Security Engineer with hands-on experience in VAPT, security automation, and offensive tooling — building custom security tools and wiring AI into pentesting workflows.
Interactive shell — type help to begin. Try whoami, projects, ctf, matrix… (there are hidden commands 🚩)
whoami --verbose
I'm a Security Engineer focused on offensive security — VAPT, security automation, and building the tooling that makes red-team work faster. I ranked 77th out of 22,000+ in the national Pentathon 2025 CTF, was a CloudSEK CTF finalist, and cleared the full board at the FamPay Security CTF (6/6). I've documented 130+ HackTheBox & CTF writeups along the way.
My work sits at the intersection of offensive security and AI — I build custom recon tools, exploit-chaining workflows, and increasingly integrate LLMs into pentesting via the Model Context Protocol. Currently I contribute to infrastructure automation and AI-powered internal tooling at Sopra Banking Software.
Comfortable across the stack: from binary internals and reverse engineering up through web, API, cloud, and Active Directory security.
_____
/ _ \ ____
/ /_\ \ / ___\
/ | / /_/ >
\____|__ \___ /
\/_____/
cat /var/log/career.log
ls -la ~/projects
A Model Context Protocol server in a Docker-containerized Kali environment that lets LLMs (Claude / Copilot) orchestrate 15+ pentest tools through natural language. Built on FastMCP over stdio, with OpenVPN for HTB/TryHackMe labs. The AI chains tools intelligently — spot SMB on 445, auto-suggest CrackMapExec. Hardened with shlex input sanitization, 300s command timeouts, and container isolation.
read the writeup →
A Python CLI that automates the full assessment pipeline: custom multi-threaded socket
port scanning (100+ threads, queue-based), service fingerprinting, dual-mode version
detection (banner + nmap -sV), and CVE correlation via the NVD API with
semantic-version matching and CVSS scoring. Outputs structured JSON / CSV / TXT reports.
Authenticated Android messaging and announcement app built following secure SDLC and OWASP MASVS principles, with threat modeling applied throughout the design.
./submit_flag.sh
Skills demonstrated: Web Exploitation (OWASP), API Security, JWT/SSTI/RCE chains, Binary Exploitation, Reverse Engineering, Privilege Escalation, Recon Automation.
cat skills.json | jq
git log --oneline ~/blog
Featured technical write-ups published on Medium. Full multi-step exploitation chains, from initial recon to root.
Chaining a JWT weakness into server-side template injection and finally remote code execution — the full Round 2 finalist submission.
read on Medium →Qualifier writeup walking through the challenge set — recon, auth bypasses, and the reasoning behind each solve.
read on Medium →All six challenges from one APK: hardcoded native secrets, weak Firebase rules, an App Check bypass, a backdoored signing scheme, a JWT alg:none bypass, and an AWS SSRF→IMDS chain on live EC2.
writeup publishing soonArchitecture deep-dive on the containerized Kali appliance — VPN/networking fixes across WSL/Docker and a threat model of the appliance itself.
read on Medium →./connect.sh
Open to security engineering, red team, and offensive tooling roles. Let's talk.