// about
5
Certifications
6
Open Source Tools
BSc
Ethical Hacking
VR
Vulnerability Research
Exploit Development
Linux & Windows
Reverse Engineering
Binary Analysis & Automation
Active Directory
Offensive Security
Web Security
Modern Web Exploitation
AI Security
AI-assisted Vulnerability Research
Cloud Security
Attack Surface Research
// skills
// projects
All-in-one HackerOne CLI for bug bounty hunters. Browse programs, filter by asset type, export recon-ready scopes, track reports and earnings.
Advanced libc identification toolkit for exploit development. Fast libc identification, automatic download, symbol lookup, Python API, and CLI.
Hexadecimal analysis and parsing toolkit for binary analysis, CTF challenges, and exploit development.
CSRF vulnerability detection and exploitation framework for web application security testing.
One-command launcher for Ghidra. Binary → Automatic Project → Headless Analysis → Launch GUI.
Final year project - interactive cryptography and code-breaking challenge platform.
// currently learning
What I'm working on right now. The messy middle, not the polished result.
Still trying to get a stable kernel read primitive. The pool internals are a nightmare.
Extracting and analyzing IoT firmware. Currently learning binwalk and firmwalker workflows.
Rewriting pwnlibc internals in Rust. The borrow checker fights me but the result is worth it.
// writeups
Gap analysis of OWASP's 2025 AI security risks against real-world LLM outputs. Testing local models for prompt injection, insecure code generation, and supply chain risks.
Deep dive into how pwnlibc identifies libc versions from leaked addresses and automates exploit development workflow.
How ghidra-open eliminates repetitive Ghidra setup with one-command project creation and headless analysis.
Automating Active Directory attack paths from enumeration to domain compromise using BloodHound and Impacket.
Comprehensive guide to modern heap exploitation including tcache poisoning, house of techniques.
// hot takes
Free, open-source, and the decompiler is good enough for most reverse engineering work. IDA is only worth it for the occasional complex binary that Ghidra struggles with.
Too many writeups skip the 'why' and jump straight to the exploit. The thought process matters more than the final payload.
It's great for prototyping but you'll hit a wall the moment you need precise memory control. Learn C or Rust.
Most AD compromises don't involve exotic zero-days. They involve default configs, excessive permissions, and nobody reading the logs.
// achievements
// lessons learned
Started building a fully automated penetration testing framework. Realized halfway through that automating everything removes the critical thinking that makes pentesting valuable. The tool became a script collection that nobody would use.
lesson: Automation should augment human judgment, not replace it. Now I build tools that make specific tasks faster, not tools that try to do everything.
Spent months feeling like I didn't belong because I couldn't do kernel exploitation from scratch. Then I realized nobody can. Everyone Googles, everyone copies from their own old code, everyone struggles. The people who look effortless are just better at hiding the struggle.
lesson: Share the struggles, not just the wins. The security community needs more honesty about how hard this stuff actually is.
Real commit messages from my repos. The journey from confusion to understanding, one git commit at a time.
// learned from
The YouTube channels that shaped how I think about security. Every one of these people made me better.
// platforms
// contact
GitHub
@0xCyb3rgh0st
X (Twitter)
@0xCyb3rgh0st
Medium
@cyberghostnp
info@jatinsingh.com.np
jatin-singh-np
Open to relocation within EU
Eligible for UK/EU work visas
