name: Sanjay Singh
role: Senior Manager - Cyber Security Services
speciality: Offensive Security | Vulnerability Research | Exploit Development
experience: 10+ years
cves: 100+ assigned by MITRE
exploits: 5+ verified on Exploit-DB
books: 6 published on Amazon
location: Bangalore, Karnataka, India
status: [ ● AVAILABLE ] open for engagementsI break things so others can build them safer. A decade spent hunting vulnerabilities across Web, IoT & Telecom products — with 100+ CVEs assigned by MITRE, verified exploits on Exploit-DB, and hands-on research spanning applications, infrastructure, and connected devices.
| 🎯 100+ | ⏳ 10+ | 📚 6 | 💥 5+ |
|---|---|---|---|
| CVEs | Years | Books | Exploits |
- Acknowledged by multiple global organizations for impactful vulnerability research
- Hands-on with routers, switches, IoT devices & telecom NFV products
- Comfortable across Web, Mobile, API, Cloud, IoT & traditional infrastructure
- Author of 6 published cybersecurity books on Amazon
| Skill | Proficiency |
|---|---|
| Web Application Security | 95% |
| API Security Testing | 92% |
| 0-day Research & Exploit Dev | 93% |
| Network & Infrastructure | 90% |
| Mobile Security | 88% |
| IoT & Telecom Security | 85% |
2020 ├─ CVE-2020-15035 CRITICAL Authentication Bypass
└─ CVE-2020-15036 HIGH Session Fixation
2022 └─ CVE-2022-29004 HIGH XSS via File Upload
2023 ├─ CVE-2023-30101 HIGH Command Injection
└─ CVE-2023-33396 HIGH SQL Injection
2024 ├─ CVE-2024-31531 HIGH Stored XSS
├─ CVE-2024-33280 HIGH Broken Access Control
└─ CVE-2024-29355 MEDIUM Information Disclosure
2025 ├─ CVE-2025-28349 CRITICAL Remote Code Execution
├─ CVE-2025-26208 HIGH Auth Bypass
├─ CVE-2025-26209 HIGH RCE via Input Validation
└─ CVE-2025-28350 HIGH Privilege Escalation
100+ vulnerabilities assigned by MITRE across auth bypass, injection, access control & RCE spanning web, IoT & telecom products.
🔗 View Full CVE Portfolio → — complete indexed list with affected products, impact ratings & exploitation notes. Reach out for detailed PoC write-ups and technical briefings.
Publicly verified vulnerabilities on Exploit-DB and other platforms:
| Date | Title | Type | Platform |
|---|---|---|---|
| 2025-06-05 | CloudClassroom PHP Project 1.0 — SQL Injection | SQLi | PHP |
| 2024-05-13 | Prison Management System — SQL Injection Auth Bypass | SQLi | PHP |
| 2023-04-08 | Medicine Tracker System v1.0 — SQL Injection | SQLi | PHP |
| 2023-04-08 | Online Appointment System v1.0 — XSS | XSS | PHP |
| 2022-06-10 | WordPress Motopress Hotel Booking Lite 4.2.4 — Stored XSS | XSS | PHP |
Offensive and defensive tooling built for real-world security assessments, research & compliance workflows:
| Tool | Focus | Highlights |
|---|---|---|
| Cybersecurity Resource Matrix | Web · Recon | Filterable matrix mapping attack techniques, tools, standards & learning resources across security domains — mapped to OWASP & MITRE ATT&CK |
| SudoShark | Network · Traffic Analysis | Interactive packet analysis & visualization platform — inspect traffic, surface anomalies, map protocol-level behavior |
| APK Auditor Threat Console | Mobile · Android | Browser-based static analysis for APKs — dangerous permissions, hardcoded secrets, OWASP Mobile Top 10, no install required |
| SecureScan Suite | Web Security | All-in-one scanning dashboard — passive recon, header analysis, SSL/TLS grading, vulnerability fingerprinting |
| DOCX Pro | Report Generation | Browser-based generator for structured pentest reports & compliance write-ups in DOCX — no Word install required |
| IPA Auditor Threat Console | iOS | Static analysis for iOS IPA bundles — hardcoded secrets, weak crypto, insecure permissions, OWASP Mobile Top 10 |
🔗 More tools & scripts on GitHub
Books Authored — cybersecurity titles covering CVE hunting, pentesting methodology & career roadmaps (available on Amazon):
- A Tale of 100 CVE's Hunting — deep dive into vulnerability hunting showcasing 100 real CVEs and the research behind them
- How to Become a Penetration Tester: Zero to One — skills, tools & strategy for an ethical hacking career
- How to Start a Career in Cybersecurity — complete roadmap from zero to your first security role
- 101 Broken Access Control Test Cases — web & API bug bounty focused, covering the #1 OWASP vulnerability
- Cyber-Security Journey: A Comprehensive Guide — fundamentals through career launch
- Privilege Escalation: Unlocking Security — post-exploitation & privilege escalation techniques
Medium Articles
- Easy to Find 3 Bugs on Sign-in & Sign-up — common yet impactful authentication flow bugs, found quickly and systematically
- Directory Listings Checker — discovering sensitive files and misconfigurations via directory listing checks
- ShinobiLabs: Hidden Leaf Exploit — enumeration, exploitation & privilege escalation walkthrough in a custom lab
📺 More write-ups & walkthroughs on YouTube and the Portfolio Blog
Need a security assessment, product hardening, or research collaboration? I'm available.
📍 Bangalore, Karnataka, India | 📞 +91 XXXXXXXXXX
"Breaking things to make them safer."
© 2026 Sanjay Singh · SUDONINJA