Portfolio & Research Profile
Mohammad Al Shahin
Cybersecurity Researcher · IoT & Firmware Security · Cloud Security Enthusiast
CSE student focused on the security of consumer IoT devices — I spend most of my time pulling routers apart, in software. My recent work automates firmware collection, extraction, and vulnerability analysis at scale to map real-world risk in consumer networking hardware.
- focus
- IoT & Firmware Security
- based_in
- Bangladesh
- timezone
- GMT+6
- degree
- CSE, Primeasia University
01 — Background
About
I'm a Computer Science & Engineering student at Primeasia University in Bangladesh, working at the intersection of applied security research and full-stack systems engineering. My coursework has spanned artificial intelligence, compiler theory, simulation modeling, and web development — but the thread running through all of it is a fascination with how systems fail, and how to prove it rigorously.
My current research examines the security posture of consumer IoT router firmware shipped in Bangladesh — building an automated pipeline that collects, extracts, and statically analyzes firmware images from major vendors, then cross-references findings against the NVD to produce composite risk scores. It's the kind of unglamorous, iterative work that involves as much debugging of proprietary archive formats as it does security analysis, and I've come to enjoy that grind.
Academically, I'm aiming toward graduate research in cybersecurity — IoT and embedded security, applied cryptography, or cloud security — at a lab that values empirical, reproducible work. Outside of formal research, I build socially-driven software for the Bangladeshi context: a technology-facilitated gender-based violence support platform, a real-time news-mapping tool, and — as a personal creative outlet — original Bengali-language board games that use the structure of the Bengali script itself as a game mechanic.
2023
Began CSE at Primeasia University
Started a Computer Science & Engineering degree, with early coursework in programming fundamentals and discrete structures.
2024
AI & Systems Coursework
Completed coursework in AI (propositional/predicate/fuzzy logic, reinforcement learning) and built expert-system projects, including a dengue outbreak resource-allocation system and a Q-learning power grid balancer.
2025
Applied Security Projects
Shifted focus toward applied security and social-impact engineering: a TFGBV support platform (ছায়াকবচ) built for a national hackathon, and hands-on work with AWS core services and hardware prototyping.
2026 – Present
IoT Firmware Vulnerability Research
Building a fully automated Python pipeline for firmware acquisition, extraction, static analysis, and NVD-correlated risk scoring across consumer router vendors — the foundation of an ongoing thesis-level research project.
02 — Education
Education
Primeasia University
B.Sc. in Computer Science & Engineering
Dhaka, Bangladesh
2023 – Expected 2027
CGPA: [3.99/4.00]
Coursework and independent projects concentrated on AI systems, applied security, and full-stack engineering.
03 — Research
Research
Empirical, reproducible work on real-world security problems. Entries are added here as research progresses from working pipeline to submitted manuscript.
An Empirical Vulnerability Assessment of Consumer IoT Router Firmware in Bangladesh
A large-scale, automated empirical study of firmware security across consumer routers sold in Bangladesh, spanning TP-Link, Tenda, D-Link, and Mercusys devices. The pipeline extracts and statically analyzes firmware images to surface hardcoded credentials, embedded keys, and dangerous function usage, then correlates findings against the National Vulnerability Database to produce a composite risk score per device.
Problem
Consumer router firmware is rarely audited before reaching market in South Asia, and there is little public, reproducible data on the real security posture of the devices actually deployed in Bangladeshi homes and small businesses.
Methodology
- Automated firmware acquisition across four major vendors
- Archive extraction via Binwalk, with unblob and sasquatch as fallback extractors for proprietary formats
- Credential and embedded-key scanning with Firmwalker
- Dangerous function detection via Semgrep static analysis rules
- NVD API integration for CVE correlation and composite risk scoring
- Dynamic vendor auto-detection to replace hardcoded vendor/model lists
04 — Projects
Projects
Applied engineering work — production systems, hackathon builds, and tools.
ExploitraX — Kali Linux Cleanup & Recon Utility
A modular Bash utility for Kali Linux that automates system cleanup, package management, cache removal, logging, and reconnaissance tasks with a professional CLI interface.
Challenges
Designed a safe cleanup workflow with dry-run mode, selective operations, system information dashboard, accurate space tracking, logging, and extensible modular architecture.
HackLab Enumeration Toolkit
A terminal-based cybersecurity enumeration toolkit that automates reconnaissance and enumeration tasks commonly performed during penetration testing and security assessments.
Challenges
Packaged the toolkit as a Debian package and designed modular Bash scripts to simplify reconnaissance workflows for security researchers.
Chayakaboch — TFGBV Support Platform
A privacy-focused platform supporting victims of technology-facilitated gender-based violence with anonymous reporting, AI assistance, evidence integrity, and secure case tracking.
Challenges
Migrated from Firebase to a self-hosted PHP/MySQL architecture while preserving anonymity, evidence integrity, and role-based administrative workflows.
Arduino Drone Detection & Laser Tracking System
An embedded air-defence simulation prototype that detects nearby objects using dual ultrasonic radar modules and automatically tracks them with servo-controlled laser alignment while visualizing radar data in real time.
Challenges
Implemented trigonometric laser-offset correction, synchronized dual-radar scanning, Processing-based visualization, and achieved approximately 95% detection accuracy during controlled testing.
CSE Hunters — Ludo Championship Management System
A real-time tournament platform supporting multiplayer gameplay, bilingual interface, registration, live scoring, and event management for a university-wide competition.
Challenges
Built synchronization logic, anti-tampering mechanisms, live game management, player verification, and configurable tournament workflows.
