I'm Madhurendra
Security Consultant & Vulnerability Researcher working across penetration testing, VAPT, Appsec and security research. I enjoy understanding how systems work, finding vulnerabilities and how systems can be secured.
About Me
I'm Madhurendra, a security consultant based in Bengaluru. I've spent the last few years doing penetration testing and vulnerability research full-time, with 50+ CVEs assigned along the way. I hold CRTPT, eWPTXv3, and CEH Master certifications, along with my MCA degree
I work across web, API, Android, iOS, thick-client, network and cloud testing, Agentic Pentest, along with secure source-code review, SCA, Threate modeling etc. Most of my tooling is in Bash and Python, and I'm comfortable across the common programming language and Linux/Windows.
Outside of the office work, I spends time on research, contribute on my open source project, hunt bugs, play CTFs on Hack The Box and TryHackMe, and write technical articles on Medium. I'm always happy to connect with others in the security community.
Skills & Arsenal
The domains I work across.
Vulnerability Assessment
Web Security
Mobile Application (Android / iOS)
API Security
Thick Client
SAST & SCA
Threat Modeling
Design / Idea Review
Cloud Security
Network Security
Automation & Scripting
Security Research
Experience
Where I've worked.
- End-to-end VAPT across web, mobile, API and thick-client targets.
- SAST and DAST reviews, OWASP-aligned testing and CVSS-scored reporting.
- Penetration testing across web, mobile and API, with SAST (manual and AI-assisted).
- Threat modeling and design reviews to catch risks early in the SDLC.
- DevSecOps team running penetration testing for web, mobile, API and thick-client apps, plus SCA.
- SAST with Fortify SSC and Prisma Cloud, integrated into Jenkins CI/CD pipelines.
- VAPT across web, mobile, API and thick-client targets.
- Secure source-code review, cloud security assessments and vulnerability research.
- 350+ NCIIPC acknowledgements, plus multiple Hall of Fame and appreciation letters.
- Ongoing responsible disclosure and vulnerability research.
- Web and mobile application penetration testing.
- IoT and hardware pentesting, with documentation and reporting.
- Web pentesting on Metasploitable2 and OWASP Broken Web Apps.
- CTF challenges and hands-on labs with virtualization.
Featured Projects
Open-source tools I build and maintain.
PentestingEverything
Comprehensive repository of 15+ types of pentesting tools, resources and methodology. A one-stop reference for offensive security.
PentestingChecklist
A practical, repeatable security testing checklist covering web, API, mobile and network engagements end to end.
scan4secrets
Lightweight source-code scanner with 400+ detection rules for secrets, tokens and sensitive information.
PayloadEverything
Comprehensive collection of payloads for penetration testing, vulnerability assessment, and security research.
Scripting4Hackers
A growing collection of Bash and Python scripts that automate everyday offensive-security tasks.
50+ CVEs Assigned
A sample of CVE IDs credited to me, each verifiable on cve.org.
Articles & Writing
Long-form guides on offensive security, published on Medium and my blog.
Certifications
Credentials in offensive and application security.
Education
Recognition & Hall of Fame
Organisations and bodies that have credited my disclosures.
Hobbies & Interests
Let's build something secure
Open to consulting and research work. Reach me on any of these.