Hi, I'm
Tamilarasu M
Cybersecurity undergraduate with hands-on experience in penetration testing, offensive security tool development, and CTF competitions. Completed a real-world VAPT internship and holds a Certified Red Team Analyst (CRTA) certification.
[+] Specialization: Pentesting & Offensive Dev
[+] Clearance: CRTA CERTIFIED
[+] Education: B.E. CSE (Cyber Security) | CGPA 8.3
Projects
DNSWatch — Embedded Threat Detection
Standalone hardware security device built on Raspberry Pi Zero 2W & ESP32-S3 featuring 4-layer real-time detection: Shannon entropy calculation, subdomain anomaly heuristics, NXDOMAIN spike detection, and blocklist matching. Integrates Blynk IoT dashboard, email alerting, NeoPixel RGB status, and local SD card forensic logging.
Specter Network Scanner
Asynchronous multithreaded network recon and vulnerability scanner written in Python. Performs rapid port scanning, banner grabbing, OS fingerprinting, and automatic vulnerability mapping via Exploit-DB. Features interactive HTML reporting, Docker support, pytest CI/CD pipeline, and Google Colab cloud demo.
Kali NetHunter — Wireless Research Setup
Configured Kali NetHunter on Xiaomi Redmi Note 8 (A16) with custom kernel patch enabling internal Wi-Fi monitor mode and packet injection. Successfully executed and validated WPA/WPA2 handshake capture, PMKID capture workflows, and deauth testing using Stryker OSS, aircrack-ng, wifite2, and hcxdumptool.
ExFilTrap — DNS Exfiltration Detection
Stateful detection and automated mitigation framework for covert DNS tunnelling and low-and-slow data exfiltration. Pairs a per-query Random Forest classifier (label entropy, domain length, subdomain count, query frequency, n-gram deviation, digit ratio) with a session layer that accumulates entropy-weighted byte mass per source over a two-hour sliding window and tests it against a self-learning EWMA–Welford baseline with a sequential z-test. Adds beacon-regularity detection, Base32/Base64/Hex payload decoding with file-signature confirmation, a LOW/MEDIUM/HIGH/CONFIRMED risk engine, and policy-gated firewall mitigation with allowlists, TTL auto-unban and canary tripwires.
Vulnerability Research
Security flaws I have identified and reported through coordinated vulnerability disclosure programmes and bug bounty platforms. Organisations, assets, and reproduction details are deliberately omitted to respect disclosure agreements and programme confidentiality policies.
Hard-Coded Cryptographic Key → Account Takeover
CriticalA desktop client wrote every OS-keychain secret byte-identically into plaintext profile files and authenticated logins with a static envelope key. A copied profile directory was therefore enough to mint a permanent remote login credential and decrypt the local message store offline — no password, no keychain, no code execution.
Broken Object-Level Authorisation
CriticalA customer intake endpoint accepted caller-supplied identifiers without validating ownership. Any self-verified email could file records against other customers, read their stored addresses, and block their existing requests — a cross-tenant PII and fraud primitive at scale.
Shared-State Race in VM Instruction Dispatch
CriticalA globally shared, lazily populated instruction table let a lagging-snapshot thread demote the live handler for a state-destroying opcode, so identical transactions produced different results on different nodes during fork-activation windows — a consensus-split primitive.
Integer Truncation in On-Chain Market Math
HighA BigInteger-to-long narrowing conversion inside a high-precision market pricing routine silently discarded the high-order bits, allowing token amounts to be manufactured out of rounding residue during order execution.
Client-Controlled Trust Flag Bypass
HighA server trusted a client-supplied eligibility flag instead of deriving it server-side, letting a caller skip a mandatory investor-knowledge assessment that gated purchase of a regulated financial product.
Auth Bypass via Spoofable Forwarding Header
HighA payment service accepted a forged loopback address in a client-controlled forwarding header, satisfying an internal-only trust check and bypassing the authentication service in front of it.
Missing Authentication on a Media Endpoint
HighA media API reachable through a public access code accepted unauthenticated uploads, allowing anyone holding the code to inject audio and imagery onto a connected device's display.
