“Breaking things to make them secure.” I think like an attacker so your systems don't have to find out the hard way.
$ I work with a break-to-fix mindset, approaching security the way an attacker would so systems get hardened before anyone else finds the gaps. My focus is offensive security: web and application penetration testing, network exploitation, and vulnerability research, with 100+ engagements behind me across professional roles, internships and independent projects. The part that matters is what comes after, turning findings into remediation a team can actually act on. I keep sharpening through CTFs, labs, and hands-on work.
I gravitate toward offensive security. There is a real thrill in probing an application, chaining small misconfigurations into something with actual impact, then writing it up so a team can close it for good. Every engagement, CTF, and lab is another rep at sharpening that instinct.
GIFT City, Gandhinagar · Rajkot, Gujarat, India
English · Hindi · Gujarati
De Montfort University, Cyber Technology Institute · Leicester, UK
Currently reading for the MSc. Deepening the offensive skill set with advanced security research, digital forensics and enterprise-scale defence, from the UK.
Tooling and tradecraft logged from live engagements. Pick a category to filter the records.
Map the attack surface first. OSINT, subdomain enumeration, fingerprinting, and asset discovery, all before a single payload is fired.
Hunt OWASP Top 10 and past it. SQLi, XSS, SSRF, auth flaws, business logic, then chain them into real, demonstrable impact.
Scan, enumerate, and pivot. Service exploitation, misconfig abuse, and lateral movement across internal infrastructure.
From foothold to root. Local enumeration, kernel and misconfiguration abuse, and credential harvesting to own the host.
Translate findings into clear, prioritized, business-aware reports with reproducible PoCs and fixes a team can act on.
Selected operations, documented like evidence: the challenge, the approach, the outcome.
Multi-agent automation system for end-to-end VAPT execution
An intelligent orchestrator-driven system that automates full penetration tests from reconnaissance through reporting. Coordinates parallel specialist AI agents through a gated wave pipeline with real-time evidence tracking, quality gates, and CVSS-scored findings generation.
Building reliable autonomous agents that self-verify coverage, maintain accuracy across parallel execution, and catch under-tested attack surfaces before report generation.
A working pipeline that runs recon-to-report unattended, self-checks its own coverage through quality gates, and outputs CVSS-scored, evidence-backed findings. The same orchestration approach placed 9th with a full 37/37 clear at Hack The Box's MCP TryOut.
One-command external recon, from subdomains to secrets
A bash pipeline that takes one target and runs full external recon: subdomain enumeration, live-host probing, port scanning, endpoint discovery, and JS/secret hunting. It has passive, standard, and full scan modes.
Chaining a dozen+ third-party recon tools into one reliable pipeline that degrades gracefully when a tool is missing, and keeping results scoped to the real target.
One command turns a bare domain into a structured findings directory containing subdomains, live hosts, open ports, endpoints, and flagged secrets, ready for manual triage.
Edge-deployed biometric attendance on Raspberry Pi
A real-time face-recognition attendance platform running on Raspberry Pi. Captures faces via camera, matches against an enrolled dataset, and logs attendance to a web dashboard built with Flask.
Achieving reliable recognition on constrained edge hardware, handling varying lighting conditions, and keeping latency low enough for live capture.
Delivered an end-to-end working system with a web interface for enrollment, live recognition, and exportable attendance records.
Interactive playground for classical & modern crypto
A Flask web app that teaches cryptography hands-on, with interactive cipher tools, encrypt/decrypt demos, and plain explanations of the core concepts for learners and security students.
Designing intuitive interactive tooling for complex cryptographic concepts while keeping the implementation correct and educational.
Built a usable learning platform that demystifies ciphers and crypto fundamentals through interactive, in-browser demonstrations.
_ further case files pending declassification
Verified and current. Earned the practical way, not the multiple-choice way.
EC-Council
credential heldThe SecOps Group
credential heldGoogle / Coursera
credential heldMultiple Platforms
credential heldLeaderboards, disclosures, and independent engagements worth putting on the record.
100+ web and application penetration tests to date, spanning professional roles, internships and independent projects. OWASP Top 10 issues and business logic flaws, each mapped to a prioritized remediation path.
Built an agent orchestrator that captured every flag in HTB's AI-agent CTF. A full 37/37 clear, placing 9th on the global scoreboard (Apr 2026).
Placed 3rd in EC-Council's global Capture The Flag competition against international competitors.
Active in vulnerability research and responsible disclosure across public programs (HackerOne).
Independent penetration testing and security consulting for small businesses and indie products.
Direct line, no gatekeepers. Messages land straight in my inbox.