Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
Contact Info
-
Colombo, Sri Lanka
Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
HackTheBox and TryHackMe walkthroughs, VAPT case studies, OSINT research and the tools I build along the way.
Bash/Python automation that scans the local network, identifies active hosts, pulls MAC addresses and hostnames, and logs results to a CSV for IT audit.
Read post
Internal inventory tracking system built for Timex Garments. Role-based access control, stock management, PDF report generation, and audit logs.
Read post
Internal network vulnerability assessment — open ports, weak protocols, unpatched services and misconfigured firewall rules identified and documented.
Read post
Simulated phishing engagement using the Social Engineering Toolkit. Crafted pretexting scenario, credential harvesting page, and awareness gap report for the client.
Read postFull web application vulnerability assessment. Identified SQL Injection, XSS, IDOR and broken authentication. CVSS-rated report with PoC and remediation steps.
Read postFull OSINT reconnaissance on a consenting test target — email enumeration, social media mapping, domain/WHOIS analysis, and breach data correlation.
Read postFull company website for Dreamway Education — responsive design, PHP backend, contact form with mail integration, and SEO-optimised pages.
Read post
Built a full AD environment in VirtualBox — domain controller, workstations, and file server. Simulated Kerberoasting, Pass-the-Hash and BloodHound enumeration.
Read post
Elastix / FreePBX server with multiple attack vectors. Exploited Local File Inclusion to grab credentials, then escalated to root via sudo misconfiguration.
Read postToolkit of Python scripts for common CTF crypto challenges — Caesar, Vigenère, Base64 chaining, XOR bruteforce, and RSA weak key exploitation.
Read postEternalBlue (MS17-010) exploitation on a Windows target. Manual exploit without Metasploit — using Impacket and custom Python scripts.
Read postClassic Easy Linux box. Exploited a vulnerable Samba service to gain direct root access. Full walkthrough covering enumeration, exploitation and post-exploitation.
Read postPython script that wraps Nmap for automated recon — service version detection, OS fingerprinting, and outputs a formatted HTML/JSON report.
Read post
Mr Robot themed room — three hidden flags using WordPress exploitation, dictionary attack and SUID binary privilege escalation.
Read postMulti-day Capture The Flag — 24 challenges spanning web exploitation, OSINT, digital forensics, reverse engineering, and cryptography.
Read postNo posts in this category yet.
