root@kali:~# cat /etc/threat-actor.json
{
"operator" : "Rehan Malek",
"affiliation" : "NSIT Ahmedabad [M.Sc Cybersec]",
"clearance" : "RED TEAM // UNRESTRICTED",
"specialties" : [
"ICS/SCADA Exploitation",
"Authentication System Hacking",
"Hardware Implants & RF Attacks",
"Bug Bounty & CVE Research",
"RADIUS/AAA Security"
],
"cve_count" : "1 PENDING",
"mission" : "Hunt. Break. Disclose. Repeat.",
"available" : true,
"status" : "[●] ACTIVE — HUNTING MODE"
} |
|
⚠️ All research conducted ethically under Coordinated Vulnerability Disclosure (CVD) frameworks. Do not attempt to replicate on unauthorized systems.
| 🔴 STATUS | CVE ID | TARGET | SEVERITY | CLASS |
|---|---|---|---|---|
⏳ PENDING |
CVE-XXXX-XXXXX |
Kotori ICS/SCADA | 🔴 CRITICAL | Unauthenticated Telemetry Data Poisoning |
╔══════════════════════════════════════════════════════════════════════════╗
║ [ EXPLOIT CHAIN ANALYSIS — KOTORI ] ║
╠══════════════════════════════════════════════════════════════════════════╣
║ ║
║ TARGET : Kotori ICS/SCADA Framework ║
║ VECTOR : Unauthenticated HTTP Endpoint ║
║ TECHNIQUE : Telemetry Data Injection → Sensor Value Falsification ║
║ IMPACT : Critical Infrastructure Disruption / False Sensor Data ║
║ DISCLOSE : Coordinated Vulnerability Disclosure (CVD) ║
║ CREDIT : ✅ Official Contributor Credit Received ║
║ CVE ID : Pending Assignment by NVD ║
║ ║
╚══════════════════════════════════════════════════════════════════════════╝
┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ RECON │───▶│ WEAPON │───▶│ DELIVER │───▶│ EXPLOIT │───▶│ PERSIST │───▶│ EXFIL │
│──────────│ │──────────│ │──────────│ │──────────│ │──────────│ │──────────│
│ OSINT │ │ Zero-Day │ │ Social │ │Auth Byp. │ │ RADIUS │ │Data Drain│
│ Nmap │ │ HW Implnt│ │ Delivery │ │ SCADA/OT │ │ Backdoor │ │ C2 Comms │
│ Shodan │ │ Exploits │ │ Phishing │ │ ICS/PLC │ │ Persist │ │ Loot Out │
└──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘
| 🌐 WEB APPLICATION | 📡 HARDWARE & EMBEDDED | 🏭 ICS / SCADA | 🔐 NETWORK & AUTH |
|---|---|---|---|
| OWASP Top-10 | Flipper Zero | Modbus / DNP3 | RADIUS / AAA |
| SQL Injection | RF Replay Attacks | Telemetry Poisoning | Wi-Fi Deauth |
| Auth Bypass / IDOR | NFC Cloning | PLC Exploitation | MITM Attacks |
| XXE / SSRF / RCE | RFID Spoofing | Kotori Framework | Session Hijacking |
| LFI / RFI | BadUSB / JTAG | OT Network Recon | Cred Harvesting |
📱 ROOT LOCK SCREEN BYPASS — [Android Security]
╔══════════════════════════════════════════════════════╗
║ OPERATION : DROID BYPASS ║
╠══════════════════════════════════════════════════════╣
║ TARGET : Rooted Android Devices ║
║ VECTOR : Privilege Escalation via Root Shell ║
║ METHOD : Scripted Lock Screen Bypass ║
║ IMPACT : Full Device Access — No Auth Required ║
║ LESSON : Root access = broken security model ║
╚══════════════════════════════════════════════════════╝
Script demonstrating privilege escalation on rooted Android devices, exposing fundamental weaknesses in Android's security model when root is present. Full PoC with documentation.
🔐 CYRAD — ENTERPRISE RADIUS AUTH SYSTEM — [Network Auth / AAA]
╔══════════════════════════════════════════════════════╗
║ OPERATION : CYRAD DEPLOYMENT ║
╠══════════════════════════════════════════════════════╣
║ SYSTEM : CYRAD — Custom RADIUS Auth Platform ║
║ BUILD : Designed & built from scratch ║
║ FEAT 1 : Per-user data limits & quota enforce ║
║ FEAT 2 : Real-time session monitoring (AAA) ║
║ CLIENT : Cyndia Cyberspace LLP ║
║ RESULT : ✅ Letter of Recommendation Awarded ║
╚══════════════════════════════════════════════════════╝
Enterprise-grade Authentication, Authorization, and Accounting (AAA) system. Built for production deployment with real-time data cap enforcement and live session management.
