DeadPackets

Youssef Awad

Head of Engineering & Co-Founder, CTFae

Hacker and software engineer. I break into systems for a living, and I build the platforms other hackers compete on.

Dubai, UAE · open to opportunities

Download CV (PDF) [email protected] GitHub LinkedIn
  • 10,000+ concurrent players on CTF infrastructure I architected for BlackHat MEA
  • 90%+ Domain Admin rate across 100+ Active Directory engagements
  • OSCP 90/100, 12+ CTF wins, 30+ CTF events engineered
Youssef on stage mid-talk, hands up, behind a laptop covered in CTF and hacker-con stickers

What makes a good hacker?

The stickers on my laptops.

Two laptops, 2019 to now. Every sticker here is cut from a photo of a real lid. Each one marks Engineering or Offense.

The HUAWEI MateBook D16 lid, covered in about 50 stickersThe MacBook Pro 16 lid, covered in about 36 stickers

Engineering BlackHat MEA, Riyadh

The world's largest CTF ran on infrastructure I architected.

In 2024 it set the Guinness World Record. Every player got their own challenge containers on AWS ECS, started on demand.

  • 10,000+ concurrent players
  • AWS ECS containers on demand
  • 2024 Guinness World Record

Drag the sticker to turn it. ClickTap any sticker for its story.

The blackhat sticker

Engineering 2021 to now

Co-founded CTFae.

Head of Engineering. We build CTFs (capture-the-flag hacking competitions) and cyber ranges for governments, universities and conferences.

  • 100+ teams scored live
  • IaC cyber ranges on AWS and GCP
  • 2024 Best Emirati Startup, GISEC
The CTF.ae (outline) sticker

Offense Malcrove, 2022 to 2025

Domain Admin, most weeks.

Three years as a senior consultant at Malcrove, testing UAE government and critical-infrastructure networks. The usual end state: full control of the Windows domain.

  • 90%+ Domain Admin rate
  • 100+ Active Directory tests
  • Web, mobile networks, wireless
The Elite First Blood (Malcrove CTF) sticker

Offense 2016 to 2025

First place, ten times.

From CyberBattle of the Emirates and HITB Lockdown to CyberQuest Attack-Defense and, in 2025, SaikoCTF at HITB Thailand.

  • 12+ CTF wins
  • 10 first places, 2016 to 2025
The FIRST BLOOD sticker

Engineering CTF events

From playing CTFs to running them.

DEF CON 33, GITEX, HITB, BSides Nashville, BlackHat. The green one is holographic in real life too.

  • 30+ CTF events engineered
  • 2021 longest CTF in the UAE
The DEFCON (green) sticker

Engineering Side projects

Always building something.

Silly ideas are how I learn a new stack properly. One is a to-do app that faxes me, and you can send me a task. Others pit LLMs against each other at chess or run a trivia night.

  • 6 projects below
  • Claude and Gemini
  • RAG, evals in production
The SHIP IT sticker

Offense Certified

OSCP certified.

OSCP, Offensive Security Certified Professional. The heart is not ironic.

  • 90/100 OSCP exam
  • Hack The Box practice
The TRY HARDER sticker

Engineering DEF CON 33, 2025

Led engineering for the Bug Bounty CTF.

Bug Bounty Village, Las Vegas.

  • DEF CON 33 Bug Bounty Village
  • 2025 Best Community Engagement award
The Bug Bounty Village 2025 CTF sticker

Not convinced stickers are enough?

Let's see what these laptops built.

CTFae

Company · 2021 to now

The CTF and cyber-range platform behind BlackHat MEA, GITEX and DEF CON 33 events. Challenge Deployment API, CyberRanges IaC and a real-time Attack-Defense checksystem for 100+ teams.

  • FastAPI
  • AWS ECS
  • Terraform
  • Celery
  • PostgreSQL

ctf.ae

The CTF.ae home page: Built for Real Operations, trusted by JetBrains, Black Hat MEA, Bug Bounty Village and Dubai Police

LLM-AD-Defense

Private repository · Python

An autonomous SOC analyst on Gemini 2.5 Pro. It reads Wazuh EDR alerts and remediates on its own, including isolating compromised Active Directory accounts.

  • Python
  • Gemini
  • Wazuh
  • Active Directory

Private. The screen shows an illustrative session.

Illustrative terminal session of LLM-AD-Defense triaging alerts and isolating an account

LLMChessArena

Open source · TypeScript

Any LLM against any LLM at chess, streamed live with Stockfish evaluation and per-move token cost.

  • TypeScript
  • Stockfish
  • Any LLM

Play it live Source

LLM Chess Arena: a list of live and finished games between language models

BuzzerMinds

Live · Web

A live trivia party. One big screen, a room full of phones, and AI-generated questions grounded in real facts.

  • Web
  • LLM-generated, fact-grounded

Start a game

BuzzerMinds start screen with Create Game and Room Code

FaxMeMaybe

Open source · TypeScript

A gloriously over-engineered to-do and reminder system. Send it a task and it faxes it to me.

