david㉿munene: ~/portfolio — bash
(david㉿munene)-[~/portfolio]
$
____ _ _ __ __ | _ \ __ ___ _(_) __| | | \/ |_ _ _ __ ___ _ __ ___ | | | |/ _` \ \ / / |/ _` | | |\/| | | | | '_ \ / _ \ '_ \ / _ \ | |_| | (_| |\ V /| | (_| | | | | | |_| | | | | __/ | | | __/ |____/ \__,_| \_/ |_|\__,_| |_| |_|\__,_|_| |_|\___|_| |_|\___|
// Cybersecurity Professional — Web & API Security · System Engineering · Security Automation
(david㉿munene)-[~/portfolio]
$ id
uid=1000(david) gid=1000(redteam) groups=linux,owasp,osint,automation,incident-response
(david㉿munene)-[~/portfolio]
$ uptime
8+ years in IT · LPIC-1 / LPIC-2 certified · AfricaHackOn Swara · OWASP Top 10 · load avg: curious, methodical, relentless
(david㉿munene)-[~/portfolio] $
try:
help ls resume sudo hire david$
cat about.txt
IT professional with 8+ years spanning Linux and Windows system administration, now sharpened toward Web & API Security. I identify, assess, and remediate vulnerabilities across web applications — and I like understanding systems well enough to break them on purpose.
I'm hands-on with the OWASP Top 10, API security risks, authentication mechanisms, access-control models, vulnerability management, and security-testing methodology. I'm LPIC-1 and LPIC-2 certified, with a recently completed AfricaHackOn Cyber Security Swara certification adding practical offensive skill to a deep operations foundation.
Equally comfortable hardening production infrastructure, training staff on security best practice, and writing the Python/Bash automation that takes the toil out of scanning and reporting. I also produce clear, professional penetration-testing reports — documenting findings with CVSS scoring, OWASP Top 10 mapping, proof-of-concept steps, and prioritized remediation guidance that both engineers and management can act on.
OWASP Top 10
API Security Testing
Penetration Testing
Incident Response
OSINT
Security Automation
$
cat ~/skills
Web & API Security
Security Tools
Reporting & Documentation
Security Operations & Defense
Operating Systems & System Security
Network Security
Automation & Scripting
Cloud & Virtualization
$
history --experience
Apr 2021 — Present
System Engineer & Database Administrator
Cheli & Peacock Safaris
- Perform authentication, authorization, and access-control reviews across enterprise applications.
- Evaluate and recommend hardware/software solutions with security considerations baked in.
- Train new staff on security best practices and system procedures.
- Generate database reports to support operations, performance tracking, and decision-making.
- Identify and ship automation that streamlines workflows and improves data quality.
- Document data-management procedures, configs, and troubleshooting for knowledge sharing.
Sep 2019 — Mar 2021
Technical Support
Elewana Collection
- Configured, maintained, and monitored network devices for secure, optimized operations.
- Ran regular system backups and disaster-recovery processes.
- Delivered IT projects improving reliability, security, and end-user experience.
- Used Nagios for continuous monitoring with alerting on downtime and performance issues.
May 2017 — Aug 2019
Linux System Engineer
Linux Learning Centre Ltd, Kenya
- Implemented system security that reduced unauthorized access attempts.
- Configured and maintained firewalls and network security policies.
- Conducted security assessments and vulnerability reviews across production infrastructure.
- Managed Red Hat, Ubuntu, and CentOS servers for high uptime and reliability.
- Automated backups and system updates with Bash and Cron.
- Mentored junior IT staff on administration, troubleshooting, and automation.
May 2015 — Aug 2015
IT Technical Support — Volunteer
Pan Africa Christian University
- Implemented basic security measures for user authentication and access control.
- Managed user accounts and provided full support across software, hardware, and networking.
- Maintained IT inventory and asset documentation.
- Developed troubleshooting methods that minimized operational disruption.
$
ls -la ~/projects
// featured — security assessments & tooling
WIP
drwxr-xr-x j01hunt/
J01Hunt — Autonomous Pentest Agent
(david㉿munene)-[~/portfolio] $ cat j01hunt-readme | less
[+] OS: Kali Linux
[+] Status: Work in progress
[Architecture]
- Dual-LLM planner / analyst design
- Integrated security toolset
- ChromaDB knowledge base
- Structured tool-result feedback loops
- Operator checkpoints
- Incremental HTML reporting
[Stack]
- Python
- Ollama (local LLMs)
- LangChain
- ChromaDB
An autonomous penetration-testing agent that plans, executes, and documents recon and assessment steps with a human in the loop.
