Debjyoti Choudhury

VAPT Cybersecurity professional with hands-on expertise in Web, API, and Network Infrastructure Vulnerability Assessment & Penetration Testing. Certified in advanced penetration testing and enterprise systems (C|PENT, eJPT, RHCSA). Demonstrated capability in executing manual vulnerability testing, validating security findings, and tracking issues through remediation and retesting.

Experienced in discovering high-risk vulnerabilities including RCE, OS command injection, and BOLA/IDOR across production web portals, REST/GraphQL APIs, and virtualized enterprise testbeds. Strong communicator adept at delivering actionable, CVSS-prioritized VAPT reports.

Security Intern – Web Application & Network Penetration Tester - Dept. of Cybersecurity Science & Technology, Brainware University - Kolkata, India

(2025-02 - 2025-03)

• Performed end-to-end grey-box VAPT against 2 live enterprise production environments, assessing web applications and perimeter network infrastructure.
• Conducted in-depth manual vulnerability testing to uncover 15 vulnerabilities, including 3 critical flaws: unauthenticated RCE, server-level OS command injection, and cPanel takeover via brute-force.
• Validated technical findings and assessed operational risk utilizing CVSS v3.1 and CWE; authored comprehensive client VAPT reports outlining root cause, PoC evidence, and prioritized remediation strategies.
• Collaborated with system owners to perform retesting and remediation validation, ensuring verified vulnerability closure across web servers and database endpoints.

Vulnerability Assessment Projects & Security Research - Self-directed

(2025 - 2026)

• Web Application & GraphQL API Security Testing | Burp Suite, Postman, Manual Testing, Responsible Disclosure
• Identified and manually validated high-severity SQL Injection and authentication bypass vulnerabilities on an active production portal through responsible disclosure.
• Discovered critical Broken Object Level Authorization (BOLA) and authorization flaws in an enterprise GraphQL API, preventing unauthorized PII data exposure across 1,989 records.
• Drafted formal vulnerability disclosure reports featuring step-by-step remediation workflows and assisted developers with patch validation and retesting.

PlugPwn: Infrastructure Adversary Simulation Framework - Self-directed

(2026-08 - 2026-08)

• Architected a multi-stage attack and defense simulation inside a segmented VMware virtualization lab to evaluate endpoint and network infrastructure controls.
• Simulated post-exploitation tradecraft, testing egress filtering, UAC bypass, registry persistence, and encrypted C2 communication to pinpoint infrastructure hardening gaps.
• Correlated assessment telemetry to MITRE ATT&CK techniques and documented defensive remediation benchmarks for security operations teams.

B.Sc. (Hons) - Advanced Networking & Cyber Security - Brainware University (2024-08)

Higher Secondary (12th Grade) - Old Malda Kalachand High School (2023 - 2024)