  • TypeScript
  • Fax

Send me a to-do Source

FaxMeMaybe form: send me a TODO, with importance and due date

DOSArchive

Open source · Astro

My dad Yasser Awad's DOS programs from the early 1990s, restored and playable in the browser. On the screen: SUN.EXE, his 1993 Arabic program about the sun in C and Assembly, which won 3rd place in a PC Middle East programming competition.

  • Astro
  • DOS, in the browser

Open the archive Source

DOSArchive: 15 programs by Yasser Awad, 1991 to 1993

The full CV

Youssef Awad · Dubai, UAE (GMT+4) · Open to opportunities

Download PDF

Experience

Head of Engineering & Co-Founder, CTFae

2021 to now

  • 10,000+ concurrent players
  • 2024 Guinness World Record
  • 100+ teams scored live
  • Challenge Deployment API: on-demand containerized challenges on AWS ECS with auto-scaling, for 10,000+ concurrent players at BlackHat MEA.
  • CyberRanges IaC: multi-VM attack-defense environments on AWS and GCP, built with Terraform, Packer and Ansible, shipped by GitHub Actions with OIDC.
  • Attack-Defense checksystem: real-time scoring of 100+ teams at once on Celery, PostgreSQL with PgCat, and Redis.
  • Event engineering: DEF CON 33 and 34 Bug Bounty CTF, GITEX Dubai, Bahrain National CTF, BSides Nashville, HITB, Dubai Police CTF.

Senior Cyber Security Consultant, Malcrove

2022 to 2025

  • 90%+ Domain Admin rate
  • 100+ AD engagements
  • Penetration tests: UAE government and critical-infrastructure clients: web and mobile apps, internal and external networks, wireless.
  • Active Directory: Domain Admin in over 90% of 100+ engagements.
  • Reporting: CVSS-scored reports with proof-of-concept exploits, and briefings for non-technical leadership.

Volunteer researcher, GDI.Foundation

2019 to 2024

  • Coordinated disclosure: found and reported exposed systems.

Record

CTF podiums 10 × 1st

  1. 20251stSaikoCTF, HITB Thailand
  2. 20211stGISEC SOCathon
  3. 20201stHITB Lockdown
  4. 20201stCyberKnight
  5. 20201stCyberTalents UAE
  6. 20191stDubai Police CTF
  7. 20191stCyberBattle of the Emirates
  8. 20191stCyberTalents UAE
  9. 20192ndHITB AI Challenge
  10. 20193rdCyberTalents Arab
  11. 20181stCyberQuest Attack-Defense
  12. 20161stCyberQuest
  13. 20162ndCSAW Forensics

Awards

  1. 2025Best Community Engagement, UAE CyberSecurity Awards
  2. 2024Guinness World Record, largest CTF in the world, BlackHat MEA
  3. 2024Best Emirati Startup, GISEC (CTFae)
  4. 2021Outstanding CSE Student Talent, American University of Sharjah
  5. 2021Longest CTF in the UAE, ramadan.ctf.ae

Talks

  1. 2024Cyber Drill workshop, HITB Thailand
  2. 2024The CTFae story, CPX CyberAlley
  3. 2021Two-day Attack-Defense training, HITB CyberWeek
  4. 2020Stealing Windows hashes, live, GISEC
  5. 2019Invited speaker, DESC

Stack

Applied AI

  • Claude
  • Gemini
  • OpenRouter
  • Multi-agent orchestration
  • RAG
  • Evals and guardrails

Languages

  • Python
  • TypeScript
  • JavaScript
  • Bash
  • SQL

Cloud

  • AWS
  • GCP
  • Docker

Infrastructure as code

  • Terraform
  • Ansible
  • Packer
  • GitHub Actions

Web

  • FastAPI
  • Hono
  • React
  • Next.js

Data and queues

  • PostgreSQL
  • Redis
  • Celery
  • RabbitMQ

Offense

  • Penetration testing
  • Red teaming
  • Active Directory
  • CTF development

Offense tools

  • Burp Suite
  • Kali Linux
  • Hack The Box

Education

  • B.Sc. Computer Engineering, minor in Computer Science

    2017 to 2022 · American University of Sharjah

  • OSCP, Offensive Security Certified Professional

    Certified · 90/100 on the exam

More things I built

  • VisualizeAUS Python

    20 years of AUS course data, visualized. Source

  • InfoSteal JavaScript

    A page that learns as much as it can about whoever visits it. Source

  • HackPi JavaScript

    Turns a Raspberry Pi into a plug-in hacking device.

  • pwnbox Shell

    Kali in a Docker container, pre-loaded with tools, ZSH and SSH.

  • DiscordIPs Python

    Finds Discord's voice server IPs.

  • HistoryThief HTML, JS

    Social engineering plus CSS and JS tricks that leak your browser history.

Want to add to the collection?

[email protected]

Browse every sticker

The HUAWEI MateBook D16 lid, covered in stickersThe MacBook Pro 16 lid, covered in stickers