Manas Mahajan

Technical Arsenal

⚔️ Penetration Testing

Web Application VAPT

API Security Testing

Network Penetration

Mobile App Security

Red Teaming

Source Code Review

Active Directory Security

Digital Forensics

🛠️ Security Tools

Burp Suite Professional

Nmap / Nessus

Metasploit / Cobalt Strike

Wireshark / tcpdump

SQLmap / Nikto

OWASP ZAP / Acunetix

Hydra / John the Ripper

Nuclei / Subfinder

📚 Frameworks & Methodologies

OWASP Testing Guide

PTES / OSSTMM

NIST Cybersecurity

SANS Top 25

CIS Controls

ISO 27001

💻 Programming & Scripting

Python (Security Automation)

Bash/Shell Scripting

SQL

Web Technologies (HTML/JS)

🔐 Security Domains

OWASP Top 10

MITRE ATT&CK Framework

CVSS Scoring & Risk Analysis

Secure SDLC

Threat Hunting

Vulnerability Management

SAST/DAST

Professional Experience

May 2025 - Present

Security Analyst Intern

Bornsec Consulting LLP | Remote

• Conducting comprehensive security assessments including web application, network, and API penetration testing
• Excel in generating detailed security reports and employing black box, grey box, and white box testing methodologies
• Performing OWASP Top 10 vulnerability assessments and PTES-based penetration testing
• Identifying and documenting security vulnerabilities with CVSS scoring and remediation strategies
• Utilizing advanced testing tools including Burp Suite, Nmap, Metasploit, and custom scripts

April 2024 - October 2024

Cybersecurity Analyst Intern

CyberSRC® Consultancy | Remote

• Performed end-to-end vulnerability assessments and penetration tests on web applications, networks, and systems following OWASP and PTES methodologies
• Utilized tools such as Nessus, OpenVAS, and Metasploit to uncover security misconfigurations, CVEs, and privilege escalation vectors
• Analyzed and mitigated security threats by implementing effective remediation strategies and security controls
• Conducted comprehensive security testing across cloud and on-premise environments

April 2023 - July 2023

Cybersecurity Analyst Intern

Cyber Secured India | Remote

• Performed digital forensics to investigate and assess security incidents
• Conducted penetration testing on web applications, focusing on the OWASP Top 10 security vulnerabilities
• Compiled comprehensive security reports, collected data, and conducted research to support security evaluations
• Gained hands-on experience in incident response and security analysis

Academic Background

2021 - April 2025

Bachelor of Technology in Computer Science & Engineering (Cyber Security)

Parul University, Vadodara | CGPA: 7.40/10

Relevant Coursework:
• Web Application Security
• Network Security
• Cryptography
• Information Security Management
• Incident Response
• Ethical Hacking
• Risk Assessment

Academic Projects:
• Phishing Link Detection System: Developed a tool to identify and analyze phishing URLs based on URL features such as domain analysis, HTTPS status, URL length, and blacklist verification. Achieved 95% accuracy in detecting phishing URLs during testing by validating the tool against 1000+ URLs sourced from both legitimate and phishing datasets.

• Utilized Python, Regex, and URL parsing libraries to extract and validate critical URL parameters
• Implemented pattern-matching algorithms to detect suspicious keywords and anomalies in URLs
• Active learner on platforms like TryHackMe, HackTheBox, and PortSwigger Academy

Rewards & Achievements

🏆 Letter of Appreciation - Summence Private Limited

Critical Vulnerability Discovery

Recognized for successfully identifying and reporting high-risk vulnerabilities in live production environments. Demonstrated expertise in discovering critical security flaws that could have led to significant data breaches and system compromise.

Critical Severity Production Environment Responsible Disclosure

🔓 Vulnerability Discovery & Recognition - Nojoto Private Limited

Multiple Critical Findings

Identified a no rate limit vulnerability and a critical Amazon S3 bucket misconfiguration in production applications and websites. These findings helped the organization secure sensitive data and prevent potential unauthorized access.

Rate Limiting Bypass S3 Misconfiguration AWS Security Data Exposure

🎯 Bug Bounty Recognition

Responsible Disclosure Program

Active participant in bug bounty programs, identifying and responsibly disclosing security vulnerabilities. Focused on web application security, API testing, and cloud infrastructure vulnerabilities with a track record of critical and high-severity findings.

Bug Bounty Ethical Hacking Security Research

Projects

🎣 Phishing Link Detection System

Academic Project | 95% Accuracy Achieved

Developed a comprehensive phishing link detection tool that identifies and analyzes malicious URLs based on multiple security features including domain analysis, HTTPS status, URL length, and blacklist verification. The system achieved an impressive 95% accuracy rate when tested against 1000+ URLs from both legitimate and phishing datasets.

Key Features:
• Utilized Python, Regex, and URL parsing libraries to extract and validate critical URL parameters
• Implemented pattern-matching algorithms to detect suspicious keywords and anomalies in URLs
• Real-time URL analysis with comprehensive security scoring
• Database integration for blacklist verification and threat intelligence

Python Machine Learning Pattern Matching URL Analysis Security Research

💡 Future Projects

Coming Soon

Upcoming Projects in Development:

• Automated VAPT Scanner: Custom vulnerability assessment tool with OWASP Top 10 coverage
• API Security Testing Framework: Comprehensive API penetration testing automation
• Security Reporting Dashboard: Real-time vulnerability tracking and reporting system
• CTF Challenge Platform: Educational cybersecurity challenges for learners

In Development Planning Research

Security Research & Blogs

📝 Authentication Bypass in OAuth 2.0

Published: January 2025 | Severity: Critical

Detailed analysis of a critical authentication bypass vulnerability in popular OAuth implementation affecting millions of users. Includes POC, remediation steps, and responsible disclosure timeline.

OAuth Authentication CVE-2025-XXXX

🔓 SQL Injection to RCE

Published: December 2024 | Severity: Critical

Complete penetration testing methodology demonstrating escalation from SQL injection to remote code execution through creative exploitation techniques.

SQL Injection RCE Privilege Escalation

⚡ SSRF in Cloud Infrastructure

Published: November 2024 | Severity: High

Server-Side Request Forgery exploitation in cloud environments, accessing internal metadata services and sensitive credentials.

SSRF AWS Cloud Security

✍️ More Coming Soon...

Future Blog Posts

I'm continuously working on creating in-depth security articles and technical writeups. Follow me on Medium for the latest updates.

Visit My Medium Profile →