Skip to content
View HO-9's full-sized avatar
2 followers · 3 following

Achievements

Achievement: Quickdraw

Achievements

Achievement: Quickdraw

Highlights

Block or report HO-9

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
HO-9/README.md

Chanho Kim (Ho-9)

Security Researcher

Profile

I research software vulnerabilities, application security, and practical threat hunting. My interests include vulnerability analysis, security tooling, UEFI security, web hacking, malware analysis, and AI-assisted security research.

Skills

  • System Hacking
  • Web Hacking
  • Vulnerability Analysis
  • Malware Analysis
  • Threat Hunting
  • AI / LLM
  • C / Python / Java / SQL

Experience

Organization Role Period
H3XOR Security Researcher 2018.07 – 2019.07
Republic of Korea Army Special Forces CERT Team 2020.07 – 2022.01
KITRI Best of the Best (BoB) 11th Vulnerability Analysis 2022.07 – 2023.03
Ai-Ver.se Labs Senior Researcher 2023.02 – Present

Research Projects

UEFI Exploitation Fuzzer Project · 2022.07 – 2022.12

Node.js Vulnerability Analysis · 2023.04 – 2023.09

  • ReDoS vulnerability detection tool trend analysis and improvement research — CISC-W'23 Outstanding Paper Award
  • Node.js package vulnerability analysis through prototype pollution pattern research — CISC-W'23
  • Disclosures across Node.js packages including CVE-2023-45827, CVE-2024-23339, and CVE-2024-27088

Achievements / Awards

  • Codegate Junior 2018 — Finalist
  • BYU CTF — 2nd place, team Budaejjigae
  • CISC-W'23 — Outstanding Paper Award
  • KISA Practical Cyber Training Center — Threat Hunting instructor, 2023

Disclosed Vulnerabilities

HackerOne

  • #3639103 — Insufficiently Protected Credentials

FindTheGap

  • FVE-2024-5b89-188 — XSS Using meta tag
  • FVE-2024-5b89-127 — Admin page Misconfiguration
  • FVE-2024-5b89-64 — Self-XSS

CVE / GHSA

Product Vulnerability identifier(s)
Firefox CVE-2026-6778
Nvidia CVE-2026-24189
Samsung CVE-2023-30738 · SVE-2023-0437
Next.js CVE-2026-64646
Node CVE-2026-1526
OpenSSL CVE-2026-28390
Electron CVE-2026-34765
libssh CVE-2026-59844
PHP CVE-2025-1218
Insyde CVE-2023-27471 · SA-2023036
n8n CVE-2026-59253
MSI CVE-2026-82908
jq CVE-2026-33948 · CVE-2026-39979
capnproto CVE-2026-32240 · CVE-2026-32239
Mailspring GHSA-pj5m-wc7c-mwhg · GHSA-px2g-jhg5-c6gh · GHSA-83gr-g8q8-fw32
NanaZip CVE-2026-27711 · CVE-2026-27710 · CVE-2026-27709
backnet-stack CVE-2026-26265
dot-diver CVE-2023-45827
get-func-name CVE-2023-43646
hoolock CVE-2024-23339
es5-ext CVE-2024-27088
fprime GHSA-grhx-8h8f-j7fm

CTF

  • Codegate Junior 2018 Finals
  • BYU CTF 2023 — 2nd place, team Budaejjigae
  • Other CTF participation and security competitions since 2018

Bug Bounty

  • Samsung SDS / FindTheGap disclosures
  • HackerOne vulnerability report #3639103
  • Responsible disclosure of web and application security issues

Teaching

  • KISA Practical Cyber Training Center, 2023
  • Threat Hunting
  • MITRE ATT&CK TTP-based threat behavior simulation, event identification, and analysis

Research & Publications

  • UEFI GitBook
  • UEFI Security Trends, CISC-W'22
  • A Study on Node.js Package Vulnerabilities through Prototype Pollution Pattern Analysis, CISC-W'23
  • A Study on Trends in ReDoS Vulnerability Detection Tools and Vulnerability Analysis through Improvement, CISC-W'23

research · analyze · build · share

Popular repositories Loading

  1. HoSqlinjector HoSqlinjector Public

    Python

  2. HO-9 HO-9 Public

    Config files for my GitHub profile.

  3. ho-9.github.io ho-9.github.io Public

    HTML

  4. Chat2DB Chat2DB Public

    Forked from OtterMind/Chat2DB

    🔥🔥🔥AI-driven database tool and SQL client, The hottest GUI client, supporting MySQL, Oracle, PostgreSQL, DB2, SQL Server, DB2, SQLite, H2, ClickHouse, and more.

    Java

  5. reflex reflex Public

    Forked from reflex-dev/reflex

    🕸️ Web apps in pure Python 🐍

    Python

  6. dlt dlt Public

    Forked from dlt-hub/dlt

    data load tool (dlt) is an open source Python library that makes data loading easy 🛠️

    Python