Skip to content
View DarkLycn1976's full-sized avatar
🎯
Focusing
🎯
Focusing
  • Chennai, Tamil Nadu, India

Block or report DarkLycn1976

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
DarkLycn1976/README.md
Krithik Babu P — Product Security Engineer, vulnerability research and coordinated disclosure

I break application and infrastructure security for a living, and for fun. Six years in offensive security, currently doing product security full-time. Most of my public work is source-level vulnerability research — reading code until I find the bug, then building a proof that it is real.


Published research

IdentifierTargetClassSeverity
CVE‑2026‑19264 Postiz Unauthenticated path traversal → full instance takeover
technical writeup · advisory · CWE‑22
Critical
9.8
GHSA‑6m2r‑wm6v‑c8qp VNote Argument injection → arbitrary command execution
advisory · CWE‑88
High

Further advisories are in coordinated disclosure and will be listed once public.

PapersGrowing Threats of Cyber Security: Protecting Yourself in a Digital World, IEEE ICNWC 2023.


Focus

Source-level audits Path traversal · injection · deserialization · authn/authz boundaries · SSRF · supply-chain and CI/CD attack paths

Application & API IDOR · auth bypass · business logic · request smuggling · cache poisoning · OAuth and session handling

AI & agent security Prompt injection and XPIA · agent tool-permission boundaries · MCP server security

Red team & Active Directory Enumeration · privilege escalation · persistence · cross-trust and inter-forest attacks

Also: Web3 contract auditing, Android/iOS assessment, cloud IAM and misconfiguration.


How I work

Prove it or drop it. Every report ships with a reliable, minimised PoC and a control case. No theoretical findings.

Vendor first. Coordinated disclosure, no deadlines, nothing published before a fix ships.

Root cause over symptom. A report should explain why the bug exists and what the correct fix is.


Background

Product Security Engineer2025 – present · remote
Security Engineer — Vault Infosec2024 – 2025
Trainee Security Engineer — Auriseg2023 – 2024

Web, API, mobile and thick-client VAPT · network VA and configuration audits · secure source-code review, automated and manual · DevSecOps. Contributed to SEBI CSCRF and CERT‑In empanelled engagements.

Certifications — CRTP · PNPT · PT1 · eJPT · CEH Practical (17 total)
CRTP Certified Red Team Professional — Altered Security
PNPT Practical Network Penetration Tester — TCM Security
PT1 Jr Penetration Tester — TryHackMe
eJPT eLearnSecurity Junior Penetration Tester
CEH (Practical) EC-Council
Community & CTF
  • 🏆 1st place — Enigma Expedition 2024, ISACA Chennai Chapter · Team Dark Vengeance
  • 🥇 ServiceNow CTF winner · CloudSEK top 3 — NULLCON Goa 2025
  • 🎤 Member, BSides Bangalore · organiser, CyberHawkCTF 2023 (published TryHackMe room)
  • 📍 VulnCon · BSides Bangalore & Ahmedabad · NULLCON Goa · Seasides · CSA Bangalore · ISACA Chennai · CSEC Chennai

Tooling

Burp Suite Pro Ghidra Frida Objection MobSF jadx Foundry Semgrep Checkmarx nuclei Nessus Nmap Wireshark

Python Go Rust TypeScript Solidity Bash



LinkedIn  HackerOne  TryHackMe

Popular repositories Loading

  1. CEH-Practical-Notes-and-Tools CEH-Practical-Notes-and-Tools Public

    My Personal Notes that I used on the Exam as a Cheatsheet

    C 72 38

  2. INFO3NUM INFO3NUM Public

    INFO3NUM or Information Enumeration is a CLI (Command Line Interface) based Cybersecurity Tool, which is used in Linux (Debian) Operating system. It is Developed using Python3 & Bash. INFO3NUM help…

    Python 6

  3. Cybersecurity-Resource Cybersecurity-Resource Public

    Python

  4. DarkLycn1976 DarkLycn1976 Public

    Config files for my GitHub profile.

  5. CVE-2026-19264 CVE-2026-19264 Public

    CVE-2026-19264 - Critical unauthenticated path traversal to full instance takeover in Postiz (< 2.22.1). Technical writeup: decode-order bypass, JWT_SECRET escalation, and analysis of the upstream …