./0xc4t.re

Web Security & Active Directory Security

Portofolio

I'm Varel Valensio, a 19-year-old offensive-security specialist from Indonesia who started penetration testing at 17. My focus is Red Teaming and Active Directory pentesting, with hands-on experience across web applications, network infrastructure, wireless, Android, and ATM/EDC systems. I'm certified in eWPTX, eCPPT, and eJPT (plus CRTA and CNSP) and currently advancing through OSCP, CPTS, CPENT, and CRTO. Through bug bounty and responsible disclosure I've earned Hall of Fame recognition from organizations such as DHL, USGS, NASA, and BASF, alongside dozens of Indonesian government CSIRTs and BSSN VVIP engagements. I'm currently studying malware development at Maldev Academy and share my research as a writer on Medium and this blog. LinkedIn ↗

Skills

Red Team OperatorCobalt Strike & C2 frameworks, malware development, AV/EDR evasion, Active Directory attack paths, and adversary simulation.

Penetration TesterWeb application, network & infrastructure, Active Directory, wireless, Android, and ATM/EDC assessments.

Boot2Root Lab CreatorDesign and build vulnerable boot2root machines and CTF-style challenges.

Ricing LinuxDaily-driver Linux customization — because aesthetics matter too. hahaha

Certifications

eWPTX

eWPTXeLearnSecurity Web App Penetration Tester eXtreme — advanced web exploitation.verify ↗

eCPPT

eCPPTeLearnSecurity Certified Professional Penetration Tester — network & web exploitation.verify ↗

eJPT

eJPTeLearnSecurity Junior Penetration Tester — entry-level hands-on pentesting.verify ↗

CAP

CAPCertified AppSec Practitioner (CAP) — The SecOps Group, passed with Merit (ID 8369205).verify ↗

CRTA

CRTACertified Red Team Analyst — red teaming fundamentals and Active Directory attacks.verify ↗

Varel Valensio Certified Network Security Practitioner CNSP

Varel Valensio Certified Network Security Practitioner CNSPCertified Network Security Practitioner (CNSP) — network security assessment.verify ↗

Pro Labs

Dante

DanteHack The Box Pro Lab: Dante — cert HTBCERT-3989DD6A0A.verify ↗

FullHouse

FullHouseHack The Box Mini Pro Lab: FullHouse — cert HTBCERT-EBF9322E77.verify ↗

P.O.O

P.O.OHack The Box Mini Pro Lab: P.O.O — cert HTBCERT-63B97F5675.verify ↗

Hall of Fame & Bug Bounty

BASF

BASFHall of Fame — BASF responsible disclosure.verify ↗

HoF DHL

HoF DHLWall of Fame — DHL Group vulnerability disclosure.verify ↗

HoF Stedtfabrikanten

HoF StedtfabrikantenHall of Fame — Stadtfabrikanten.verify ↗

HoF Teknokrat

HoF TeknokratHall of Fame — Universitas Teknokrat Indonesia CSIRT.verify ↗

HoF TIM Group

HoF TIM GroupHall of Fame — TIM Group responsible disclosure.verify ↗

HoF USGS

HoF USGSHall of Fame — U.S. Geological Survey (USGS) VDP.verify ↗

PRIZ Guru

PRIZ GuruHall of Fame — PRIZ Guru responsible disclosure.verify ↗

Recognition & Appreciation

Alterra

AlterraRecognition — Alterra.

AMIKOM

AMIKOMRecognition — Universitas AMIKOM Yogyakarta.

Git Aja

Git AjaRecognition — Git.aja.

IDCloudHost

IDCloudHostRecognition — IDCloudHost.

Strongnet

StrongnetRecognition — StrongNet.

Upscale

UpscaleRecognition — Upscale.

NASA

Latter of Nasa

Latter of NasaLetter of appreciation — NASA vulnerability disclosure.

CSIRT Recognition

CSIRT Bekasi

CSIRT BekasiReported a vulnerability in a Bekasi city government website.

CSIRT Beltim

CSIRT BeltimReported a web-app security flaw for Belitung Timur Diskominfo (Vulnerability Report).

CSIRT BPK

CSIRT BPKListed as a security reporter for BPK RI (Aug 2023).verify ↗

CSIRT Jakarta

CSIRT JakartaReported a vulnerability in a DKI Jakarta provincial government system.

CSIRT Kebumen

CSIRT KebumenReported vulnerabilities in subdomains of kebumenkab.go.id.

CSIRT Kemenkes

CSIRT KemenkesReported a vulnerability in a Ministry of Health (Kemenkes RI) system.

CSIRT KPK

CSIRT KPKReported a vulnerability in KPK's e-learning application.

CSIRT Kulon Progo

CSIRT Kulon ProgoReported a vulnerability in Kulon Progo government websites.

CSIRT Magelang

CSIRT MagelangReported a vulnerability in Magelang Regency's e-government systems.

CSIRT Malang

CSIRT MalangReported a security flaw in malpro.malangkota.go.id.

CSIRT PDTT

CSIRT PDTTRecognized for helping secure the cyberspace of the Ministry of Villages (Kemendes PDTT).

CSIRT UBP

CSIRT UBPReported a vulnerability in a UBP Karawang system.

CSIRT Unjaya

CSIRT UnjayaReported a vulnerability in a subdomain of Universitas Jenderal Achmad Yani Yogyakarta.

BSSN VVIP Engagements

BSSN VVIP Jateng

BSSN VVIP JatengBSSN VVIP event security support — Central Java.

BSSN VVIP Jogja

BSSN VVIP JogjaBSSN VVIP event security support — Yogyakarta.

BSSN VVIP Kulon Progo

BSSN VVIP Kulon ProgoBSSN VVIP event security support — Kulon Progo.

Capture The Flag

Athena CTF 2026

Athena CTF 2026Athena CTF 2026 — participation & achievement.

POLRI CTF

POLRI CTFPOLRI CTF — participant.

Redlimit Meta4sec CTF

Redlimit Meta4sec CTFRedlimit Meta4sec CTF — finalist.