Akshat Singh
Penetration tester with hands-on experience in web application exploitation, Active Directory attacks, and CVE-based vulnerability research
Talent
LucknowMember since June 10, 2026
Penetration TestingActive Directory AttacksVulnerability ChainingBloodHoundResponderAS-REP RoastingKerberoastingOAuth 2.0PythonHackTheBoxHackerOne
·
Hire this person
Send a job offer directly to this candidate
Penetration TestingActive Directory AttacksVulnerability ChainingBloodHoundResponder
About
Penetration tester with hands-on experience in web application exploitation, Active Directory attacks, and CVE-based vulnerability research. Built a suite of open-source offensive security tools (ShadowC2, ShadowRecon, ShadowScan). Active on HackTheBox and HackerOne. Targeting junior penetration testing and red team roles.
Experience
Active Player at HackTheBox (Present)
- Completed 20+ Linux and Windows machines (Medium/Hard); active player on the platform
- CVEs exploited: CVE-2025-8110 (Gogs RCE via symlink), CVE-2024-46987 (LFI), CVE-2025-49132 (LFI); ZoneMinder SQLi + motionEye RCE chain; Wing FTP RCE + TAR symlink privesc
- AD techniques: AS-REP Roasting, Kerberoasting, Responder NTLM capture, MSSQL linked server abuse, gMSA extraction, BloodHound enumeration, ADCS attack paths
Bug Bounty Researcher at HackerOne (Present)
- Discovered unauthenticated order tracking API on Meesho/Valmo.in exposing order and user data; identified user enumeration on supplier.meesho.com and exposed Sentry DSNs; filed H1 reports
- Performed OAuth 2.0 recon on Truecaller's Shopify-integrated backend - mapped full auth flow, JS source review, and API endpoint discovery on wildcard scope targets
Education
B.E. in Instrumentation & Control Engineering – Sant Longowal Institute of Engineering and Technology (2023)
Secondary Education – RLB International School (2022)
Skills
Active Directory attacksand CVE-based vulnerability research
