Liang Zhong / Independent offensive security

Looks secure.
Let’s check.

I’m Liang. I test applications, infrastructure and AI systems, with findings you can reproduce and fixes your team can act on.

See how I can help liang.zhong@calimsec.com

Offensive security consulting since 2020.
Scoping, testing and reporting directly with me.

How I can help

Application & infrastructure pentesting“We’re about to ship.”

What I do: before a release, or when a customer or auditor asks for an assessment, I test your web or mobile application, APIs and supporting infrastructure. We agree the scope and any reporting requirements before testing starts.

You get: a report with reproducible findings, their impact and concrete fixes.

Web, mobile & APIs · Authentication & access controls · Business logic · Cloud & network · Configuration audits

Red & purple team exercises“Would we notice a real attacker?”

What I do: I try to get in, move through your environment and reach an agreed objective. Afterwards, your security operations team and I compare what I did with what they detected.

You get: a record of the attack paths and a walkthrough with your security team of what they detected and what they missed.

Red team · Active Directory · Purple team · AV/EDR evasion

AI security assessments“We’re adding AI to the product.”

What I do: I test whether your AI features can expose data or take actions they shouldn’t. This includes the tools, data access, permissions, model loading and deployment pipelines around the model.

You get: a report showing what I found, how to reproduce it and what to fix.

Agents & MCP · Model loading · RAG · MLOps pipelines

SAP, industrial & IoT security“It runs the plant or the ERP.”

What I do: I assess SAP systems, industrial networks and connected devices. We agree what can be tested—and what must be left alone—before touching production.

You get: a report of what I found and what to fix, with the testing limits made explicit.

ERP/SAP · OT/SCADA · IoT

Code & architecture review“We need a second pair of eyes.”

What I do: I review source code for authentication and access-control flaws, injection, unsafe deserialization and memory corruption. I also review system designs for weaknesses in their security controls.

You get: a record of the flaws I found, their impact and what needs to change in the code or design.

Secure code review · Threat modeling · Architecture review

Product & application security“We need security support in the product team.”

What I do: I work with developers on security reviews, vulnerability triage and fixes. I also help set up code and application scanning in CI/CD, and decide which findings should block a release.

You get: reviewed and prioritised findings, help with fixes, and scanning and release gates set up with your developers.

SAST & DAST · CI/CD security gates · Vulnerability management

Selected work

Client names withheld

Red team / Private sector Full Active Directory forest compromise I went from an exposed website to control of every domain in the forest, without social engineering and without being detected. Read case studyClose case study
Context
A black-box attack path from a larger red team engagement for a private-sector organisation.
Attack path
  • Unauthenticated path. The website’s JavaScript revealed an application path that needed no authentication.
  • SQL injection. That path was injectable, and I used it to get an administrative account on the application.
  • Code execution. With that account I got remote code execution on the server and dumped the database.
  • Password reuse. A password from the dump also worked on an exposed remote-access service.
  • Certificate template misconfiguration. Active Directory Certificate Services had a template I could use to request a certificate as a privileged user and become domain admin.
  • Domain escalation. From the main domain I escalated into all the other domains of the forest.
What I demonstrated
I gained full control of the Active Directory forest without social engineering and without being detected.
Follow-up
I walked the client’s security team through the attack paths and the detection gaps.
AI & application security / Public sector From an AI chatbot to remote code execution I reached internal services without an account and found a flaw that allowed code execution on a local replica—not the live system. Read case studyClose case study
Context
A bug bounty program run for a public-sector organisation.
Attack path
  • Query injection. The chatbot turned questions into SPARQL queries against a knowledge graph, and I could steer those queries with my own instructions.
  • Server-side request forgery. The same service had an anonymous SSRF, and I used it to reach services listening only on localhost.
  • Buffer overflow. One of those services was an open source component with a buffer overflow that leads to remote code execution.
What I demonstrated
I showed that remote code execution was possible without an account at any step. I proved it on a local replica, not on the live system.
Follow-up
I reported the application findings to the program and the overflow to the open source maintainers.

About me

I’m Liang Zhong, based near Paris, France. I’ve been in IT for 12+ years and in penetration testing and offensive security consulting since 2020. I do the scoping, testing and reporting myself.

Before consulting, I worked in IT support, software development and in-house application security. I also scoped external pentests, reviewed the reports and followed the fixes with developers.

OSAI+ · OSEP · OSWE · OSCP
French · English · Spoken Mandarin
LinkedIn

How an engagement works

  1. Scoping & authorization

    Targets, goals, dates and limits. Signed rules of engagement before testing starts.

  2. Testing

    Manual, with tooling as support. Critical findings reported as soon as I find them.

  3. Report & debrief

    Proof, impact and concrete fixes, ranked by risk, then a call with your team.

  4. Retest

    Once the fixes ship, I verify them and update the report.

Contact

Tell me what you’re building or need tested, and roughly when. It’s fine if you don’t have a scope yet—we can define it together.

For consultancies: I also take subcontracting engagements.