Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
Contact Info
-
Colombo, Sri Lanka
Cybersecurity undergraduate and web developer based in Sri Lanka, passionate about penetration testing, VAPT, and ethical hacking.
From penetration testing and VAPT engagements to full-stack web development — every service is delivered manually, methodically, and with a clear written output you can act on.
Service 01
Full-cycle web application and network penetration testing — from recon and enumeration through exploitation to post-exploitation and lateral movement. Every engagement is 100% manual, not a scan-and-report. I follow structured methodology (OWASP, PTES) and deliver clear risk-rated findings that your team can actually remediate. Every engagement also includes a full vulnerability assessment — automated scanning as a baseline, then manual verification — so you get both breadth and depth.
What's Included
Methodology
What You Receive
Tools Used
No automated scan dumps. Every finding is manually verified, exploited where safe, and explained clearly enough for a developer to fix it on day one.
Scope Options
Best For
Service 02
Full-stack web development in PHP, MySQL, and JavaScript — with security baked in from line one, not bolted on at the end. I build clean, performant, responsive applications: from portfolio sites and business landing pages to internal management systems and custom tools.
What's Included
Recent Builds
Stack
Most developers secure their code as an afterthought. Because I test applications for a living, security is part of the architecture from the first commit.
Project Types
Service 03
Network-layer attack simulation, traffic analysis, and firewall auditing — finding open ports, weak protocols, misconfigured services, and unpatched devices before an attacker does. Backed by hands-on enterprise network management experience across multiple large organisations.
What's Included
Tools
Having managed enterprise networks at Commercial Bank, MAS Intimates, and Timex Garments, I know how quickly misconfigurations appear — and exactly where to look for them.
Common Findings
Why Work With Me
No engagement is just a scan-and-report. Every finding is manually verified and exploited where possible — because automated tools miss what skilled humans find.
I manage enterprise infrastructure by day and break into systems by night. That dual perspective means I understand the defender's constraints as well as the attacker's opportunities.
Reports are written for two audiences — technical teams who need to fix things, and executives who need to understand risk. No jargon dump, no filler.
Critical and high findings are re-tested after remediation at no additional cost. You get a re-test certificate confirming the issues are closed.
Every engagement runs within explicit written scope and rules of engagement. Security work without proper authorisation isn't security work — it's a crime.
Remediation guidance is specific and actionable — not "patch your software." You get exact config changes, code fixes, or process improvements for each finding.
Pricing
For small web apps, solo projects, or developers who want a security review before launch.
Comprehensive assessment for SMEs, pre-launch sign-off, or compliance requirements.
End-to-end offensive engagement including social engineering, network, and web — for organisations that want the complete picture.
Let's Get Started
Drop me a message to discuss scope, timeline, and pricing. All engagements start with a free scoping call — no commitment required.
Service 04
Social Engineering
& OSINT
The weakest link in most organisations isn't the firewall — it's the people behind it. Social engineering engagements simulate real-world human-layer attacks: phishing campaigns, pretexting scenarios, and OSINT-driven reconnaissance to expose exactly how much damage a well-crafted lure can do.
What's Included
Tools
attack surface.
Technical controls stop technical attacks. Social engineering bypasses all of that. The only defence is knowing exactly how exposed your people are — before a real attacker finds out.
Important Note