Chennai, Tamil Nadu, India
B.Sc. Computer Science student building offensive security tools from the ground up. I built a production C2 framework during internship, automated a full bug bounty recon pipeline, and solved 31 CTF challenges — all documented, all on GitHub.
I'm a final-year B.Sc. Computer Science student at Prince Shri Venkateshwara Arts & Science College, Chennai — CGPA 8.09/10, graduating April 2027. I don't study security. I practice it. My entire focus is offensive security: understanding how systems break, building the tools that break them, and documenting every step.
At Femtosoft Technologies, I wasn't given a task list — I built NightShade from scratch. A production C2 framework with AES-128 encrypted comms, anti-sandbox evasion using RAM, CPU, and process-count fingerprinting, Windows registry persistence, and stealth self-sanitization. The kind of thing you read about in threat intel reports. I wrote it.
At Thiranex, I built four independent security projects during internship — a secure login system, a phishing detection model trained on 164K emails, a CVE-linked vulnerability scanner, and a password strength analyzer. All production-grade. All on GitHub.
I'm currently deep in a 90-day red team skill lock-in: Linux mastery, Active Directory, BloodHound, Kerberoasting, and bug bounty hunting. I also build hardware — planning a custom wireless C2 implant from PCB design to embedded Linux before graduation.
Production-grade encrypted C2 framework built during internship at Femtosoft Technologies. AES-128 encrypted comms, anti-sandbox evasion via RAM/CPU/process fingerprinting, Windows registry persistence, stealth execution, and self-sanitization modules. Modular architecture separates server, agent, and encryption layer.
Deep Dive →Automated kill-chain recon pipeline: subfinder + amass → httpx → katana → nuclei. Regex-based exploit hint classifier flags SQLi, IDOR, open redirect, path traversal, and exposed admin endpoints. Dual-format output (PDF + HackerOne-ready Markdown). Flask dashboard with SQLite history tracks attack surface changes over time.
Deep Dive →Random Forest classifier trained on 164,000+ emails achieving 97.97% accuracy — outperforming baseline Naive Bayes by 4.2 percentage points. Features: URL patterns, TF-IDF keyword frequency, sender domain reputation, header anomalies. 98.1% precision to minimise false positives in production.
Deep Dive →Production-grade authentication system: Argon2id password hashing, SQLAlchemy ORM eliminating SQL injection, CSRF tokens on all state-changing forms, per-IP rate limiting, temporary account lockout, and secure cookie flags (HttpOnly, Secure, SameSite). Zero known injection or session vulnerabilities.
Deep Dive →Port and vulnerability scanner integrating the NVD API to cross-reference detected software versions against live CVE feeds. Generates structured PDF assessment reports with CVSS severity tiers via FPDF2.
Deep Dive →Entropy scoring, complexity enforcement, and breach-database reuse prevention. Shannon entropy calculation, pattern detection, and credential database integration to reduce weak credential risk at account creation.
Deep Dive →Challenges solved on picoCTF picoGym across Web Exploitation and Forensics. All documented with full methodology in public writeup repository.
IDOR · PostgreSQL SQLi · SSTI → RCE · File upload bypass · Rate-limit bypass via X-Forwarded-For spoofing · Session hijacking · Credential stuffing · SQLMap-based injection · Authentication bypass · 2FA bypass · robots.txt recon · Hash-based access control bypass · HTTP header inspection
Binary digit analysis · File corruption recovery · Steganography (hidden in plain sight) · Registry-based artifact analysis · Disk image forensics (DISKO 1) · Base64-encoded PNG extraction · Hex decoding · Magic byte repair
Automated multi-step attacks using Python (requests, socket, hashlib) — scripted recon and exploitation across challenge categories.
I'm a final-year student open to internships, research collaborations, bug bounty team-ups, and security conversations. If you're building something in offensive security or need someone who actually reads CVEs for fun — let's talk.
Send Email →