Skip to content
View Chrisherr1's full-sized avatar
8 followers · 8 following

Achievements

Achievement: Pull Shark

Achievements

Achievement: Pull Shark

Highlights

  • Pro

Block or report Chrisherr1

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Chrisherr1/README.md

Christian Herrera

Software Engineer & Security-Focused | Node.js • Spring Boot • Web Security • System Design

I build backend systems and pick them apart.

Certifications

PortSwigger - Burp Suite Certified Practitioner (BSCP)

Black box web exploitation with Burp Suite Professional across XSS, CSRF, SQL injection, SSRF, XXE, SSTI, OS command injection, HTTP request smuggling, web cache poisoning, insecure deserialization, prototype pollution, JWT and OAuth attacks, access control, and authentication bypasses.

Assessed by a proctored four hour practical exam compromising multiple web applications, with the objective of fully compromising the web applications.
Expected December 2026

Hack The Box - Certified Web Exploitation Specialist (CWES)

Black box and white box web exploitation across LFI, SQL injection, RCE, file upload bypasses, SSRF, SSTI, XSS, command injection, and broken authentication.

Assessed by a proctored 7 day practical exam compromising multiple vulnerable web applications, with the objective of obtaining RCE on each. Ending with a Professional bug bounty report on all vulnerabilities found, how to reproduce, and remediate findings.
Verified on Credly

CompTIA Security+ (SY0-701)

Security fundamentals across threat analysis, vulnerability management, secure architecture, security operations, incident response, identity and access management, cryptography, and risk management.

Assessed by a timed exam with performance-based questions that simulate hands-on security tasks.
Verified on Credly

Featured Projects

WebWeavr
Zero-footprint OSINT tool that maps a target's external attack surface using CT logs, passive DNS, and web archives — no traffic generated on their infrastructure.
Live | Repo

Node Initializr
Spring Initializr-style tool for Node.js — configure your Express project and download a production-ready zip in seconds. Deployed with Docker and GitHub Actions CI/CD on a personal VPS.
Live | Repo

Notepad
Note-taking app built security-first — Google OAuth 2.0 handles authentication, self-hosted on a personal VPS.
Live | Repo

Kiki's Weather
Menu bar weather app for macOS, Windows, and Linux featuring a Ghibli-themed experience — displays custom hand-picked Ghibli GIFs that change dynamically based on current weather conditions.
Repo

Personal Notes

Security+
CompTIA Security+ Notes

AWS Developer Notes
AWS Developer Notes

Portswigger
PortSwigger Web Security Academy Notes

Technologies

Languages
Frameworks
Databases
Infrastructure
Security

Pinned Loading

  1. Kiki-s-Weather-Delivery Kiki-s-Weather-Delivery Public

    A cozy macOS and Windows menu bar weather app built with Electron. Real-time forecasts, animated weather visuals, and smart notifications for rain, wind, UV, and thunderstorms — powered by the Pira…

    JavaScript 1

  2. NotePad-Security-Project NotePad-Security-Project Public

    Secure notes web app built with Express, Passport.js (Google OAuth + manual auth), and REST API — deployed on a VPS with Docker and Nginx

    JavaScript 2

  3. field-notes field-notes Public

    Spring Boot web app for organizing pentest notes by engagement, host, and findings

    Java 1

  4. node-initializr node-initializr Public

    A Spring Initializr-style tool for Node.js — pick your dependencies and download a ready-to-run Express project as a zip.

    JavaScript 1

  5. WebWeavr WebWeavr Public

    A zero-footprint passive recon tool that maps a target's external surface entirely through third-party OSINT, leaving no trace in logs and no traffic on the wire

    JavaScript 2

  6. Blitzkrieg Blitzkrieg Public

    An Electron-based desktop GUI that unifies ffuf and feroxbuster into a single visual pipeline — configure, chain, and run your entire fuzzing workflow without touching the terminal.

    TypeScript 1