↓ Skip to main content
Dinh Tuan Kiet
/

About Me

Dinh Tuan Kiet
Dinh Tuan Kiet
Offensive Security Engineer and Security Researcher specializing in manual web exploitation, binary analysis, and AI-driven cyber threat reconstruction. Strong background in network protocols, systems programming, and full-chain vulnerability assessment with 100+ solved PortSwigger Academy challenges. Dedicated to deconstructing complex adversary attack kill chains, authoring in-depth technical writeups, and bridging offensive tradecraft with intelligent defenses to safeguard critical infrastructure.
Table of Contents

Offensive Security Engineer | AI & Security Researcher
#

Tay Thanh, Ho Chi Minh City
CTFtime: ctftime.org/user/260106
GitHub: github.com/k0z1l
Facebook: facebook.com/tu4nk13t
Telegram: t.me/tu4nki3t

Education
#

Ho Chi Minh City University of Industry and Trade (2023 - 2027)
#

  • Major: Information Security
  • Current GPA: 3.59 / 4.0
  • Scholarships:
    • Outstanding Academic Scholarship (2026)
    • Merit Academic Scholarship (2024)

Awards & Honors
#

  • Honorable Mention | The 3rd TDMU Student Infosec Contest 2026

Key Skills
#

  • Programming & Scripting: Python, PHP, JavaScript
  • Security & Pentesting Tools: Burp Suite, Nmap, Wireshark, Nessus, SQLmap, Metasploit, etc.
  • Networking & Protocols: TCP/IP, OSI Model, DNS, DHCP, HTTP/S
  • Core Competencies: OWASP Top 10, Manual Web Exploitation, Source Code Review, Vulnerability Mitigation

Featured Projects & Research
#

1. Causal-TGE: Lightweight Counterfactual Attack Reconstruction
#

Under Review | Jun 2026 – Jul 2026

  • System-level Telemetry: Modeled enterprise-level temporal provenance graphs from host telemetry (process executions, socket connections, file I/O) to detect stealthy APT campaigns.
  • Attack Reconstruction: Engineered a counterfactual reconstruction engine to isolate and rank critical causal triggers within complex attack kill chains.
  • Systems Engineering: Optimized a lightweight detection framework (~46 KB footprint, sub-millisecond latency) designed for strict resource-constrained endpoint environments.

2. Tuki Fresh Flower — Secure E-commerce Platform
#

Apr 2026 – May 2026

  • Secure Architecture: Engineered a Laravel MVC backend with API integrations (VietQR, Gemini) and enforced Database Transactions to guarantee absolute data integrity during checkout.
  • Vulnerability Mitigation: Hardened application against OWASP threats by implementing Middleware RBAC, strict PDO (anti-SQLi), and a secure file upload pipeline (MIME validation, UUID renaming) to neutralize Web Shells and Path Traversal.

3. VocabMaster — Local AI English Learning Platform
#

Feb 2026 – Mar 2026

  • Built a Django backend for vocabulary and quiz management.
  • Integrated a local Ollama API for offline AI-powered grammar checking and vocabulary generation.
  • Fine-tuned a Qwen2.5-3B model using LoRA & Unsloth on a custom 10,000-sample dataset to enforce strict JSON outputs.

4. Vulnerable Web Application — Educational CTF Challenge Platform
#

Dec 2025 – Jan 2026

  • Development: Built a PHP/MySQL CTF platform with an RBAC dashboard and automated scoring, replicating 5 OWASP Top 10 vulnerabilities (SQLi, XSS, File Upload, CSRF, Command Injection).
  • Security Testing: Executed white-box code reviews and manual penetration testing via Burp Suite to validate and exploit vulnerabilities.

5. Web Application Penetration Testing & CTF Practice
#

Jul 2025 – Present

  • PortSwigger Web Security Academy: Completed 100+ labs with in-depth exploitation on SQLi, XSS, SSRF, CSRF, File Upload, and business logic flaws.
  • Hands-on Platforms: Actively sharpening skills on TryHackMe, Root-Me, and picoCTF.
  • Manual Testing: Conducted hands-on manual testing to exploit and mitigate OWASP Top 10 vulnerabilities.
  • Write-ups: Published detailed technical write-ups on vulnerability exploitations on HackMD and this blog.