// offensive security researcher

Prakhar.

aka prakhar0x01

Offensive security researcher with 2+ years of hands-on vulnerability research, web & API penetration testing, and responsible disclosure across Fortune 500 companies and government organisations. Reported 100+ valid vulnerabilities and authored 10+ CVEs in widely deployed software. Ranked Top 100 security researchers in India on HackerOne (2025).

HackerOne ↗ GitHub ↗ Projects Contact

Top 100 India — HackerOne 2025 Top 5% — TryHackMe 10+ CVEs — 2025 OWASP Contributor

▾ scroll

100+ Valid Vulnerabilities
Disclosed

10+ CVEs Authored
(2025)

#100 India — HackerOne
Leaderboard 2025

Top 5% Globally on
TryHackMe

01 // track_record

Hall of Fame

Google

Privilege Escalation

United Nations

PII Leak — 1M+ Records

US Dept. of Defence

PII Leak & Account Takeovers

NASA

Multiple Account Takeovers

Netherlands Gov.

Internal Server Access (SSRF)

Starbucks

Information Disclosure

LeetCode

Business Logic Exploitation

Groww

Information Disclosure

City of Los Angeles

Multiple Access Controls & PII Exposures

Mars

PII Exposures

Stanford University

Account Takeovers

MTN

LFI & Information Exposure

Kaseya

Account Takeover

Sony

Remote Code Execution (RCE)

Informatica

Critical PII Exposure

Hilton

Code Injection

British Airways

Information Disclosure

& more programs

[confidential]

02 // experience

Work Experience

Security Researcher Jun 2024 – Present

HackerOne (Independent)

Remote

Discovered and responsibly disclosed 100+ valid vulnerabilities across Fortune 500 and government organisations — Google, Sony, Starbucks, Discourse, British Airways, Informatica, United Nations, Supabase,US Dept. of Defence, and more.
Identified high-impact vulnerabilities including RCE, IDOR, Auth Bypass, Privilege Escalation, SSRF, and PII Exposure (1M+ users); each submission delivered with full PoC, reproduction steps, impact assessment, and remediation guidance.
Authored 10+ CVEs — CVE-2025-59541, CVE-2025-59542, CVE-2025-59543, CVE-2025-64489, CVE-2025-64490, CVE-2026-12895, CVE-2026-58507, CVE-2026-23603, CVE-2026-57897, CVE-2026-58437, CVE-2026-58424 — affecting widely deployed open-source software.
Ranked Top 100 security researchers in India (2025) on HackerOne.
Produced structured vulnerability reports covering CVSS scoring, MITRE ATT&CK mapping, business impact analysis, and step-by-step remediation.

Open Source Contributor Jan 2026 – Present

OWASP Foundation — Project Cornucopia

Remote · github.com/OWASP/cornucopia

Designed and shipped a Swagger API (/api/docs) endpoint for WebApp and MobileApp editions, improving API discoverability and enabling automated integration testing.
Resolved SSR failures and navigation inconsistencies across web and mobile editions through version and language routing for card pages.
Implemented CRE API for companion Edition released in v3.1.0
Strengthened data integrity through schema-level input validation, preventing database truncation errors in production. Resolved Docker build and CI/CD pipeline failures; contributor across 6 releases including v3.1.0.

03 // projects

Projects

🧅 GitHub ↗

Tornet

TOR Network Enumeration Platform — catalogued 1,200+ hidden services, extracted metadata including uptime patterns, service fingerprints, and exposure indicators. Automated crawling with threat intelligence extraction.

PythonTOROSINT Threat IntelDarkWeb

🔍 GitHub ↗

Approach

Automated Recon & Triage Pipeline — integrates subdomain enumeration, passive OSINT, AI-driven vulnerability triage, and structured report generation. Reduces manual recon time by ~70% with real-time alerting on new attack surfaces.

BashPythonAutomation ReconBug Bounty

🕵️ GitHub ↗

Sentryd

Detects malicious-by-design packages — typosquats, dependency confusion, credential-harvesting install hooks, self-propagating worms — threats with no CVE yet, missed by signature-based tools. Fast static tier always runs; LLM tier (Anthropic API) activates only on flagged slices, never executing untrusted code.

Python,KQLFalco, Sigma Security Engineering

🌐 GitHub ↗

Xpose

Deanonymization simulation platform for tracing operators behind illegal dark web sites. Combines advanced OSINT techniques with a web app and CLI interface for research-grade analysis.

PythonDarkWebOSINT Research

04 // technical_skills

Skills & Tools

Offensive Security

Web PentestingAPI Security VAPTVulnerability Research Business LogicThreat Modelling Responsible DisclosureCVSS Scoring Attack Surface Mapping

Tools

Burp Suite ProCaido NucleiFFUF NmapAmass MetasploitSQLMap FridaADB ShodanGit

Programming & Scripting

PythonBash Node.jsCSQL

Frameworks & Standards

OWASP Top 10MITRE ATT&CK NIST CSFCVE/NVD PTESCVSS v3.1

Cloud & Infrastructure

Linux (primary OS)Docker CI/CD PipelinesAWS Fundamentals API Security

05 // cve_authored

Security Research

CVE-2026-58424 Gitea — nvd.nist.gov ↗ CVE-2026-58437 Gitea — nvd.nist.gov ↗ CVE-2026-57897 Gitea — nvd.nist.gov ↗ CVE-2026-23603 Gitea — nvd.nist.gov ↗ CVE-2026-58507 Gitea — nvd.nist.gov ↗ CVE-2026-12895 Frappe — nvd.nist.gov ↗ CVE-2025-59541 Chamilo — nvd.nist.gov ↗ CVE-2025-59542 Chamilo — nvd.nist.gov ↗ CVE-2025-59543 Chamilo — nvd.nist.gov ↗ CVE-2025-64489 SuiteCRM — nvd.nist.gov ↗ CVE-2025-64490 SuiteCRM — nvd.nist.gov ↗

07 // testimonials

What Programs Say

"Clear, well-documented report with a clean PoC, professional communication throughout, and a diligent retest to confirm the fix. A pleasure to work with."

"Professional, high quality, and well written reports from Prakhar0x01. Thank you for the your time and dedication identifying and reporting vulnerabilities. Anytime I come across one from Prakhar0x01 I already know it's going to be a good report. Thank you."

"Thank you Prakhar for reporting issues on our platform and making our business systems safer. Keep up the good work."

"This hacker's reports are very well written. The steps to reproduce are always clear and easy to follow, making the triage process smoother. Additionally, this hacker maintains a professional and friendly behaviour in all communications, which is greatly appreciated."

08 // latest_posts