I'm an Application Security Engineer with 4+ years of hands-on experience in offensive security — vulnerability assessment, penetration testing, and secure code review across Web, API, Mobile, Thick Client, and Network environments.
My work centers on simulating real-world attacks — from OWASP Top 10 exploitation and authentication abuse to full adversary-emulation exercises, plus AI / LLM security testing against the OWASP Top 10 for LLMs and the ASI01–ASI10 agentic framework. I translate findings into clear, prioritized remediation that engineering teams can ship without guesswork.
I published CVE-2025-54592 against FreshRSS and have been recognized by the security programs at Zoho, TECNO, OPPO, OnePlus, and private bug-bounty programs. Currently ranked #21 globally on TECNO SRC.
Beyond full-time consulting, I take on freelance security engagements for SaaS & startups. Flexible scoping, fixed-price or retainer.
OWASP Top 10, auth & business-logic abuse
Android & iOS — MobSF, Frida, Jadx
REST & GraphQL — BOLA, BFLA, mass assignment
SAST-driven + manual review across stacks
When I'm not testing, I'm automating — Python-first — building recon pipelines, custom Burp extensions, and threat-intel workflows that stitch together tools like Shodan, Amass, and theHarvester.
End-to-end testing of web apps against OWASP Top 10 and beyond — authentication, authorization, injection, SSRF, business logic.
REST & GraphQL APIs — broken auth, excessive data exposure, mass assignment, rate limiting, and business-flow abuse.
Android & iOS — static + dynamic analysis with MobSF, Frida, Jadx-GUI, apktool. Certificate pinning bypass, storage abuse, IPC flaws.
Internal & external network assessments — service enumeration, privilege escalation paths, lateral movement, AD weaknesses.
SAST-driven + manual review across Node, Python, Java, PHP. Focus on auth logic, deserialization, SSRF sinks, crypto misuse.
Adversary simulation, spear-phishing campaigns, C2 infrastructure, initial access operations. Built with Havoc, Evilginx, GoPhish.
Testing LLM-powered products against OWASP Top 10 for LLMs & the ASI01–ASI10 agentic framework — prompt injection, data exfiltration, RCE via tools, system-prompt extraction, chatbot IDOR.
Understand the app, auth model, data classification, and attacker goals before touching a single request.
Enumerate surface — subdomains, endpoints, JS secrets, parameters. Map the full attack surface.
Manual testing backed by automation. OWASP Top 10 first, then business logic and chained vulnerabilities.
Reproducible PoCs. Every finding includes impact, exploit path, and severity justification.
Developer-ready remediation. Retest cycles until every valid finding is resolved.
Incomplete Session Termination on Logout in FreshRSS — a session-lifecycle flaw allowing re-use of authenticated context after logout. Disclosed responsibly and credited in the upstream fix.
Technical writeup authored for TECNO SRC — vulnerability research & exploitation walkthrough.
security.tecno.comOverall global ranking #21 across TECNO's Security Response Center program.
Public profileTECNO's feature page highlighting researcher experience and contributions to the program.
3rd-of-tecnosrcPublic bug-bounty profile — reports, thanks & ongoing programs.
hackerone.com/nameisbasBugcrowd researcher profile — crowdsourced security programs.
bugcrowd.com/h/nameisbasTools, automation scripts, and research code.
github.com/baskar18Currently taking freelance engagements — penetration tests, secure code reviews, AI/LLM security assessments, and bug-bounty-style audits. Remote, worldwide. Fastest response on email or LinkedIn.