About

I'm Isaiah Reyes, a self-taught offensive security researcher based in Olympia, WA. I got my start by breaking into HackTheBox machines and haven't stopped since. Over the past two years I've logged more than 1,000 hours of hands-on training across web application penetration testing, network security, Active Directory attack paths, and vulnerability research.

Everything I know, I taught myself. No degree, no bootcamp — just relentless curiosity, public documentation, and a willingness to sit with a problem until it breaks. I earned my GED in 2017, started studying cybersecurity full-time in 2024, and I'm currently working toward CompTIA Security+.

What I Do

My core work is web application security. I hunt for vulnerabilities across bug bounty platforms like HackerOne, where I have 6 valid reports in information disclosure, broken access control, and business logic categories. I specialize in the OWASP Top 10 — SSRF, XSS, XXE, injection, authentication bypass, and privilege escalation.

My most significant finding was a coordinated disclosure of a critical Apache RCE exposure (CVE-2021-41773 / CVE-2021-42013, CVSS 9.8). I identified nine customer-facing VPS instances at a major hosting provider running vulnerable Apache 2.4.49 through passive reconnaissance of public scan data, traced the pattern to the provider's base image, and reported through their security.txt contact with CVE references, remediation guidance, and a CERT escalation timeline. It was acknowledged and remediated.

HackTheBox

I'm an active competitor on HackTheBox, currently ranked #613 out of 5,400 active players in Season 12 with 51 machine root/admin compromises and Professional rank at Level 58. My trajectory has been consistently upward — Season 9 finish #1740, Season 10 finish #1986, Season 12 currently top 12%. I use HTB as a training ground to sharpen methodology against realistic enterprise environments and document everything I learn.

Beyond Security

I run two businesses. Hardline WebWorks provides web application security assessments and secure web development for small businesses — I build sites, AI assistants, and run vulnerability scans with guardrail and abuse testing. The Photog Plan is a SaaS application I designed and shipped solo: HTML/JS frontend, Node backend, Supabase with row-level security, all running on infrastructure I provision and administer myself.

I also operate this server as an out-of-band testing platform — it runs custom nginx logging with Python parsing tools that I built for live bug bounty work. The site you're reading is plain HTML, CSS, and JavaScript that I deploy via rsync to a hardened VPS with key-only SSH and TLS.

This Site

Here you'll find detailed HackTheBox machine walkthroughs that break down my methodology from enumeration to root, as well as blog posts covering vulnerability classes, new attack techniques, and lessons from the field. Some writeups for active HTB machines are password-protected to comply with HackTheBox's rules and are unlocked once the machine retires.