AI-Powered Master's & Scholarship Finder
A web application that helps students discover Master's programs and scholarships across multiple countries using AI-assisted live search instead of a static database.
Challenges
Designed reliable retrieval and prompt workflows to improve result accuracy for real-world academic decision making.
Cloud Security Mastery
A self-contained cloud security learning platform featuring structured lessons, Pomodoro productivity, flashcards, and local progress tracking.
Challenges
Organized an AWS-focused cloud security curriculum into an interactive learning experience with offline persistence.
Dengue Outbreak Prediction & Resource Allocation
An AI expert system that predicts dengue outbreak risk and allocates healthcare resources using First-Order Predicate Logic.
Challenges
Modeled healthcare decision rules as logical predicates while ensuring reliable inference across complex reasoning chains.
Bus Ticket Reservation System
A terminal-based reservation system implementing seat management, waiting queues, authentication, and booking automation using core data structures.
Challenges
Implemented queue-based waiting list allocation and dynamic seat reassignment while maintaining cross-platform compatibility.
AI-Powered Smart Power Grid Load Balancing System
A reinforcement learning-based smart grid simulation that dynamically balances electricity demand across multiple zones, optimizing power distribution while reducing overloads and improving grid stability.
Challenges
Designed a custom Q-Learning environment to simulate real-world load balancing, reward optimization, and autonomous decision-making across multiple power distribution zones.
05 — Experience
Experience
Undergraduate Researcher
Primeasia University · Dhaka, Bangladesh
2025 – Present
Responsibilities
- Conduct research in cybersecurity, IoT security, and router firmware security.
- Perform literature reviews, vulnerability analysis, and experimental evaluations.
- Design and implement proof-of-concept tools for security testing and automation.
- Prepare research findings for academic publications and conference submissions.
Achievements
- Published an undergraduate research paper in cybersecurity.
- Conducted undergraduate thesis research on router firmware security.
Chief Executive Officer & Founder
ExploitraX · Dhaka, Bangladesh
2026 – Present
Responsibilities
- Lead strategic planning and oversee cybersecurity research initiatives.
- Organize CTF competitions, workshops, and hands-on security training sessions.
- Coordinate team operations, project development, and community engagement.
- Mentor members in penetration testing, cloud security, and research activities.
Achievements
- Founded and established ExploitraX as a cybersecurity-focused student organization.
- Led multiple cybersecurity awareness programs and technical events.
- Built a collaborative platform for students interested in ethical hacking and security research.
Cybersecurity Learner & CTF Participant
TryHackMe · Remote
2023 – Present
Responsibilities
- Complete hands-on labs covering penetration testing, web security, networking, and privilege escalation.
- Participate in Capture The Flag (CTF) challenges to strengthen practical offensive security skills.
- Practice vulnerability analysis, exploitation, and post-exploitation techniques in controlled environments.
Achievements
- Ranked among the Top 4% of TryHackMe users worldwide.
- Completed numerous cybersecurity learning paths and practical challenges.
Bug Bounty Hunter
Bugcrowd · Remote
2024 – Present
Responsibilities
- Perform security assessments of web applications within authorized bug bounty programs.
- Identify and responsibly disclose security vulnerabilities following coordinated disclosure practices.
- Continuously improve expertise in web application security and vulnerability research.
Achievements
- Actively participated in public and private bug bounty programs.
- Developed practical experience in real-world vulnerability discovery and reporting.
Joint Secretary
Primeasia University Computer Club · Primeasia University, Dhaka
2025 – Present
Responsibilities
- Coordinate club activities and support executive committee operations.
- Assist in organizing technical workshops, seminars, and competitions.
- Maintain communication between members, committees, and club leadership.
- Support event planning, documentation, and administrative tasks.
Achievements
- Contributed to the successful organization of multiple technical events and workshops.
- Strengthened member engagement through effective coordination and communication.
Campus Ambassador
Bangladesh Network for Radio and Communication (BNNRC) · Primeasia University, Dhaka
2026 – Present
Responsibilities
- Promote digital safety and awareness initiatives on campus.
- Coordinate student engagement activities and outreach programs.
- Support campaigns focused on technology, innovation, and online safety.
Achievements
- Represented Primeasia University in national BNNRC initiatives.
- Contributed to awareness programs on digital security and responsible technology use.
Chief Coordinator & Tournament Director
CSE Hunters · Primeasia University, Dhaka
2026
Responsibilities
- Led planning and execution of a university-wide Ludo Championship.
- Coordinated organizing committees, volunteers, and participants.
- Managed tournament operations, scheduling, and technical logistics.
- Oversaw event promotion and participant engagement.
Achievements
- Successfully organized a large-scale university tournament.
- Delivered a smooth tournament experience through effective coordination.
06 — Skills
Skills
Programming
Cybersecurity
Cloud
Web
Databases
Networking & Systems
AI & Modeling
Tools
07 — Achievements
Achievements & Leadership
Research Paper Under Review
Submitted a cybersecurity research paper for peer review and publication.
Ongoing
Top 4% on TryHackMe
Ranked among the top 4% of TryHackMe users through practical cybersecurity labs and Capture The Flag (CTF) challenges.
Ongoing
BNNRC National Hackathon — Chayakaboch
Designed and presented Chayakaboch, a TFGBV support platform during the national BNNRC hackathon.
2026
Chief Coordinator — CSE Hunters Ludo Championship
Led the planning and execution of a university-wide tournament, coordinating event operations, volunteers, and participants.
2025
08 — Certifications
Certifications
09 — Contact
Get in touch
Open to research collaborations, Master's/PhD conversations, and cybersecurity roles.