Offensive Security Researcher
Prakhar.
Breaking to build safer.
Vulnerability researcher focused on web application security. Reported 100+ valid vulnerabilities across Fortune 500 companies and government organisations through responsible disclosure.
100+Valid Vulnerabilities
Disclosed
Disclosed
10+CVEs Authored
(2025)
(2025)
#100India — HackerOne
Leaderboard 2025
Leaderboard 2025
Top 5%Globally on
TryHackMe
TryHackMe
01 // Track Record
Hall of Fame
Google
Privilege Escalation
United Nations
PII Leak — 1M+ Records
US Dept. of Defence
PII Leak & Account Takeovers
NASA
Multiple Account Takeovers
Netherlands Gov.
Internal Server Access (SSRF)
Starbucks
Information Disclosure
LeetCode
Business Logic Exploitation
Groww
Information Disclosure
City of Los Angeles
Access Controls & PII
Mars
PII Exposures
Stanford University
Account Takeovers
MTN
LFI & Info Exposure
Kaseya
Account Takeover
Sony
Remote Code Execution
Informatica
Critical PII Exposure
Hilton
Code Injection
British Airways
Information Disclosure
Supabase
Security Misconfiguration
Discourse
Security Misconfiguration
& more programs
CLASSIFIED
02 // Experience
Work Experience
Security ResearcherJun 2024 – Present
HackerOne (Independent)
- Discovered and responsibly disclosed 100+ valid vulnerabilities across Fortune 500 and government organisations — Google, Sony, Starbucks, Discourse, British Airways, Informatica, United Nations, Supabase, US Dept. of Defence, and more.
- Identified high-impact vulnerabilities including RCE, IDOR, Auth Bypass, Privilege Escalation, SSRF, and PII Exposure (1M+ users).
- Authored 10+ CVEs affecting widely deployed open-source software including Gitea, Frappe, Chamilo, and SuiteCRM.
- Ranked Top 100 security researchers in India (2025) on HackerOne.
- Produced structured vulnerability reports covering CVSS scoring, MITRE ATT&CK mapping, business impact analysis, and step-by-step remediation.
Open Source ContributorJan 2026 – Present
OWASP Foundation — Project Cornucopia
- Designed and shipped a Swagger API (/api/docs) endpoint for WebApp and MobileApp editions.
- Resolved SSR failures and navigation inconsistencies across web and mobile editions.
- Implemented CRE API for companion Edition released in v3.1.0
- Strengthened data integrity through schema-level input validation. Resolved Docker build and CI/CD pipeline failures; contributor across 6 releases including v3.1.0.
03 // Projects
Projects
GitHub ↗
Tornet
TOR Network Enumeration Platform — catalogued 1,200+ hidden services, extracted metadata including uptime patterns, service fingerprints, and exposure indicators.
GitHub ↗
Approach
Automated Recon & Triage Pipeline — integrates subdomain enumeration, passive OSINT, AI-driven vulnerability triage. Reduces manual recon time by ~70%.
GitHub ↗
Sentryd
Detects malicious-by-design packages — typosquats, dependency confusion, credential-harvesting install hooks. LLM tier activates on flagged slices.
GitHub ↗
Xpose
Deanonymization simulation platform for tracing operators behind illegal dark web sites. Combines OSINT with web app and CLI interface.
04 // Capabilities
Skills & Tools
Offensive Security
Tools
Programming & Scripting
Frameworks & Standards
Cloud & Infrastructure
05 // Research
CVEs Authored
06 // Testimonials
What Programs Say
"Clear, well-documented report with a clean PoC, professional communication throughout, and a diligent retest to confirm the fix. A pleasure to work with."
"Professional, high quality, and well written reports from Prakhar0x01. Thank you for your time and dedication. Anytime I come across one from Prakhar0x01 I already know it's going to be a good report."
"Thank you Prakhar for reporting issues on our platform and making our business systems safer. Keep up the good work."
"This hacker's reports are very well written. The steps to reproduce are always clear and easy to follow. Additionally, this hacker maintains a professional and friendly behaviour in all communications."
07 // Writing
Write-ups & Blogs
Security Write-ups
6
write-up
Exploiting YouTube’s Permission Model : A Privilege Escalation case
Aug 11, 2025
My experience of discovering and reporting a Privilege Escalation case in YouTube Studio (sub-un...
write-up
Account Takeovers & more : Hacking NASA
Jul 25, 2024
My experience of finding multiple security vulnerabilities in the NASA Systems. In this blog post...
write-up
The tale of IDOR's : Hacking US Dept. Of Defence
Jul 19, 2024
My experience of finding multiple IDOR's vulnerabilities in the US Army Systems sub-unit of US De...
Mindset & Philosophy
6
mindset
Psychology of Motivation
Mar 10, 2024
Motivation drives our actions and decisions in various ways. From societal expectations to person...
mindset
Philosophy of Reality
Feb 01, 2024
Reality is a multifaceted concept which is more than just what we see or experience. It consists ...
mindset
Philosophy of Oppenheimer
Dec 30, 2023
Explore the philosophical insights of J. Robert Oppenheimer, focusing on his study of the Bhagava...
08 // Links