Penetration Tester specializing in adversary simulation, Active Directory security, web application testing, and mobile security assessments.

Off the clock I take apart Android applications, and I automate the parts of offensive work that should not need a human.

Most of my time goes to the awkward middle of mobile security — the part after static analysis stops being useful and before you can actually reach the application logic. Packers, RASP SDKs, emulator detection, TLS pinning, Flutter apps that ignore the system trust store entirely.

The tooling here exists because I hit a wall and the existing write-ups were wrong about why.

• Reverse engineering Android apps — packers, RASP, Flutter/Dart AOT binaries
• Building multi-agent tooling for engagement work, with scope and phase gates rather than a model left to its own judgement
• Writing it down, including the approaches that didn't work

_{OffSec Certified Professional Plus · OffSec Certified Professional · Certified Red Team Analyst · Certified AppSec Practitioner v2 · Cisco CyberOps Associate — every badge links to the issuer's verification page.}

• Building an Anti-Detection Rooted AVD (Android 16 + KernelSU) — why emulator -prop cannot touch ro.*, why skip_mount silently voids system.prop, and why a CA has to be mounted into zygote
• Bypass SSL Pinning with Frida & Objection
• Install a Burp CA Certificate on Android 11

More at blog.hayyvin.my.id · HTB and CTF writeups at writeup.hayyvin.my.id

_{Yogyakarta, Indonesia · everything published here comes from systems I own or was authorised to test}