Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
Loading
Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
From penetration testing and VAPT engagements to full-stack web development — every service is delivered manually, methodically, and with a clear written output you can act on.
Service 01
Full-cycle web application and network penetration testing — from recon and enumeration through exploitation to post-exploitation and lateral movement. Every engagement is 100% manual, not a scan-and-report. I follow structured methodology (OWASP, PTES) and deliver clear risk-rated findings that your team can actually remediate.
What's Included
Methodology
Tools Used
No automated scan dumps. Every finding is manually verified, exploited where safe, and explained clearly enough for a developer to fix it on day one.
Scope Options
Service 02
VAPT combines structured vulnerability discovery with hands-on exploitation — giving you both breadth (every vulnerability catalogued) and depth (confirmed, exploited, risk-contextualised findings). Ideal for compliance requirements, pre-launch audits, or board-level security sign-off.
What's Included
Tools Used
VAPT is what you need when you want both the complete catalogue of vulnerabilities AND confirmed exploitation evidence — required for most compliance frameworks.
Best For
Service 03
Full-stack web development in PHP, MySQL, and JavaScript — with security baked in from line one, not bolted on at the end. I build clean, performant, responsive applications: from portfolio sites and business landing pages to internal management systems and custom tools.
What's Included
Recent Builds
Stack
Most developers secure their code as an afterthought. Because I test applications for a living, security is part of the architecture from the first commit.
Project Types
Service 04
Active on HackTheBox and TryHackMe — working through machines and challenges across web exploitation, privilege escalation, binary exploitation, reverse engineering, cryptography, and digital forensics. I publish detailed writeups that document the methodology, not just the answer.
What I Cover
Tools
CTF platforms are where offensive security skills are stress-tested outside of client engagements. Regular practice keeps techniques sharp and current.
From My Writeups
Service 06
Network-layer attack simulation, traffic analysis, and firewall auditing — finding open ports, weak protocols, misconfigured services, and unpatched devices before an attacker does. Backed by hands-on enterprise network management experience across multiple large organisations.
What's Included
Tools
Having managed enterprise networks at Commercial Bank, MAS Intimates, and Timex Garments, I know how quickly misconfigurations appear — and exactly where to look for them.
Common Findings
Service 07
A security finding is only valuable if the right person understands it and acts on it. Every report I produce is written in two layers: a technical section with full PoC evidence and step-by-step remediation, and an executive summary that clearly communicates risk to non-technical decision makers — no jargon, no padding.
Report Structure
Delivered In
The best penetration test report is useless if nobody reads it. Every report is structured so developers know exactly what to fix, and management knows exactly what to prioritise.
Report Standards
Why Work With Me
No engagement is just a scan-and-report. Every finding is manually verified and exploited where possible — because automated tools miss what skilled humans find.
I manage enterprise infrastructure by day and break into systems by night. That dual perspective means I understand the defender's constraints as well as the attacker's opportunities.
Reports are written for two audiences — technical teams who need to fix things, and executives who need to understand risk. No jargon dump, no filler.
Critical and high findings are re-tested after remediation at no additional cost. You get a re-test certificate confirming the issues are closed.
Every engagement runs within explicit written scope and rules of engagement. Security work without proper authorisation isn't security work — it's a crime.
Remediation guidance is specific and actionable — not "patch your software." You get exact config changes, code fixes, or process improvements for each finding.
Pricing
For small web apps, solo projects, or developers who want a security review before launch.
Comprehensive assessment for SMEs, pre-launch sign-off, or compliance requirements.
End-to-end offensive engagement including social engineering, network, and web — for organisations that want the complete picture.
Let's Get Started
Drop me a message to discuss scope, timeline, and pricing. All engagements start with a free scoping call — no commitment required.
Service 05
Social
Engineering
The weakest link in most organisations isn't the firewall — it's the people behind it. Social engineering engagements simulate real-world human-layer attacks: phishing campaigns, pretexting scenarios, and OSINT-driven reconnaissance to expose exactly how much damage a well-crafted lure can do.
What's Included
Tools
attack surface.
Technical controls stop technical attacks. Social engineering bypasses all of that. The only defence is knowing exactly how exposed your people are — before a real attacker finds out.
Important Note