🔍 ORIGIN IP DISCOVERY TOOL — [OSINT / Recon]
╔══════════════════════════════════════════════════════╗
║ OPERATION : UNMASK ║
╠══════════════════════════════════════════════════════╣
║ TARGET : CDN-protected web applications ║
║ VECTOR : Origin IP unmasking (Cloudflare/CDN) ║
║ METHOD : Multi-vector recon + DNS enum ║
║ PURPOSE : Expose true origin — bypass WAF/CDN ║
║ USE CASE : Penetration testing recon phase ║
╚══════════════════════════════════════════════════════╝
Automates origin IP discovery behind Cloudflare and reverse proxies. Used in pen tests to identify and attack the true origin server, bypassing CDN/WAF protections entirely.
📡 FLIPPER ZERO 5-IN-1 EXTENSION BOARD — [Hardware Hacking]
╔══════════════════════════════════════════════════════╗
║ OPERATION : HARDWARE KRAKEN ║
╠══════════════════════════════════════════════════════╣
║ HARDWARE : Custom Flipper Zero PCB Extension ║
║ CAP 1 : RF Replay + Sub-GHz attacks ║
║ CAP 2 : NFC cloning + RFID spoofing ║
║ CAP 3 : Physical bypass + BadUSB ║
║ PURPOSE : Red team physical security assessment ║
║ STATUS : Built, assembled & field-tested ║
╚══════════════════════════════════════════════════════╝
Custom 5-in-1 PCB extension board for Flipper Zero — dramatically expanding RF, NFC, RFID, and physical attack capability for real-world red team operations.
┌─────────────────────────────────────────────────────────────────────────┐
│ [OP-001] KUBOTOR — Bug Bounty Hunter (Intern) │
│ TIMELINE : Sep 2025 → Jan 2026 │
├─────────────────────────────────────────────────────────────────────────┤
│ [+] Executed structured penetration tests across multiple live targets │
│ [+] Chained vulnerabilities for maximum-impact proof-of-concept │
│ [+] Responsible disclosure pipeline — full exploit documentation │
└─────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐
│ [OP-002] CYNDIA CYBERSPACE LLP — Security Analyst (Intern) │
│ TIMELINE : May 2025 → Jul 2025 │
├─────────────────────────────────────────────────────────────────────────┤
│ [+] Architected CYRAD from zero — enterprise RADIUS authentication │
│ [+] Per-user quota enforcement + real-time session monitoring │
│ [+] Awarded Letter of Recommendation for exceptional delivery 🏅 │
└─────────────────────────────────────────────────────────────────────────┘
| DOMAIN | SKILL | THREAT LEVEL |
|---|---|---|
| 🌐 Web App Pentesting | Burp Suite / OWASP | ████████████ ADVANCED |
| 📡 Hardware Hacking | Flipper Zero / RF / RFID | █████████░░░ PROFICIENT |
| 🏭 ICS / SCADA | Kotori / Modbus / OT | ██████████░░ ADVANCED |
| 🔐 Network / Auth | RADIUS / AAA / MITM | ████████████ ADVANCED |
| 🐍 Python Scripting | Exploit Dev / Automation | █████████░░░ PROFICIENT |
| 🔎 OSINT / Recon | Shodan / DNS / Nmap | ████████████ ADVANCED |
| 💾 Forensics | Digital Evidence / Analysis | ███████░░░░░ INTERMEDIATE |
| 🧩 CTF | Capture The Flag | ████████░░░░ PROFICIENT |
| 🏅 CERTIFICATION | 🏛️ ISSUER | 🎯 DOMAIN |
|---|---|---|
| Cyber Security & Privacy | NPTEL | Defensive & Offensive SecOps |
| Computer Networks & Internet Protocol | NPTEL | Network Architecture |
| SQL Injection Attack | EC-COUNCIL | Web Application Exploitation |
| PHP & MySQL | IIT Bombay | Backend Development |
| H4CKP13T 0X01 | International CTF | Capture The Flag |
| PHANTOM FLAB | CTF Event | Capture The Flag |
┌──────────────────────────────────────────────────────────┐
│ OPEN TO ENGAGEMENTS │
├──────────────────────────────────────────────────────────┤
│ ✅ Freelance Penetration Testing Assessments │
│ ✅ Bug Bounty Collaborations & Joint Research │
│ ✅ Security Research Internships │
│ ✅ Full-Time Offensive Security Roles │
│ ✅ CVE Coordination & Responsible Disclosure │
│ ✅ Red Team Operations & Hardware Hacking │
└──────────────────────────────────────────────────────────┘
root@rehan:~# echo "© 2026 Rehan Malek — ONLINE | MODE: HUNTING | CLEARANCE: RED TEAM"
© 2026 Rehan Malek — ONLINE | MODE: HUNTING | CLEARANCE: RED TEAM