I'm Madhurendra
Security consultant and researcher with 50+ assigned CVEs. I test web apps, APIs, mobile, thick clients, cloud and networks, then report findings teams can act on.
About Me
I'm Madhurendra, a security consultant based in Bengaluru. I've spent the last few years doing penetration testing and vulnerability research full-time, with 50+ CVEs assigned along the way. I hold the eWPTXv3, CAP and CEH Master certifications, plus an MCA degree.
I work across web, API, Android, iOS, thick-client, network and cloud testing, along with secure source-code review. Most of my tooling is in Bash and Python, and I'm comfortable across the common stacks and operating systems.
Outside of client work I hunt bugs, play CTFs on Hack The Box and TryHackMe, and write up what I find on Medium. Always happy to talk shop with people working in security.
Skills & Arsenal
The domains I work across.
Vulnerability Assessment
Web Security
Mobile Application (Android / iOS)
API Security
Thick Client
SAST & SCA
Threat Modeling
Design / Idea Review
Cloud Security
Network Security
Automation & Scripting
Security Research
Experience
Where I've worked.
- End-to-end VAPT across web, mobile, API and thick-client targets.
- SAST and DAST reviews, OWASP-aligned testing and CVSS-scored reporting.
- Penetration testing across web, mobile and API, with SAST (manual and AI-assisted).
- Threat modeling and design reviews to catch risks early in the SDLC.
- DevSecOps team running penetration testing for web, mobile, API and thick-client apps, plus SCA.
- SAST with Fortify SSC and Prisma Cloud, integrated into Jenkins CI/CD pipelines.
- VAPT across web, mobile, API and thick-client targets.
- Secure source-code review, cloud security assessments and vulnerability research.
- 350+ NCIIPC acknowledgements, plus multiple Hall of Fame and appreciation letters.
- Ongoing responsible disclosure and vulnerability research.
- Web and mobile application penetration testing.
- IoT and hardware pentesting, with documentation and reporting.
- Web pentesting on Metasploitable2 and OWASP Broken Web Apps.
- CTF challenges and hands-on labs with virtualization.
Featured Projects
Open-source tools I build and maintain.
PentestingEverything
Comprehensive repository of 15+ types of pentesting tools, resources and methodology. A one-stop reference for offensive security.
PentestingChecklist
A practical, repeatable security testing checklist covering web, API, mobile and network engagements end to end.
Clickjacking-Poc
Instant clickjacking proof-of-concept generator to demonstrate UI-redress vulnerabilities for reports.
scan4secrets
Lightweight source-code scanner with 400+ detection rules for secrets, tokens and sensitive information.
wordlistForger
Targeted wordlist generator that forges context-aware lists to sharpen fuzzing and brute-force coverage.
Scripting4Hackers
A growing collection of Bash and Python scripts that automate everyday offensive-security tasks.
50+ CVEs Assigned
A sample of CVE IDs credited to me, each verifiable on cve.org.
Articles & Writing
Long-form guides on offensive security, published on Medium and my blog.
Certifications
Credentials in offensive and application security.
Education
Recognition & Hall of Fame
Organisations and bodies that have credited my disclosures.
Hobbies & Interests
Let's build something secure
Open to consulting and research work. Reach me on any of these.