Testing security, building websites, writing tools.
I help website owners and in-house teams find security flaws before someone else does, recover websites that have already been attacked, build the systems they need, and prepare tools for daily work.
- Location
- Indonesia (UTC+7)
- Working languages
- Indonesian and English
- Status
- Open for projects
Tools I use daily
Security testing
Burp Suite · Nuclei · ffuf · sqlmap · nmap · Metasploit · OWASP ZAP · Wireshark · Postman
Website development
HTML · CSS · JavaScript · Tailwind CSS · Bootstrap · jQuery · MySQL · Git · Docker
Tool development
Python · Node.js · PHP · Bash
CMS and frameworks
WordPress · Laravel · CodeIgniter · PHP native
About me
My name is Hilman Zain, codename zenthakid. I work on website security: tracing flaws, including CVE-class flaws in the components a site depends on, and helping to close them before someone else can use them.
I also build software in Python, Node.js and PHP. Past work includes admin panels, payment panels, game top-up sites and SMM panels.
Services
Four services clients ask for most.
Website pentest
I test your website, find the flaws someone else could use, and explain how to fix them in steps your team can follow.
Website development
New websites, or work on a site already running, including admin panels and payment systems.
Tool development
Tools for daily work, such as automation, security checks, or report builders.
Recovery after an attack
For a website that has already been attacked, such as a page changed or defaced: I clean up what the attacker left, close the way they got in, then monitor the server that was infiltrated so it does not happen again.
How I work
These four steps apply to all four services. Only the work itself changes.
- 1
Scope agreed
Scope, targets and limits are agreed in writing before work starts — including which parts I am allowed to touch.
- 2
First look
I study the situation first: which parts need testing, building, or how far an attack has already gone.
- 3
The work
Security testing, website development, tool building, or clearing what an attacker left — done by hand, not only by running automated tools.
- 4
Report and monitoring
The work and its findings are handed over together with how to fix them; a server that was broken into is watched afterwards.
Clients and results
Client names are withheld as agreed. I list only the sector and the findings I am allowed to share.
Sectors and type of work
- FintechWeb app pentest · 2025
- MarketplaceAPI review · 2025
- Multi-tenant SaaSClosed pentest · 2024
- Retail e-commerceBug bounty programme · 2024
Results per service
- Website pentest
Web application testing for clients, reported finding by finding with its severity.
- Website development
Admin panels, cafe payment panels and SMM panels — including repairing sites already running.
- Tool development
Small tools for repetitive work, built with Python, Node.js or PHP.
- Recovery after an attack
A damaged website put back the way it was, the hole that let it happen closed, the server that was broken into watched.
Projects I founded
- ThaquinxGame top-up and digital voucher service that I founded and run myself.Open the site
Findings I can share
Users could open invoices belonging to another client
CriticalBy changing a single number in the address, a regular user could open invoice documents belonging to another client. Found while tracing the invoice download flow.
Website pentest · Fintech · 2025
The payment amount could be changed from the visitor side
HighThe payment page took a number from the visitor side without checking it again on the server, so the amount due could be lowered before paying. I moved the check back to the server.
Website development · Payment panel · 2024
Passwords written inside the code of an internal tool
HighDatabase passwords and third-party service keys were written straight into the code, so they travelled with every copy. I moved them into a separate file and limited who can read it.
Tool development · Internal · 2024
Front page defaced and the original hole still open
CriticalThe front page of the site was replaced by someone else. Once the page was restored, I traced the way in, closed it, then watched the server so the same thing cannot repeat.
Recovery after an attack · Website · 2025
Full reports, including reproduction steps and evidence, are available when we work together.
Certificates
Security certificates and training I have completed.
No certificates are listed yet.
Partners
I work with communities, agencies and other teams.
No partners are listed yet.
Contact me
Send a short outline of the work you need. I will reply with a plan and a time estimate.
- [email protected]
- PGP key
- [ paste your PGP fingerprint ]
Profiles elsewhere
- LinktreeAll my social mediaOpen profile
- Link.meMy link pageOpen profile
- FiverrHire me through FiverrOpen profile
- HackerOneBug bounty profileOpen profile
- TryHackMeProfile CTFOpen profile