Mikołaj Kołodziej Penetration Testing / SOC internship candidate
PL

Technical

Projects & research

Study projects and research programmes — tooling entries appear only when they are real enough to show.

01 Projects

Tools & projects

Personal and study tooling. This list is empty until a project is ready to present honestly.

No tooling projects listed yet. Disclosures, findings and work experience carry the evidence for now.

02 Profile

Work & research

Employment and structured research — from lab confirmation through coordinated disclosure.

How I run research

  1. 01

    Scope and lab setup

    Isolate a local WordPress or application instance, pin versions, and stay inside an explicitly declared test scope.

  2. 02

    Surface mapping

    Map routes, roles, inputs and state-changing operations. Use open-source tooling for coverage, then verify interesting paths by hand.

  3. 03

    Confirmation

    Confirm the issue safely in the lab. Prefer minimal evidence that proves impact — never a destructive proof against systems I do not own.

  4. 04

    Impact and CVSS

    Describe who can trigger the issue, what they can achieve, and a CVSS 3.1 vector that matches the demonstrated impact.

  5. 05

    Report and disclosure

    Write a vendor-facing report with remediation guidance, then follow coordinated disclosure. Public CV pages omit exploit material.

Vulnerability researcher Independent / self-directed

Independent vulnerability research

Self-directed WordPress and web application research in isolated labs — from attack-surface mapping to coordinated disclosure reports vendors can act on.

2025 — present

  • Documented public findings for Advatix FEP API Connection, WPIDE and WP Easy Pay, plus reserved CVE-2026-30764 pending its public MITRE reference.
  • Every public advisory states product, version, root cause, impact and remediation — without publishing exploit payloads or attack procedures.
  • All confirmation work stays in isolated local WordPress and application labs.
Details

Scope of work

I run this research alongside my Cybersecurity (CBE) studies. The focus is WordPress plugins and small web applications where missing authentication, injection and file-handling bugs have practical impact.

Typical loop:

  • Lab setup — pin plugin and WordPress versions in an isolated instance.
  • Surface mapping — routes, roles, inputs and state-changing operations.
  • Confirmation — minimal evidence that proves impact without touching production.
  • Report — product, versions, root cause, CVSS, impact and remediation for the vendor.
  • Public CV record — English advisory body only; exploit material stays private.

Outcome

Details live under Public Disclosures (CVE records) and Findings (issues without a public CVE yet). Counts on the home page are derived from those data files, not typed by hand.

  • WordPress
  • Web security
  • Coordinated disclosure
  • CVSS
Technical support Soul Living sp. z o.o.

E-commerce store support

Technical support for an online store and its server environment, with light store-side programming when needed — not a software-engineering role.

February 2026 — present

  • Day-to-day technical support for the storefront and server side of an e-commerce operation.
  • Occasional store-side programming only as needed to keep the shop running — secondary to support work.
Details

Context

Soul Living is ongoing work alongside studies. The role is operational support for the shop and server, not a claim of full-stack product engineering. On this CV it sits behind vulnerability research and education on purpose: the internship target is penetration testing / SOC, not a developer track.

  • E-commerce
  • Technical support
  • Server basics
Technical documentation Controltec

Technical documentation

Early professional experience writing and structuring technical documentation — the same habit that later shows up in disclosure reports.

June 2022 — August 2022

  • Prepared and organised technical documentation for an engineering / industrial context.
  • Built the reporting discipline later reused in vulnerability disclosures and vendor communication.
Details

Why it still matters on a security CV

Controltec was documentation work, not security testing. It remains relevant because clear writing is part of how findings get fixed: structure, precision and a reader who is not inside your head. That skill transfers directly to coordinated disclosure reports.

  • Technical writing
  • Documentation

Why this section is quiet

Placeholder tooling projects were removed on purpose. Invented recon pipelines and home-SOC stacks look busy on a CV and waste a recruiter’s trust. When a university or personal project is ready — with a real scope and honest outcome — it will be listed here.

What to read instead

01 — Contact

Looking for a penetration testing internship (SOC secondary)

I can walk you through any report, the lab methodology behind it, and how I document findings for vendors.

Open to internship opportunities — timing flexible

Get in touch [email protected]

I reply fastest by email. Happy to walk through any report, the methodology, or how I document findings.

Disclosure policy & safe harbor →