B.Tech CSE (Cybersecurity) · GD Goenka University · CGPA 9.25 / 10 Research Intern · Computer Services Centre, IIT Delhi · June 2026
I bridge offensive security (exploitation, VAPT) with blue team (detection, response, automation). Most security practitioners focus on one side. I document both — every attack I run has a paired detection rule.
Current focus: Network-layer anomaly detection and SDN-based flow analysis at IIT Delhi CSC.
| # | Repo | What it demonstrates |
|---|---|---|
| 1 | VAPT-Portfolio | 20+ assessments · MS17-010 · CVSS-aligned risk reporting |
| 2 | ad-exploitation-lab | 5 AD attack chains · MITRE ATT&CK · paired Sigma rules · PCAP evidence |
| 3 | security-automation-scripts | Nessus XML parser · SIEM threat detector · IR playbook trigger |
| 4 | sdn-network-lab | Mininet mesh topology · Ryu L2 controller · OpenFlow 1.3 |
Repo: ad-exploitation-lab
End-to-end purple team lab — 5 attack chains, each with a paired Sigma detection rule and PCAP evidence:
| Attack | T-Code | Detection Signal |
|---|---|---|
| Kerberoasting | T1558.003 | Event 4769 from non-service account |
| Pass-the-Hash | T1550.002 | Same NTLM hash reused across machines |
| DCSync | T1033 | Replication RPC from non-DC source |
| Lateral Movement (SMB) | T1021.002 | Admin$ access + cmd.exe via svchost |
| Credential Spray | T1110.003 | >5 × Event 4625 in 5 minutes |
Repo: VAPT-Portfolio
20+ vulnerability assessments with professional documentation:
- MS17-010 (EternalBlue) exploitation — CVSS 9.3
- Full lifecycle: Recon → Scanning → Enumeration → Exploitation → Post-Exploitation
- Risk-based reporting aligned with NIST CSF and CIS Controls
Repo: security-automation-scripts
Three production-ready scripts for SOC automation:
- nessus_parser.py — Nessus XML → severity-sorted CSV with CVSS v3.1
- siem_analyzer.py — detects brute force, privilege escalation, lateral movement
- ir_trigger.sh — fires structured IR playbooks from alert payloads
Repo: sdn-network-lab
Hands-on SDN lab built to understand network-layer security research:
- Mininet 3-switch mesh with Open vSwitch
- Ryu controller with MAC learning and OpenFlow 1.3 flow rules
- Foundation for flow-based anomaly detection work
Repo: CCT-Lab-Reports
EC-Council C|CT hands-on lab documentation — network analysis, defensive security, incident response.
| Offensive | Defensive | Research |
|---|---|---|
| AD attacks (Kerberoasting, PTH, DCSync) | Sigma rules · Splunk SPL | Network flow analysis |
| Privilege escalation · lateral movement | Threat hunting · IR automation | Mininet · Ryu · SDN |
| VAPT methodology · CVSS scoring | SIEM analysis (Splunk / ELK) | Python · Bash scripting |
| MITRE ATT&CK mapping | Detection engineering | Wireshark · Impacket |
B.Tech CSE — Cybersecurity Specialisation GD Goenka University · Class of 2027 · CGPA 9.25 / 10
| Certification | Status |
|---|---|
| EC-Council C|CT (Certified Cybersecurity Technician) | ✅ Completed |
| IIT Guwahati Cybersecurity Micro-Credit Programme | ✅ Completed |
| EC-Council C|EH (Certified Ethical Hacker) | 🎯 Target Dec 2026 |
- 🔬 Interning at Computer Services Centre, IIT Delhi — network security research
- 📖 Studying flow-based anomaly detection, SDN architecture, academic IDS literature
- 🏗️ Building toward a research publication pipeline
Most pentesters focus on finding vulnerabilities. I focus on defensibility — can this attack be detected? What does the event log look like? What is the Sigma rule? What's the IR playbook? That perspective is what makes a security engineer, not just a pentester.
📧 becomeshivamjha@gmail.com · 🔗 LinkedIn · 🧑💻 GitHub
Building toward an elite-tier security career. Always learning. Always shipping.