# Who Am I? > It started with running network cables in 2015; today I report CVEs. The decade in between is below. URL: https://iamcanturk.dev/en/about/ --- While studying computing in high school, I joined the IT department at Floteks as an intern in 2015. For two months I fixed user problems, worked with a Fortinet firewall and ran cables in the server room. That summer I understood I liked this work. I began higher education in Computer Programming at Uludağ University, where I was an active member of UHAVK (the university aviation society) with a particular interest in air sports. Both my love of paragliding and my wish to upgrade to a bachelor’s degree took me to Management Information Systems at Cumhuriyet University. During that time we founded CüSiber (the university cyber security society), where I served as co-founding vice president. Within two years we led trainings and conferences that had never been held in Sivas or across Anatolia before: Linux 101, reconnaissance and information gathering workshops, then a cyber security conference with five speakers. I was both organiser and participant at these events. After bringing new faces into the national cyber security ecosystem, I stepped back and handed the flag to newcomers. What remains are good memories, Hacktrick stickers, summits and friendships. I paused my studies and started as a web developer at DLL Teknoloji in 2019. With PHP and Laravel I built corporate sites, e-commerce systems, a proposal tracking tool, a CRM and an IoT dashboard that read electricity meters remotely. Within a year I learned a great deal and also saw what I was missing. Between October 2020 and June 2022 I returned to university and graduated from Management Information Systems as an honours student. In the same period I earned Cisco CyberOps Associate and CCNA certifications. As soon as I graduated I founded my own company in 2022, and in 2024 I brought that work together under the Echomerce brand. Working alone on client projects forced me to learn design too: logos, brand identity, social media templates, ad creatives. It turned out to be the most useful skill I picked up. Since November 2025 I have been an Application Security Engineer at Kuark. Kuark became a turning point for me; it gave me a playground where I can express my multidisciplinary side. Staying active in software development while never drifting away from security has done me a lot of good, and still does. Where that leaves me: when I look at a project I can think about how it will be built, how it will look and where it will break — all at once. For people who would rather talk to one person instead of three, that turns out to be useful. ## Deneyim ### Application Security Engineer Nov 2025 — Present — Kuark · Full-time · Bursa, Türkiye (Hybrid) I actively contribute to backend development while also taking responsibility for securing applications, performing vulnerability assessments and evaluating systems from an attacker's perspective. My role goes far beyond a traditional backend developer position: it combines software development with continuous application security improvement. - Developing APIs, microservices and backend modules with a strong emphasis on secure coding practices - Conducting security assessments aligned with OWASP Top 10 and SANS 25 - Performing regular Web/API penetration tests and enforcing strict security controls - Analyzing, prioritizing and reporting vulnerabilities, collaborating with development teams for remediation - Reducing the attack surface through threat modeling and attack surface analysis - Integrating SAST, DAST and dependency scanning tools into CI/CD pipelines - Implementing modern authentication and authorization mechanisms such as OAuth2, JWT, RBAC and MFA - Using a Red Team mindset to develop proof-of-concept exploits, test bypass techniques and evaluate system resilience - Supporting log management, security monitoring and incident response activities ### Co-Founder & Digital Solutions Consultant Dec 2024 — Present — Echomerce · Full-time · Türkiye In December 2024 I brought my freelance work together under the Echomerce brand. Echomerce focuses on software development, e-commerce solutions, digital marketing and advertising management, building custom solutions around each client's specific needs. We turn years of business management experience into smart, effective strategies that help clients succeed. Echomerce is not just a brand name; it represents our vision for excellence in digital solutions and a partnership built on trust. ### Freelance Web Developer Jun 2022 — Present — Yusuf