Security Consultant | OSCP | Crest | AI/ML

I believe in a proactive, curiosity-driven approach to cybersecurity: identifying weaknesses before adversaries do, building secure systems, and continuously learning in a rapidly evolving field.

• 🔍 Skilled Penetration Tester: Specializing in Web Application, Mobile Application, API , AI/ML, SCR, and Network Security.
• 🛡️ Security Professional: Focused on ethical hacking, vulnerability assessment, and helping organizations strengthen their defenses.
• 💻 Lifelong Learner: OSCP certified with a commitment to staying ahead of emerging threats through hands-on practice and certifications like Crest CRT.
• 🧠 Experience: Over 7 years in cybersecurity, delivering high-quality security assessments and contributing to safer digital environments.

• Reported critical vulnerabilities to organizations like Google, Apple, Facebook, Microsoft, and Asus etc.
• Holder of OSCP (Offensive Security Certified Professional), Crest CRT , eWAPTxV2 , eJPT and Secops AI/ML certifications.
• Discovered and reported CVE impacting widely-used iOS Edge browser.

• Web Application Penetration Testing
• API Penetration Testing
• Mobile Application Penetration Testing
• Thick Client Penetration Testing
• AI/ML Penetration Testing
• Secure Code Review
• Wifi Penetration Testing
• Network Penetration Testing
• Cloud Security (AWS / Azure)
• Report Writing & Remediation Guidance

• Building custom scripts for automated recon, vulnerability discovery, and pentest workflow optimization.
• Interested in collaborating on ethical hacking tools, internal security tooling, and CTF-style challenges.

All tools shared are for educational and authorized use only — always obtain permission before testing.

Highlights from hands-on security assessments (sanitized and anonymized):

• 🔓 Authentication & Authorization Flaws: Identified broken access controls enabling privilege escalation to administrative roles.
• 🧪 Business Logic Vulnerabilities: Discovered logic flaws bypassing payment, subscription, or workflow restrictions.
• 🌐 Critical Web Vulnerabilities: Found SQL injection, stored XSS, and insecure deserialization with real exploitation paths.
• 📱 Mobile Application Weaknesses: Identified insecure local storage, improper certificate validation, and API abuse issues.
• 🖧 Network Misconfigurations: Exposed services, weak segmentation, and credential reuse enabling lateral movement.

🧠 Interview talking point: Many high-risk findings were uncovered through manual testing and threat modeling, not automated tools.

Context
During a web application security assessment, several issues were initially classified as low to medium risk when viewed independently.

Findings Chained

• An IDOR vulnerability exposing internal object references
• Weak authorization checks on a secondary API endpoint
• Predictable session handling logic

Impact
By chaining these flaws, it was possible to escalate from a standard user account to full account takeover of high-privilege users, including access to sensitive business data.

Why This Mattered

• None of the issues were flagged as critical by automated scanners
• Risk only became visible through manual analysis and attacker-style thinking
• The exploit path directly reflected realistic abuse scenarios

🧠 Key takeaway: Security risk is cumulative — individually minor issues can combine into critical compromises.

• Actively working on practical pentesting write-ups focused on exploitation chains and remediation strategies.
• Strong interest in sharing real-world lessons learned from offensive security engagements.

(Links to blog posts, Medium articles, or conference talks can be added here.)

• 🔗 LinkedIn: https://www.linkedin.com/in/shankr6/
• 🐙 GitHub: (Manif3stVoid)
• 📧 Email: (shankr.r1337@gmail.com)

Open to:

• 🔭 Collaborations on security projects
• 🌱 Discussions on OSCP prep, pentesting techniques, and career growth
• 💬 Questions around real-world security assessments

I once chained three “low-risk” vulnerabilities to achieve full account takeover — a reminder that context beats severity scores every time.

All content and shared tools are released under the MIT License unless otherwise specified. Contributions are welcome — fork, improve, and submit pull requests!

Thanks for stopping by — and remember: attackers only need one weakness. 🛡️