security engineer · oscp-track
I build things, then try to break them - offensive security tooling, ML-based detection, and infrastructure-as-code, practiced on a homelab I run and defend myself.
01 · about
Cybersecurity & Digital Forensics graduate from VIT Bhopal, focused on web application security, exploit development, and system hardening. Two internships - CSI Cyber Secured India and Unified Mentor - doing vulnerability assessment and security audits against real client systems. I build offensive security tooling and ML-based detection systems from the ground up in Python, currently working toward OSCP.
Most recently, I designed and built a two-node cybersecurity homelab from bare metal: an isolated pentest range, a scaled-down detection stack, and full observability - all defined as code and reproducible from a clean install. It's documented publicly as proof of how I actually work, not just what I know.
I'd rather ship something small and honest - including the parts that aren't finished yet - than polish a demo that doesn't reflect the real state of the work. A few projects below are still mid-build; I've labeled them as such.
02 · projects
A two-machine cybersecurity homelab, entirely Ansible-managed: an isolated libvirt pentest range (Kali attack box, DVWA, Juice Shop, Metasploitable2) reachable only from inside the mesh, a scaled-down detection stack (Suricata IDS + CrowdSec + Loki/Grafana), fleet-wide observability (Prometheus, Uptime Kuma), and a public status dashboard served over a Cloudflare Tunnel. Everything reproducible from a bare Ubuntu install.
A Python framework orchestrating 24+ open-source security tools into 80+ automated checks - recon, SSL/TLS weakness detection (Heartbleed, POODLE, FREAK, LogJam), injection flaws (SQLi, XSS, RFI/LFI), and WAF fingerprinting, with severity-based report generation.
Trained and compared 5 classification algorithms - Random Forest, SVM, Decision Tree, Naive Bayes, Logistic Regression - on the KDD Cup 1999 dataset, covering DoS, Remote-to-Local, User-to-Root, and Probing attack categories.
A production-style Nextcloud/MariaDB/Redis stack on Docker Compose with zero exposed inbound ports - admin access via Tailscale, public HTTPS via Cloudflare Tunnel, version-pinned images, an isolated DB container, and automated volume-level backups.
Solutions and notes for the PortSwigger Web Security Academy, organized by vulnerability class. Every solved lab pairs a runnable exploit script with a short write-up of the underlying flaw and the reasoning that found it.
A security-analyst-in-a-box for small teams: upload auth/Apache/Nginx/firewall logs and get plain-English findings on brute-force attempts, suspicious IPs, and scanning activity. The FastAPI shell - auth, Stripe billing, gated dashboard - is built; the analysis engine is being rebuilt now. Shipping it honestly, mid-build.
A front-end concept for a community cybersecurity-incident reporting tool - an incident report form, a browsable threat database, and incident search, built in vanilla HTML/CSS as a UI exercise.
Group capstone project for my B.Tech - a deepfake-detection web application pairing a computer-vision classification backend with a web frontend for uploading and screening media.
03 · experience & education
Practicing against the isolated range in the homelab above before sitting the exam. EC-Council CEH also in progress.
Vulnerability assessment and security best practices under mentorship - applied penetration testing and network security concepts to practical assignments and case studies.
Identified and assessed security vulnerabilities across client systems and web applications; supported vulnerability scanning, security audits, and findings documentation.
Three concurrent one-month internships spanning Python development, Java development, and web development.
Vellore Institute of Technology (VIT), Bhopal.
04 · certifications & awards
05 · contact
Open to opportunities in offensive security, detection engineering, and infrastructure roles.