Offensive security | Web penetration testing

Testing like an attacker.
Reporting like an engineer.

I am Garvit, a cybersecurity enthusiast with an academic background in computer applications, an ethical hacker specializing in web penetration testing, and a VAPT intern, finding, proving and reporting vulnerabilities. More to come.

View my findings Let’s connect

Ethical HackerBug HunterPenetration TesterSecurity Researcher

About

A little about me.

I play with systems to understand how they work.

I started in cybersecurity at 17 and have spent the past year on structured offensive training, labs and live bug hunting. I am studying computer applications and working as a VAPT intern.

I am not much of a lab guy. I would rather play with real systems — you learn the most from poking at things that were never built for you to poke at. I have loved tech since I was a kid; computers always fascinated me, and now cybersecurity does.

My current focus is on web application security: finding real flaws, demonstrating their impact and writing reports developers can act on. I am working to level up my skills, with eJPT and OSCP as the next targets.

1+ yearsIn offensive security

2Vulnerability reports

6 monthsCybersecurity internship

Skills

What I work with.

Web application testing

OWASP Top 10InjectionCross-site scriptingBroken access controlAuthentication and sessionsFile upload flaws

Toolbox

Burp SuiteOWASP ZAPsqlmapffufGobusterNucleiNiktoNmapMetasploit FrameworkHydraWiresharkAnd More

System exploitation

Metasploit FrameworkmsfvenomReverse shellsAV evasionSession handling

Malware and mobile analysis

VirusTotalMobSFSandbox analysisStatic analysisDynamic analysis

Systems and scripting

LinuxWindowsKaliBashPython

Reporting

PoC write-upsResponsible disclosureRemediation advice

Experience

Where I’ve worked.

September 2026 to present

Independent bug hunting

Testing live web applications for security flaws and reporting findings through responsible disclosure.

April 2026

VAPT intern, CyberEthicX

Web application testing and vulnerability assessment, from recon through to documented findings.

Burp SuiteOWASP Top 10Reporting

February 2026

Malware analysis, Delhi Police Cyber Cell

Worked with Delhi Police Cyber Cell personnel on an active malware investigation, analyzing sample behavior, network activity and persistence mechanisms. (Informal Engagement)

WiresharkVirusTotalMobSFSandboxEmulators

December 2025

OSINT support on a cybercrime investigation

Assisted with open-source intelligence on an active case. Details are confidential. (Informal Engagement)

Selected findings

Reported, fixed, acknowledged.

High Business Impact

Unrestricted file upload

Uploads were not restricted, allowing storage exhaustion, phishing page hosting and abuse as free hosting. Reported responsibly and fixed.

A private coding community site Read the write-up

Informational

Token exposure in JavaScript bundles

Values exposed in public client-side bundles allowed forging of invite tokens. Reported with remediation advice.

Bug Bounty Target

Organization names have been redacted in accordance with the disclosure policy.

Roadmap

Leveling up.

✓

Complete

Foundations

CEH-based training, Linux and networking

In progress

Web pentesting

PortSwigger labs, live bug hunting

eJPT

Practical network penetration testing

Goal

OSCP

Advanced hands-on exploitation

Web application security for now — with more domains to explore and expand into.

Recognition

Certificates and Acknowledgments.

CEH training certificate

Global Institute of Cybersecurity and Ethical Hacking.

Letter of Appreciation

From TheAngaarBatch.

Internship certificate

CyberEthicX. For the VAPT internship.

Hall of Fame