ETHICAL HACKER · PENETRATION TESTER
// ETHICAL HACKER & PENETRATION TESTER
01 — About
I'm an ethical hacker and penetration tester focused on web testing, enumeration, exploit validation, privilege escalation, bug bounty practice, and clear reporting — finding weaknesses, proving impact, and explaining risk in a way teams can act on.
I build practical security projects, document exploit paths, use a cloud-connected Wazuh homelab to understand defensive visibility, and I'm preparing for Hack The Box CPTS while starting structured bug bounty practice. Terminal-first, lab-driven, documentation-heavy. Open to junior penetration testing, ethical hacking, and offensive security roles. Timezone: Asia/Kolkata.
02 — Skills & Tooling
Penetration testing, ethical hacking, vulnerability assessment, enumeration, web testing, and exploit validation.
SOC triage, incident response, SIEM review, and detection thinking used to explain offensive impact.
Static triage, IOC extraction, macro deobfuscation, packet review, memory clues.
Security scripts, exploit-lab helpers, terminal-first workflows, setup automation.
03 — Pentest Methodology
My workflow is built around repeatable, legal testing: define scope, enumerate carefully, validate impact, escalate only inside the allowed target, and finish with evidence-backed remediation notes. I'm applying this to CPTS preparation, lab machines, and beginner bug bounty targets with public scope.
Clarify targets, constraints, assumptions, and what proof is acceptable before touching a system.
Map hosts, services, directories, technologies, identities, and exposed trust paths.
Turn open ports and web paths into hypotheses using Nmap, Burp Suite, Gobuster, and manual review.
Prove the issue safely with screenshots, commands, artifacts, and clear reproduction steps.
Check misconfigurations, credentials, services, SUID/sudo paths, and lateral movement opportunities.
Write findings with severity, business impact, evidence, root cause, and practical fixes.
Practice on permitted programs only, document reproduction steps, avoid user harm, and keep findings actionable.
Build toward CPTS with deeper enumeration, pivoting, Active Directory exposure, web attacks, and professional reporting.
04 — Projects
Hands-on Python security tooling — a network scanner, ARP-spoof traffic-analysis lab, remote command-execution exercise, keystroke logging exercise, and packet sniffer — written by hand through a Coursera exploit-development course.
Cybersecurity learning paths and roadmaps for building practical skills across ethical hacking, penetration testing, web security, SOC context, and security tooling.
05 — Certifications
Certifications are treated as operating vocabulary, not decoration.
Applied through attack-surface thinking, enumeration discipline, and controlled validation in lab scenarios.
Applied through practical recon, exploitation workflow, web testing, and clear post-exploitation notes.
Applied as defensive context for writing better impact, risk, and remediation language.
Currently building toward practical offensive depth.
Learning program scope, recon discipline, web vulnerability classes, proof collection, and responsible disclosure etiquette.
Working toward Hack The Box Certified Penetration Testing Specialist through deeper enumeration, exploitation, pivoting, AD basics, and report writing.
06 — Pentest Reports
Report-style notes written like junior pentest deliverables: scope, enumeration, exploitation path, proof, risk, and remediation. SOC and malware notes stay here as supporting defensive context.
07 — Homelab
Cloud-connected pentest lab — Wazuh on OCI Always Free, connected over Tailscale to Kali Linux, Fedora victim VM, and Windows 10 victim VM — used to run controlled attacks, collect endpoint evidence, review Wazuh alerts, and document what defenders would see. The goal: practice ethical hacking while understanding detection, logging, and remediation impact.
Keep the OCI Wazuh manager reachable by lab endpoints without exposing the lab broadly to the internet.
Controlled scans, web tests, and auth probes against lab victims through a private network path.
Windows and Linux agents forward logs, file changes, auth events, and host context to Wazuh in OCI.
Review alerts, identify false positives, decide what evidence is useful.
Record what fired, what was noisy, what was missed, what needs coverage.
Feed findings back into scenarios, watchlists, custom rules, and writeups.
Verify authentication alerts, compare normal endpoint noise, and document whether the signal is useful for triage.
Trace a simulated phishing path through email artifacts, endpoint signals, URL reputation, and containment actions.
Change watched paths on Windows and Linux targets, validate FIM alerting, and separate drift from noise.
Generate failed logons on the Windows 10 victim, review Event ID 4625 context, and document whether Wazuh produced useful triage evidence.
Cloud-hosted Wazuh manager reachable through Tailscale for agent enrollment, alert review, and detection tuning.
Generates controlled attacker activity and manages lab testing — scans, auth tests, web probes, and repeatable detection scenarios.
Monitored Windows target — Security event logs, failed logons, file integrity changes, process context, and user activity.
Monitored Linux target — SSH activity, service events, package changes, auth logs, and filesystem drift.
Open to junior penetration testing, ethical hacking, offensive security internships, and security tooling conversations.
Timezone: Asia/Kolkata · Best channel: LinkedIn or email.