┌──(visitor㉿github)-[~]
└─$ whoami
Ashutosh Jena
Security Researcher • Penetration Tester • Offensive Security Enthusiast
┌──(visitor㉿github)-[~]
└─$ cat mission.txt
Find what developers missed.
Understand why it failed.
Prove the impact.
Help secure it.operator:
name: Ashutosh Jena
codename: MAVERICK-VF142
location: India 🇮🇳
specialization:
primary:
- Web Application Penetration Testing
- API Security Testing
- Vulnerability Research
- Application Security
secondary:
- Mobile Application Security
- Infrastructure Assessment
- Security Engineering
- Open Source Security Research
current_status:
mode: "OFFENSIVE"
focus: "Finding vulnerabilities that survive automated scanners."
learning: "Advanced Web, API & Exploitation Techniques"
philosophy:
- "Understand before exploiting."
- "Impact matters more than scanner output."
- "Authorization bugs are rarely just an IDOR."| ID | Target | Vulnerability | Impact |
|---|---|---|---|
| CVE-2026-83743 | Invoice Ninja | Broken Access Control / IDOR | Unauthorized resource access |
| CVE-2026-83744 | Invoice Ninja | Server-Side Request Forgery | Server-side request abuse |
| CVE-2026-82524 | UnoPIM | Unrestricted File Upload | Remote Code Execution |
| GHSA-x397-5hrv-j9m9 | Cachet | Stored Cross-Site Scripting | Persistent client-side execution |
┌─────────────────────────────────────────────────────────────┐
│ RESEARCH METHODOLOGY │
├─────────────────────────────────────────────────────────────┤
│ │
│ Recon ──► Map Trust ──► Attack ──► Verify ──► Impact │
│ │ │
│ ▼ │
│ Reproduce │
│ │ │
│ ▼ │
│ Report │
│ │ │
│ ▼ │
│ Retest │
│ │
└─────────────────────────────────────────────────────────────┘
I don't collect vulnerabilities. I study why trust boundaries fail.
📡 Research notes, technical write-ups and disclosures:
ashutosh-jena.in
┌──────────────┐
│ TARGET │
└──────┬───────┘
│
┌────────────────┼────────────────┐
│ │ │
▼ ▼ ▼
┌────────────┐ ┌────────────┐ ┌────────────┐
│ WEB APP │ │ API │ │ MOBILE │
└─────┬──────┘ └─────┬──────┘ └─────┬──────┘
│ │ │
┌───────┼───────┐ │ ┌───────┼───────┐
▼ ▼ ▼ ▼ ▼ ▼ ▼
AUTH ACCESS INPUT BOLA STORAGE APIs RE
CONTROL AUTH
│ │ │ │ │ │ │
└───────┴───────┴────────┴────────┴───────┴───────┘
│
▼
┌────────────────────┐
│ ATTACK PATH │
└─────────┬──────────┘
│
▼
IMPACT ANALYSIS
+ Broken Access Control
+ Authentication Bypass
+ IDOR
+ SSRF
+ SQL Injection
+ Cross-Site Scripting
+ CSRF
+ SSTI
+ XXE
+ File Upload Attacks
+ Path Traversal
+ Command Injection
+ Business Logic Abuse |
+ BOLA
+ Broken Authentication
+ Object Property Authorization
+ Mass Assignment
+ JWT Weaknesses
+ Rate Limit Abuse
+ Excessive Data Exposure
+ API Enumeration
+ Business Logic Abuse
+ Improper Inventory Management |
┌──────────────────────────────── EXPLOITLEDGER ────────────────────────────────┐
│ │
│ ┌────────────┐ │
│ │ ENGAGEMENT │ │
│ └─────┬──────┘ │
│ │ │
│ ┌────────────────────────┼──────────────────────────┐ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌────────┐ ┌──────────┐ ┌────────┐ │
│ │ ASSETS │ │ COVERAGE │ │ TEAM │ │
│ └───┬────┘ └────┬─────┘ └────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ENDPOINT MAP OWASP WSTG / API │
│ │ │ │
│ └───────────────┬────────┘ │
│ ▼ │
│ ┌──────────┐ │
│ │ FINDINGS │ │
│ └────┬─────┘ │
│ │ │
│ ┌──────────┼───────────┐ │
│ ▼ ▼ ▼ │
│ CVSS EVIDENCE CWE │
│ │ │ │ │
│ └──────────┼───────────┘ │
│ ▼ │
│ RETEST │
│ │ │
│ ▼ │
│ REPORT │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
SCOPING → MAPPING → TESTING → FINDING → EVIDENCE → RETEST → REPORT
Core capabilities
- Multi-tenant organizations
- Engagement management
- Asset & endpoint mapping
- OWASP WSTG methodology coverage
- OWASP API Security methodology
- CVSS & CWE tracking
- Evidence vault
- Retest workflows
- Developer remediation portal
- Client portal
- Security report generation
- AI-assisted finding workflows
I use development knowledge as an offensive-security advantage.
Understanding how software is built makes it easier to understand how it breaks.
🏅 Expand security certifications & badges
| Certification / Badge | Issuer |
|---|---|
| Introduction to Cybersecurity | IBM |
| Cybersecurity Tools & Cyber Attacks | IBM |
| Penetration Testing & Incident Response | IBM |
| Cyber Threat Intelligence | IBM |
| Network Security & Database Vulnerabilities | IBM |
| IT Fundamentals Specialization | IBM |
┌──(maverick㉿kali)-[~/research]
└─$ ./next_target.sh
[*] Enumerating attack surface...
[*] Questioning assumptions...
[*] Following the data...
[*] Breaking trust boundaries...
[+] Interesting behavior detected.
root@maverick:~# _
[ EOF // MAVERICK-VF142 ]