CSRF on Unauthenticated Node APIs
MediumState-changing endpoints of a node's local HTTP API accepted any origin and any content type, letting an ordinary web page silently force a running node to broadcast attacker-chosen transactions and burn its cryptographic proving capacity.
Responsible disclosure. Every finding listed here was discovered during authorised testing within the scope of a published disclosure or bug bounty programme. Reports are submitted privately to the affected vendor first, and technical detail is withheld until triage and remediation are complete. No organisation names, hosts, endpoints, or step-by-step reproduction details are published on this page.
Certifications & Badges
CRTA
CyberWarFare Labs — Certified Red Team Analyst
Networks & Network Security
Google — TCP/IP, Routing, Firewalls & Architecture
Certified Fundamentals
Fortinet — Threat Landscape & Security Operations
Kali for Penetration Testers
EC-Council Continuing Education — 7-hour practical course completion
GenAI Study Jam
Google Developer Student Clubs — Vertex AI, Gemini, GenAI Apps & Streamlit on Google Cloud
Conferences & CTF
Seasides Information Security Conference
Goa, India • 3-Day Deep Dive into Real-World Security
Session Breakdown:
- Day 1 — AI & Bug Bounty: How AI is actually used in bug bounty today, from automating reconnaissance to building and attacking AI agents and MCP servers — and where manual thinking still matters most.
- Day 2 — SOC Training (Entry Level): A clear picture of how a Security Operations Centre functions day to day: alert analysis, incident flow, tooling, and what is realistically expected from someone starting out in a SOC role.
- Day 3 — Red Teaming: Hands-on insight into red teaming approaches, especially breaking into Active Directory environments, understanding attack paths, and thinking like an adversary instead of just running tools.
- CTF & Quizzes: Actively competed in the on-site capture-the-flag challenges and quizzes, reinforcing practical problem-solving under time pressure — and took home HackerOne merchandise twice.
- Industry Networking: Practical questions and honest guidance from professionals and teams from HackerOne, Bugcrowd, SecureLayer7, Blooom, ArmorCode Inc., Fortive and Payatu.
DCG Coimbatore Cybersecurity Conference 2026
DCG91422 • Kumaraguru College of Technology, Coimbatore
Participation & Takeaways:
- Attended a full-day regional security conference covering the latest trends across offensive security and defensive practice.
- Awarded a Certificate of Participation by the DCG Coimbatore team for active participation in the chapter meetup.
- Collaborated with like-minded practitioners and researchers, and explored current directions in the regional cybersecurity community.
DCG91422 Capture The Flag
Team OxGore • Kumaraguru College of Technology, Coimbatore
Result & Challenges:
- Competed as team OxGore and finished 27th out of 500+ teams with 1,314 points.
- Solved challenges spanning forensics, reverse engineering and web exploitation against a well-structured and genuinely challenging challenge set.
- Teammates: Aaruth V P and Sanjay V N.
Skills & Tools
Offensive Tactics & VAPT
Security Tools & Suite
Platforms & Environments
Programming & Embedded
Education & Experience
B.E. Computer Science & Engineering (Cyber Security)
KSR Institute for Engineering and Technology • Tiruchengode, Tamil Nadu
Academic Standing & Focus:
CGPA: 8.3 / 10.0 • Specialized in offensive security, penetration testing, network cryptology, and hardware security engineering.
- Core Focus: Web Application Security, Network Protocols, Malware Reversing, Penetration Testing Tactics, and Systems Hardening.
- Active technical contributor and security researcher at student cyber defense chapters.
Vulnerability Assessment & Penetration Testing Intern
Pargavan Cyyber Solutions • Salem, Tamil Nadu
Key Contributions & Scope:
- Conducted vulnerability assessments and penetration tests across production web applications; identified critical vulnerabilities including Remote Code Execution (RCE), arbitrary file upload bypasses, and clickjacking.
- Performed comprehensive network and port enumeration using Nmap, custom scripts, and manual reconnaissance techniques.
- Mapped all discovered flaws to OWASP Top 10 vulnerabilities, calculated CVSS v3.1 severity scores, and authored comprehensive remediation reports for development teams.
Contact
Available for penetration testing engagements, red team threat simulations, security research, and full-time technical opportunities. Get in touch via secure uplink or phone.