🔍 Black-box & Gray-box VAPT

Comprehensive security assessments focusing on OWASP Top 10, API security flaws, and business logic vulnerabilities

⚡ Exploit Development

Automating test cases and exploit development using Python, Bash, and JavaScript

🚨 Incident Response

Leading end-to-end incident response and post-exploitation VAPT on web applications

🔧 Security Tool Development

Creating custom offensive security tools and PoCs, including Burp Suite extensions

🎯 Red Team Operations

Simulating advanced attacks including Kerberoasting, AS-REP Roasting, and Pass-the-Hash

Web/App Security

Burp Suite Pro, Postman, OWASP ZAP, Nmap

Exploitation Tools

SQLMap, Metasploit, Nikto, John the Ripper, Hashcat

Reconnaissance

FFUF, Subfinder, Gobuster, Amass, WAFW00F

Programming

Python, JavaScript, Bash

Security Standards

OWASP Top 10, MITRE ATT&CK, CVE

Attack Vectors

SQLi, XSS, SSRF, RCE, IDOR, Auth Bypass, XXE, API Misconfig

🔴 BNHS Incident Response: Broken Auth to RCE Exploitation Chain

Led end-to-end incident response and conducted post-exploitation VAPT on Laravel, WordPress, and CodeIgniter applications. Successfully analyzed and reversed obfuscated PHP backdoors, removed SEO spam injections, and reinforced server entry vectors against RCE and web shell (Backdoor) attacks.

🔧 Custom Burp Suite Extension Development

Created custom Burp Suite extension for detecting shell access patterns and automated exploit chains during black-box assessments, significantly improving the efficiency of vulnerability discovery.

🎯 Red Team Attack Simulation

Simulated advanced red team attacks including Kerberoasting, AS-REP Roasting, and Pass-the-Hash using BloodHound and CrackMapExec for internal network reconnaissance and privilege escalation.