones and shipped work

2026 · Augmilestone

1st Runner-Up · Zero to Production Hackathon

Built CinemaSeat with team Cuet cryptic_knights and placed 1st Runner-Up in the IEEE Computer Society CUET × Poridhi.io hackathon.

hackathoncinemaseatconcurrency
2026 · Augtool

Real-Time Cyber Attack Monitoring & Threat Intelligence Platform

Self-hosted cyber attack monitoring platform with hybrid rule + ML detection for SQLi, XSS, brute-force, and DDoS.

typescriptmlsecurity
2026 · Julmilestone

TryHackMe: MAGE tier · Top 4%

Unlocked the MAGE tier and reached the global Top 4% on TryHackMe.

thmmage
2026 · Aprmilestone

Hack The Box: Script Kiddie

First HTB owns: 4 user + 4 system, Script Kiddie rank, working from CUET's hostel network.

htblab
2026 · Martool

Self-Hosted Cloud Server

Containerized private cloud with Nextcloud, MariaDB, Pi-hole, Nginx Proxy Manager, and Twingate.

dockerself-hosted
2026 · Martool

Full Custom DNS Spoofer with Scapy

Educational Scapy toolkit for isolated lab environments: ARP spoofing, sniffing, DNS interception.

scapysecuritylab
View earlier milestones
2026 · Febtool

Hermes Cloud Agent Lab

Reproducible personal AI agent stack on AWS EC2 with Telegram gateway, Ollama, model routing.

awsollamaagents
2026 · Febcert

Associate Data Engineer (DataCamp)

Completed the Associate Data Engineer track: SQL fluency for log analysis, data cleaning, validation, and exploratory analysis.

datacampsqlsecurity
2026 · Febtool

Basilisk Shell

Built an AI-assisted Linux terminal assistant to convert natural language to audited Bash commands.

pythonailinux
2026 · Janmilestone

TryHackMe: Top 15%

Pushed to Top 15% on TryHackMe — 33 rooms, 3 badges, 13-day streak, 34 points.

thmlearning
2025 · Deccert

CompTIA Network+ (N10-009)

Completed the CBT Nuggets CompTIA Network+ (N10-009) course, strengthening practical networking and troubleshooting skills.

networkingcomptia
2025 · Decmilestone

IUPC at CUET CSE FEST 2025

Competed against university teams from across Bangladesh in the CUET CSE FEST 2025 Inter-University Programming Contest, earning team rank 111.

cpcontest
2025 · Marmilestone

Codeforces Pupil Rank

Reached Pupil on Codeforces after sustained practice across div 2 and div 3 contests.

cpcodeforces
2024 · Novmilestone

ICPC Asia Dhaka Preliminary

Competed in the ICPC Asia Dhaka Preliminary in November 2024.

cpicpc
2024 · Marmilestone

7th Place — Junior Programming Contest

Placed seventh in the intra-university Junior Programming Contest organized by the CUET Computer Club.

cpcontest
2023 · Octmilestone

Competitive Programming Origin

Started the CP grind on online judges. First taste of algorithmic thinking under contest pressure.

cplearning

Researcher's Toolkit

Interactive tools built into the site

root@basilisk:~#
algo
0 chars
output

Client-side only. Nothing leaves your browser.

Writeups

Latest from the blog

WriteupAug 12, 2026

DNS Spoofing in a Lab: What Scapy Teaches You About Trust

Notes from building a custom DNS spoofer in an isolated lab. What I learned about why DNS is the protocol we love to break.

#scapy#networking#lab#security
CVE BriefAug 8, 2026

CVE Brief: Stack-Based Buffer Overflow in Legacy VPN Appliances

A concise breakdown of a pre-auth stack-based buffer overflow affecting legacy VPN gateways — including its impact, affected deployments, and mitigations.

#cve#vulnerability#analysis
view all writeups

Capture the Flag

Three challenges hidden in this site

session: guestsolved: 0/3status: active
flag 01 · easy

Base64 Beacon

A Base64 string is hiding somewhere in the HTML comments of this page. Decode it to find the flag.

flag 02 · medium

Source Inspector

A CSS class name in this site holds a clue encoded with ROT13. Find the class and decode it.

flag 03 · medium

Console Broadcast

Open the browser developer console. A ROT13-encoded message is broadcasting from this site. Decode it.

Three flags are hidden in this site. Inspect the source, decode the clues, submit below. Solve all three for a badge in the footer.

Let's connect

Open to cybersecurity and backend internships, collaborative builds, and conversations about securing systems in practice.

Email meGitHubTryHackMeHack The Box