Alexander 'xaitax' Hagenah

Professional Experience

05/2021 - Present

Head Cyber Controls / Offensive Cyber Security Lead

Advisory Council Member

Harvard Business Review

Brighton, United States

07/2022 - Present

Technical Advisory Board

HackerOne

San Francisco, United States

04/2017 - 04/2021

Chief Technology & Innovation Officer

Senior Offensive Security Specialist

Confidential

Dubai, United Arab Emirates

Education

2022 - 2023

Executive Certificate, Managemet & Leadership

Executive Certificate, Cybersecurity Risk Management

Expertise

Global Cybersecurity Leadership

With over two decades in the cybersecurity domain, my career journey has evolved from a foundation in hacking to leading international teams in complex security environments. My experience spans various sectors, providing me with a nuanced understanding of diverse cybersecurity challenges and solutions. This extensive background empowers me to effectively manage and lead teams in developing and implementing strategic security measures on a global scale.

Expertise in Cybersecurity

My deep understanding of cybersecurity is rooted in more than 20 years of experience in the field, beginning with an early focus on ethical hacking. This journey has equipped me with a profound knowledge of cyber threats and defense mechanisms, enabling me to develop sophisticated strategies and solutions that address evolving security challenges.

Public Speaking and Advisory

As a recognized speaker, I've shared my insights at various international conferences (such as Interpol & Europol), extending beyond law enforcement to a broader range of cybersecurity topics. My ability to engage with a wide array of audiences, from technical experts to business leaders, underscores my role as a trusted advisor and thought leader in the cybersecurity community.

Innovative Cybersecurity Strategist

My approach to cybersecurity is characterized by a commitment to innovation and strategic problem-solving. With a career marked by continuous learning and adaptation, I've developed a knack for identifying and implementing cutting-edge security strategies that effectively mitigate risks and strengthen organizational resilience in the face of cyber threats.

Research

TotalRecall

This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. It was featured in WIRED, ZDNet, Ars Technica and many other media outlets.

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC

This script presents a proof of concept (PoC) for CVE-2024-21413, a significant security vulnerability discovered in Microsoft Outlook with a CVSS of 9.8. Termed the #MonikerLink bug, this vulnerability has far-reaching implications, including the potential leakage of local NTLM information and the possibility of remote code execution. Moreover, it highlights an attack vector that could bypass Office Protected View, thereby extending its threat to other Office applications.

SploitScan

SploitScan is a powerful and user-friendly tool designed to streamline the process of identifying exploits for known vulnerabilities and their respective exploitation probability. Empowering cybersecurity professionals with the capability to swiftly identify and apply known and test exploits. It's particularly valuable for professionals seeking to enhance their security measures or develop robust detection strategies against emerging threats.

PatchaPalooza

A comprehensive tool that provides an insightful analysis of Microsoft's monthly security updates.

Interactive Website (https://patchpapalooza.com)

CISA Catalog of Known Exploited Vulnerabilities

The script, which is designed to be user-friendly and efficient, allows users to search through the CISA Catalog database offline for specific products or vendors, and then displays detailed information about any vulnerabilities that have been identified in those products or by those vendors. The information that is displayed also includes the vulnerability's Common Vulnerabilities and Exposures (CVE) number including a link to the NIST database. It also features the possibility to display enhanced information about specific CVEs.

WinRAR CVE-2023-38831 (Metasploit Module)

This Metasploit module exploits a vulnerability in WinRAR 6.22 (CVE-2023-38831). When a user opens a crafted RAR file and its embedded document, the decoy document is executed, leading to code execution.

BitDefender for Mail Servers Malware Detection Bypass

BitDefender Mail Server Scan-Engine could be bypassed by manipulating email attachments. Specifically, if an email contained multiple attachments, the engine would only scan the first one, ignoring subsequent attachments, which could potentially carry malicious content. This vulnerability was particularly relevant to UUencoded mails.

Contact

Email
ah@primepage.de

GPG Key [0x80DD8C331ACD3D0F]