Gal Zror Email & Phone Number

Israel

As the leader of a group of 3 vulnerability research teams, my primary responsibilities include overseeing the team's work, providing guidance and direction as they research new attack threats and disclose them with external vendors, conducting penetration tests on CyberArk's products, and innovating new products and features.In addition, I also conduct my own research. In 2022 I had the honor to speak for the second time at DEFCON30 - Hacking ISPs with Point-to-Pwn Protocol over Ethernet (PPPoE):

I acted as a research team leader at Aleph Research by HCL AppScan. My responsibilities included leading vulnerability research, innovating new products, and contributing to AppScan's products security logic.During my employment, I assembled and led two teams: - Vulnerability research team - discovered, disclosed and published various vulnerabilities in companies such as - HP, Commscope, Canonical, Google and more. - Web security research team - developed new security logic for AppScan products (DAST/IAST) using advanced techniques and technologies. Attacks such as SSRF, deserialization, XXE and DOM XSS.Research and developed a POC for interactive application security testing (IAST) for AppScan. By creating a byte-code level function instrumentation and advanced taint propagation algorithm.I co-research out of bound detection system for blind web attacks.https://blog.hcltechsw.com/appscan/hey-dns-with-hcl-appscan-domain-name-server/In addition, I also conduct my own research. I found more than 20 CVEs including multiple RCEs in CommScope's Ruckus Networks and HP's Aruba. Some of the issues were presented at DEFCON and 36C3.

Leading the department's security research effort - Conducting POCs (firmware RE, Software RE, exploit development), designing architectures and training new developers/researchers.

Leading dozens of security research projects from initial research level, exploit development to a working product.* Received a commendation from the director of the organization about a project I was involved in.