ROBERT KRUCZEK
Independent Security Researcher • Exploit Dev • Red Teaming
I am a Cybersecurity Consultant, Mentor, and Ethical Hacker (known in the infosec community as ProXy) at Securitum - Poland's leading cybersecurity firm - and a contributor to sekurak.pl, the country's largest infosec portal. With over 10 years of experience in vulnerability research and penetration testing.
Operating under the ProXy alias, I discovered and reported 53 CVEs and I am an active Bug Bounty hunter (Hall of Fame at OLX, reports for BlaBlaCar, OVH, and ERCOM).
"Triki i kruczki hackowania ludzi."
Practical guide on the psychology of hacking.
Learn more →My radio interview where we break down the mindset and true role of ethical hackers in modern cybersecurity. We discuss how our motivations differ from black hats, focusing on securing infrastructure rather than chasing money or fame.
Read on Polskie Radio 24 →A technical breakdown of a security audit on a legacy VB6 application. It demonstrates how relying on a direct database connection and client-side authentication allows an attacker to completely bypass the login mechanism via binary patching.
Read on Securitum →A technical advisory and vulnerability analysis of PAD CMS. This research led to the discovery of critical flaws, including Remote Code Execution (RCE), affecting multiple public institution websites.
Read on Safety Online →Analysis of a new data exfiltration technique from Windows systems using RDP features, discovered in a campaign linked to the Russian APT29 group.
Read on Sekurak →A technical look into how North Korean APT groups leverage fake job offers and GitHub repositories to distribute sophisticated malware to security researchers.
Read on Sekurak →A comprehensive analysis of modern phishing techniques, psychological triggers used by attackers, and technical methods to bypass traditional email security filters.
Read on Sekurak →A fascinating case study where ChatGPT generated a security tool containing a critical vulnerability, potentially allowing an attacker to compromise the pentester's own machine.
Read on Sekurak →Technical research on how improperly secured log files can become a goldmine for attackers, leading to the exposure of sensitive session tokens, credentials, and system architecture details.
Read on Securitum →
Conducting academic classes and sharing practical knowledge in the field of cybersecurity and offensive security with students.
Advanced penetration testing, IT security consulting, and Red Teaming operations. Started as a Consultant (2016), promoted to Senior.
Independent security research and tool development. Active Bug Bounty hunter (findings for OLX, OVH, Qwant, Ercom...).
Performed network and application security testing strictly for the banking sector.
Refactoring core PHP engines for one of the largest e-commerce platforms in Poland.
Designed secure web applications and conducted web security audits.
Focused on software engineering and infrastructure management.
For commercial inquiries (pentests, audits), please contact me via Securitum.
For research, speaking engagements, or training – feel free to reach out directly - ProXy.
-----BEGIN PGP PUBLIC KEY BLOCK-----
xjMEaAKVsBYJKwYBBAHaRw8BAQdAIh3aICafTxALxd5J8GM39KnK4PFgvfE+vW5M
f9sN+HjNMFJvYmVydCBLcnVjemVrIDxrcnVjemVrLnJvYmVydEBzYWZldHktb25s
aW5lLnBsPsKPBBMWCAA3FiEEx3O8/j9EmahYYiwtJ+hKoIkuE/QFAmgClbAFCQlm
AYACGwMECwkIBwUVCAkKCwUWAgMBAAAKCRAn6EqgiS4T9OABAQD/hTRenSkXnjWL
W5MnwlwoXab+8F6snuOXdOQUXTS8kgD/S+X8gIa65M6H0CcDwZdQTL0zAkX3p7rg
ExMcDQsL7AHOOARoApWwEgorBgEEAZdVAQUBAQdAYGkMRICAOo/dYDlFOOhiiVAo
lo8CMR19dW2CPnkRXhkDAQgHwn4EGBYIACYWIQTHc7z+P0SZqFhiLC0n6EqgiS4T
9AUCaAKVsAUJCWYBgAIbDAAKCRAn6EqgiS4T9NsqAP44VRZf4fYlnRpWzBVsm4cJ
e3VGuuE1WuBq5xmRqQevEAD/f8RDIV+uIK0kQID+CJYIDnQvmRieZEwmnd3bdCps
7gg=
=4otu
-----END PGP PUBLIC KEY BLOCK-----