Offensive security practitioner focused on web application security, vulnerability research, bug bounty hunting, WAF bypass techniques, and emerging threats in LLM security. Final-year B.Tech CSE student at GM University with responsible disclosures to NASA, WHO, LG, and others.
// selected projects
Open-source tools built for the bug bounty and offensive security community.
Detects and fingerprints Web Application Firewalls using multiple evasion and identification techniques. Designed to assist penetration testers in scoping engagements and planning bypass strategies.
Python-based tool for detecting Header-Based SQL Injection vulnerabilities efficiently. Helps ethical hackers and bug bounty hunters identify SQLi in HTTP request headers.
Browser extension that automatically detects whether a website is vulnerable to clickjacking by testing for iframe embedding and missing frame-busting headers.
// recognition & disclosure
Verified security contributions through responsible vulnerability disclosure to global organisations.
Organisations I've contributed to securing
// technical expertise
Areas of active practice — based on real project work and disclosed vulnerabilities.
Comprehensive security testing of web applications, including authentication flaws, injection attacks, access control issues, and business logic vulnerabilities.
Systematic identification and responsible disclosure of security vulnerabilities to organisations. Experience with government, enterprise, and public-sector targets.
Advanced open-source intelligence gathering techniques for attack surface mapping, subdomain enumeration, and passive reconnaissance prior to engagement.
Structured penetration testing methodology including scoping, exploitation, post-exploitation, and professional reporting for web and application targets.
Exploring security testing of Large Language Models and AI systems, including prompt injection, jailbreaking, data leakage, and model misuse scenarios.
Building purpose-built security tools in Python for bug bounty automation, vulnerability scanning, and WAF detection — including HBSQLI Tool and WhatWAF.
// published research
Cybersecurity writeups and vulnerability research published on Medium.
A case study on discovering and responsibly disclosing a time-based SQL injection vulnerability in a Karnataka state government university website (VTU), including the methodology and disclosure process.
Read on MediumA detailed account of how I bypassed a Mod_Security WAF using sqlmap tamper scripts — covering detection, script selection, and successful exploitation.
Read on MediumA deep dive into bypassing key authentication mechanisms through logic flaws and misconfigurations.
View Medium Profile// about me
I'm Nithin — a final-year B.Tech Computer Science and Engineering student at GM University, and a practicing ethical hacker focused on offensive security. My primary areas of work are web application security, vulnerability research, and bug bounty hunting.
Over the course of my studies I have identified and responsibly disclosed security vulnerabilities to organisations including NASA, VTU, WHO, LG Electronics, ISRO, and UIDAI. I work within strict ethical and legal frameworks and believe in transparent communication with security teams throughout the disclosure process.
My current research interest is in LLM Security — exploring how Large Language Models can be tested, stressed, and hardened against adversarial inputs and misuse. I'm also continuing to develop open-source tools for the bug bounty community.
I write about my findings and methodology on Medium, covering topics like SQL injection, WAF bypass techniques, and broader web security research.
// get in touch
Interested in working together, discussing a vulnerability, or just want to connect? Reach out via email or any of the links below.