Can TÜRK · Self-employed · Bursa, Türkiye (Remote) In June 2022 I founded my own company and started taking on freelance work, based on the industry and business management experience I had built up over the years. Running my own business gave me the freedom to serve clients better and to keep developing myself. ### Digital Marketing Consultant May 2025 — Nov 2025 — Zai Bodrum · Part-time · Bodrum, Muğla (Remote) For Zai Bodrum I strengthened the brand's digital presence through strategic planning, content management and optimisation of advertising campaigns. My remote support in social media and website management contributed directly to the brand's growth. ### Web Developer Jul 2023 — Dec 2024 — CC Holding · Full-time · Bursa, Türkiye (On-site) Worked full-time as a developer on corporate web projects and internal systems. ### Web Software Developer Nov 2019 — Oct 2020 — DLL Teknoloji A.Ş. · Full-time · Türkiye Worked with PHP, Laravel, HTML5, CSS, JavaScript, jQuery, Vue.js and Bootstrap on both internal and external client solutions: corporate websites, e-commerce sites and custom software, plus internal projects such as a proposal tracking system and a CRM, and IoT projects automating electricity consumption measurement. ### Information Technology Intern Jun 2015 — Jul 2015 — Floteks A.Ş. · Intern · Türkiye Completed my high-school internship in the IT department of Floteks A.Ş., working on user support, firewall management with Fortinet products, server and network administration — gaining hands-on experience with tools used across the industry. ## Güvenlik araştırması (CVE) ### Missing WebSocket origin validation (Cross-Site WebSocket Hijacking) March 2026 — Textream (macOS) < 1.5.1 In Textream for macOS prior to 1.5.1, the `DirectorServer` WebSocket server accepted connections from any origin without validating the HTTP `Origin` header during the handshake. A malicious web page visited in the same browser session could silently connect to the local WebSocket server and send arbitrary commands. ### Resource exhaustion through unlimited connections (DoS) March 2026 — Textream (macOS) < 1.5.1 In Textream for macOS prior to 1.5.1, the `DirectorServer` WebSocket server imposed no limit on concurrent connections. Combined with a broadcast timer sending state to all clients every 100 ms, an attacker could exhaust CPU and memory by flooding the server, freezing and crashing the application during a live session. ## Eğitim ve sertifikalar ### Management Information Systems — BSc 2017 — 2022 — Sivas Cumhuriyet University Graduated as an honours student. Co-founding vice president of CüSiber (Cumhuriyet University Cyber Security Society) — we organised trainings and conferences. ### Web Design and Coding — Associate Degree 2020 — 2023 — Anadolu University Anadolu University Open Education Faculty. ### Computer Programming — Associate Degree 2016 — 2018 — Uludağ University Active member of UHAVK (Uludağ University Aviation Society), with a focus on air sports. ### Advanced Entrepreneurship Training Jul 2022 — KOSGEB · Certificate ### Traditional Entrepreneurship Training Jul 2022 — KOSGEB · Certificate ### CyberOps Associate Feb 2022 — Cisco · Certificate Fundamentals of SOC analysis: monitoring, incident response and threat analysis. ### CCNA: Introduction to Networks Jan 2022 — Cisco · Certificate ### NDG Linux Unhatched Nov 2021 — Cisco Networking Academy · Certificate ### Introduction to Cybersecurity Oct 2021 — Cisco · Certificate ### English — Pre Intermediate / B1 Sep 2021 — YDS Academy · Certificate ### Building Websites with Laravel Feb 2020 — Istanbul Business Institute · Certificate Credential ID: 0902010290022 ## Topluluklar ### Hacktrick 2024 2024 — BTK, Ankara ### Hacktrick 2022 2022 — BTK, Ankara ### Hacktrick’18 2018 — BTK, Ankara ### Hacktrick’17 2017 — BTK, Ankara ### Cezeri Cyber Security Academy 2017 ### CüSiber Cyber Security Conference 4 December 2017 — Cumhuriyet University, Sivas A full-day conference with five speakers: Applied Information Security Awareness (İsmail Saygılı), Careers in Cyber Security (Ertuğrul Başaranoğlu), Our Footprints in Search Engines (Hamza Şamlıoğlu), PowerShell and Client Side Attacks (Halil Dalabasmaz), 50 Shades of MS-SQL (Eyüp Çelik). ### Introduction to Cyber Security & Malware and Cryptology 9-10 December 2017 — CüSiber, Sivas A two-day training programme: Introduction to Cyber Security (Fatih Mehmet Dişçioğlu), Malware and Cryptology (Kağan Işıldak). ### Reconnaissance and Information Gathering Training 24 November 2017 — CüSiber, Sivas ### Linux 101 Training 14-15 October 2017 — CüSiber, Sivas