Vignesh is a Computer Security Master's student at EPITA in Paris, with hands-on experience in web, network and infrastructure penetration testing gained through internships and independent project work. He works primarily with Burp Suite, Nmap and Python, following OWASP testing methodology.
Vignesh's background spans cloud engineering, site reliability engineering and cybersecurity. During two internships at the Centre for Development of Advanced Computing in India, he worked on OpenStack infrastructure and on log-based threat detection, which gave him practical exposure to production systems and monitoring before he moved into offensive security.
His current focus is penetration testing across web applications, networks and Active Directory environments, following OWASP methodology with Burp Suite as his main testing tool. Alongside coursework, he also builds small security tools in Python, including a port scanner, a subdomain enumerator and a directory brute-forcer, to understand the mechanics behind common reconnaissance techniques rather than relying only on existing frameworks.
Built outside of coursework and internships. Source for all of them is on GitHub.
A multi-threaded TCP port scanner. It splits a target port range across a thread pool instead of testing ports one at a time, so a full-range scan finishes in seconds rather than minutes.
A host discovery tool combining ICMP and TCP probing. A pure ICMP sweep misses hosts on networks that filter ping, so this checks both and treats a response to either as evidence the host is live.
A threaded DNS brute-forcer. Wildcard DNS makes naive brute-forcing unreliable, since almost any guess resolves to something, so this fingerprints wildcard behaviour first and filters matching results out.
A multi-threaded HTTP path discovery tool with extension fuzzing and status-code filtering, used to find backup files and admin routes that don't show up in a normal crawl.
Worked on an OpenStack-based cloud provisioning platform used across 13 branches, automating over 100 VM deployments. Carried out REST API security assessments that identified authentication and privilege escalation flaws, then implemented fixes using RBAC and token-based authentication, along with least-privilege IAM policies. Automated provisioning workflows with Python and Bash, cutting manual provisioning time by approximately 40%.
Deployed an OpenTelemetry stack for infrastructure monitoring and log aggregation. Analyzed logs to identify abnormal traffic patterns and potential DDoS activity, and tuned alerting thresholds through load simulation, reducing false positives by approximately 30%.