About
I'm a 2025 B.E. Information Technology graduate from Sinhgad Institute of Technology & Science (SPPU), Pune, with Honours in Cybersecurity. I hold Certified Ethical Hacker (CEH) Practical.
I want to work in a SOC, on a penetration testing team or in AI security. Each project below starts from a problem an analyst or tester actually has. Most have tests, and their READMEs say what they missed. I placed 13th in the CloudSEK CTF (Aug 2025) and wrote up how I solved it.
- SOC and detection: Wazuh, Suricata, Splunk SPL, Sigma and pySigma, KQL basics, Windows event logs (EVTX, Sysmon), Linux auth logs, MITRE ATT&CK mapping, phishing header analysis (SPF, DKIM, DMARC), IOC enrichment
- VAPT and AppSec: OWASP Top 10 and API Top 10, Burp Suite, IDOR, SSRF, JWT issues, TLS and header review, Nmap, Active Directory attacks, Linux and Windows privilege escalation
- AI security: Indirect prompt injection, OWASP Top 10 for LLM apps, output guards, PII redaction, MCP server review, local models with Ollama
- Tooling: Python, Bash, JavaScript, pytest, schemathesis, Docker, GitHub Actions
Projects
SOC & detection
siem-lab
Wazuh and Suricata in Docker with custom rules mapped to MITRE ATT&CK, replayed against public EVTX attack samples and a generated pcap. No custom rule fired at first; after I fixed the decoder routing, every rule with a test event fired. 24 pytest checks pass.
- Wazuh
- Suricata
- Docker
- pytest
detection-rules-as-code
10 Sigma rules, each with true- and false-positive sample events, a linter and a CI gate. All 10 convert to Splunk SPL. A deliberate bad edit to one rule turned CI red.
- Sigma
- pySigma
- Splunk SPL
- GitHub Actions
soc-honeypot-lab
Honeypot log lab with Sentinel-style detections written as KQL, Sigma and Python that run locally, scored against labelled synthetic events. The README documents the misses and the blind spots.
- Python
- KQL
- Sigma
- pytest
phishdesk-in
Explains why an .eml looks like phishing: header authentication checks plus Indian bank and UPI lure rules, tested on 69 synthetic lab emails.
- Python
- stdlib email
VAPT & AppSec
webvuln-scanner
CLI that checks security headers, cookie flags and TLS on sites you own and grades them. On the lab targets it gave A to a hardened site and F to a self-signed, old-TLS one.
- Python
- TLS
- HTTP
secure-shortener
URL shortener where every control maps to an OWASP Top 10 category with a named test. A live run blocked the cloud metadata URL with 400 and rate-limited brute force with 429.
- Python
- FastAPI
- SQLite
- pytest
api-qa-suite
Security and functional tests for an API with 6 seeded OWASP API Top 10 defects: 9 tests fail on the vulnerable build, all 28 pass on the fixed one.
- pytest
- schemathesis
secrets-leak-guard
gitleaks config with custom rules for Indian formats such as Razorpay keys and Aadhaar numbers, a pre-commit hook that blocked a staged token, and a history scan that found a secret a later commit deleted. 20 pytest checks pass; the corpus is hand-written, and the README says so.
- gitleaks
- Python
- pytest
AI security
rag-redteam
Indirect prompt-injection tests against a local RAG app on qwen2.5:1.5b with three defences. Spotlighting and a regex sanitiser changed nothing alone; the output guard did the work.
- Python
- Ollama
- OWASP LLM01
mcp-audit-lite
Static scanner for MCP server manifests and source: tool poisoning, hardcoded secrets, shell=True and risky permissions. It flags all 5 vulnerable samples and stays quiet on the 2 clean ones.
- Python
- pytest
indicguard
Prompt-injection detection for Hindi, Hinglish and Marathi input. An English-only regex caught none of the Hindi or Marathi attacks; IndicGuard reached F1 0.824 on a held-out set.
- Python
llm-redactor
FastAPI middleware that redacts PII and secrets, including PAN, UPI and IFSC, from LLM output. The evaluation caught a card-number regex bug, which I fixed.
- Python
- FastAPI
Experience
CTF Player and Security Researcher · Hack The Box and TryHackMe
Root Linux and Windows machines on Hack The Box and TryHackMe, including Active Directory attacks and privilege escalation, and write step-by-step reports. Placed 13th in the CloudSEK CTF (Aug 2025); read the writeup.
- Active Directory
- Privilege escalation
- Nmap
- Burp Suite
ServiceNow System Administrator, Virtual Intern · AICTE program
Built ITSM reports and dashboards from incident and problem records, and completed labs on incident and problem management, the work an L1 desk does every shift.
- ServiceNow
- Incident management
Certifications
Certified Ethical Hacker (CEH) Practical
EC-Council · Credential ID ECC9356741028
arcX Foundation Threat Intelligence Analyst
arcX
Certified AppSec Practitioner (CAP)
The SecOps Group · Credential ID 8481909
Microsoft Azure Fundamentals (AZ-900)
Microsoft