PythonOllamaLangChainChromaDBKali Linux
GitHub — coming soon
Report
-rw-r--r-- crapi_assessment.pdf
crAPI — API Penetration Test
(david㉿munene)-[~/portfolio] $ cat crapi-report | less
[+] OS: Kali Linux
[+] Mapping: OWASP API Top 10
[Critical Findings]
- BOLA on reports & orders
- JWT alg:none signature bypass → admin access
- Excessive data exposure
- Unrestricted file upload
[Skills Demonstrated]
- Burp Suite
- JWT manipulation
- BOLA exploitation
- CyberChef analysis
API security assessment of OWASP's Completely Ridiculous API. Documented findings with CVSS scoring and remediation guidance.
Burp SuiteJWTBOLACyberChef
report link — coming soon
Report
-rw-r--r-- juice_shop_assessment.pdf
OWASP Juice Shop — Web App Pentest
(david㉿munene)-[~/portfolio] $ cat juice-shop-report | less
[+] OS: Kali Linux
[+] Mapping: OWASP Top 10 (2021)
[Key Findings]
- SQLi authentication bypass
- Reflected & DOM XSS with token theft
- IDOR on baskets
- JWT manipulation → admin
- Business-logic abuse (negative quantities)
- Missing rate limiting
[Skills Demonstrated]
- SQL injection
- XSS exploitation
- IDOR
- JWT manipulation
- Burp Suite Intruder
Full web-application penetration test — 13 findings across the OWASP Top 10 with CVSS scoring and remediation.
SQLiXSSIDORJWTBurp Suite
report link — coming soon
Report
-rw-r--r-- dvra_assessment.pdf
Damn Vulnerable RESTaurant API — Pentest
(david㉿munene)-[~/portfolio] $ cat dvra-report | less
[+] OS: Kali Linux
[+] Mapping: OWASP API Top 10
[Critical Findings]
- BFLA role escalation via PATCH/PUT profile
- Unauthorized menu deletion (BFLA)
- Exposed debug endpoint leaking config
[Skills Demonstrated]
- Burp Suite
- Gobuster
- Swagger analysis
- BFLA exploitation
API security assessment of an intentionally vulnerable FastAPI application, tested against the OWASP API Top 10.
FastAPIBFLAGobusterBurp Suite
report link — coming soon
// labs & infrastructure
drwxr-xr-x attack-lab/
Home Cybersecurity Lab
(david㉿munene)-[~/portfolio] $ cat home-lab-notes | less
[+] OS: Kali Linux
[Setup]
- Isolated virtualized attack lab (VirtualBox)
- Segmented networks for safe testing
- Kali Linux as the attack platform
[Skills Demonstrated]
- Virtualization
- Penetration testing
- Threat detection
Home lab for hands-on security testing with Metasploit, Nmap, Burp Suite, and Wireshark.
VirtualBoxKali LinuxMetasploitNmapWireshark
drwxr-xr-x linux-hardening/
Linux Security Hardening
(david㉿munene)-[~/portfolio] $ cat hardening-notes | less
[+] Scope: Production infrastructure
[Work Done]
- Enforced strict access-control policies
- Systematically reduced vulnerability surface
- Configuration management
[Skills Demonstrated]
- Hardening
- Access control
- Compliance
- Security policy
Led a hardening initiative across production infrastructure to strengthen the overall security posture.
HardeningAccess ControlCompliance
drwxr-xr-x secure-fileshare/
Secure File-Sharing Server
(david㉿munene)-[~/portfolio] $ cat fileshare-notes | less
[+] Stack: SAMBA + NFS
[Work Done]
- Cross-department file-sharing solution
- Authentication enforced
- Audit logging enabled
[Skills Demonstrated]
- Access control
- Authentication
- Audit logging
Designed a secure SAMBA/NFS file-sharing solution that improved both collaboration speed and data-sharing security.
SAMBANFSAudit LoggingAuthentication
$
gpg --list-keys ~/certs
BBIT — JKUAT
DBIT — JKUAT
$
cat /etc/contact.conf
[email]davidmunene.dm@gmail.com
[phone]+254 723 008 206
[linkedin]in/david-munene
[languages]English (fluent) · Swahili (basic)
[resume]download CV (PDF)
[availability]Available within one month's notice