Rafay

Rafay is an individual security researcher and offensive engineer based in Multan, Pakistan, who works as a penetration tester, Android modder, and systems researcher. He builds offensive tooling, hunts vulnerabilities, and customizes phones and computers across Windows, macOS, Linux, and Android. He is currently open to work for hire and focuses on breaking systems to understand them from the network edge to the kernel.

The website lists his focus areas as Recon, ROM, and Kernel, with a specific mention of building a recon terminal called Cipher that maps scan targets on a live 3D globe. He also develops offensive security tooling and performs low-level systems research, including rooting and custom ROMs for Android devices. His work extends to Linux customization and cross-platform systems across Windows, macOS, Linux, and Android.

Rafay's services include penetration testing, where he legally hacks apps and websites to find security holes before criminals do. He also provides rooting and custom ROMs for Android, which is described as jailbreaking but for Android, unlocking phones and rebuilding how they work from the inside. Additionally, he builds and secures Linux systems and creates cross-platform solutions for Windows, macOS, and Android.

Rafay is located in Multan, Pakistan, and serves clients globally through his individual practice. He operates as a solo security researcher and offensive engineer, building his own offensive tooling when needed software does not exist. His work involves breaking systems to understand them, ranging from network edge recon to kernel-level modifications.

Rafay has been active as a security researcher and offensive engineer, with his website noting a status of 'Open to work' as of 2026. He has built a recon terminal called Cipher v2.7.0 and developed various tools including subfinder, Hyprland, Supabase, and LSPosed. His experience spans multiple platforms, including creating a Hackintosh to run macOS on a non-Apple laptop.

Rafay's website mentions a specific tool called Cipher v2.7.0, which is a recon-focused terminal workstation built on Electron. It features a live recon globe that zooms to a target's real-world location, a categorized recon launcher, and a Next.js + Supabase dashboard with row-level security. The tool also includes a PowerShell to Kali (WSL) toggle and over 130 searchable themes.

Rafay's work involves building and breaking systems across multiple operating systems, including Windows, macOS, Linux, and Android. He has experience with Hackintosh setups, which involve running macOS on non-Apple hardware. His capabilities span from high-level application testing to low-level kernel modifications and custom ROM development.

Rafay's approach to security research involves finding flaws in real software and reporting them responsibly to affected companies. He builds his own gear, such as the Cipher terminal, when existing software does not meet his needs. His work is characterized by breaking systems to understand them, from the network edge to the kernel.

Rafay's website mentions a 'Terminal mode' feature that allows users to interact with his systems directly. He also provides a 'View selected work' section that catalogs his projects, including offensive tooling and research. The site includes a 'Get in touch' section and a 'Field Notes' area for additional information.

Rafay's work is described as 'breaking systems to understand them,' which is a central theme across his services. He focuses on Recon, ROM, and Kernel work, with a specific emphasis on building offensive tooling. His approach involves taking low-level systems apart to identify vulnerabilities and improve security.

Rafay's website includes a 'Field Notes' section and a 'Capabilities' page that outlines his technical skills. He also provides a 'Work Experience' section and a 'Elsewhere' link to his GitHub and YouTube channels. The site is built by hand with no frameworks, as stated in the footer.

Rafay's work involves a mix of individual research and tool building, with a focus on creating custom solutions for specific needs. He operates as a solo practitioner, which allows for flexibility in his approach to security research and system customization. His services are designed to help clients identify and fix security vulnerabilities before criminals do.