~/portfolio $ cat about.md

Saharsh Agrawal

Security Researcher · Threat Intelligence · Pentester

Hi there! I'm a security researcher who spends most of my time finding bugs in web applications, taking apart malware campaigns, and writing up exactly how the attack worked. I care about the part after the exploit: the detection, the write-up, the tooling that makes the next hunt faster.

Everything published on this site is my own work — CVE analysis, CTF walkthroughs, threat research and the tools I build along the way. When I'm not in front of a terminal you'll find me out on the racetrack.

$ cat ./focus.md

Vulnerability Research

Finding and reporting real vulnerabilities in production web applications — from open redirects and access-control flaws to injection issues — and writing them up with a reproducible proof of concept.

Penetration Testing

Full-scope offensive engagements against infrastructure and applications, from initial reconnaissance through to privilege escalation and lateral movement.

Threat Intelligence

Tracking how commodity malware is delivered and updated — PaperCut exploitation, IcedID, Qakbot, OneNote campaigns and Aurora Stealer — and turning that research into detections teams can actually deploy.

Automation & Tooling

Building the small tools that remove the repetitive parts of a hunt: subdomain enumeration wrappers, data pipelines and analysis scripts that make the work repeatable.

$ git log --oneline --reverse

  • 2020

    Started publishing CTF walkthroughs

    Wrote up TryHackMe rooms from first blood to root — Lazy Admin, Pickle Rick, Agent Sudo, Ignite, Tomghost, Anthem, Vulnversity, Kenobi and more — documenting every command and every dead end along the way.

  • 2021

    Built Sub3num and shipped more writeups

    Created Sub3num, a subdomain-enumeration wrapper that chains Sublist3r, Assetfinder, Subfinder, Findomain, Amass, httprobe and subjack into one pass. Continued with the Overpass, ColddBox and Advent of Cyber 3 writeups.

  • 2022

    Shipped NEPSE FloorSheet Analysis

    Built a Python, Pandas and NumPy pipeline that pulls and analyses NEPSE floor sheet data, turning a raw daily dump into something you can actually read and trade off.

  • 2023

    Published threat research with Loginsoft

    Co-authored four articles on active intrusion chains — exploitation of CVE-2023-27350 in PaperCut by Cl0p, LockBit and TrueBot; the evolving IcedID malware family; the OneNote delivery campaign; and the Aurora Stealer campaign.

    Read the articles →

  • 2025

    CVE-2025-47789 published

    Reported and disclosed an open redirect vulnerability (CWE-601) in the Horilla HRMS platform, with a full proof of concept and remediation guidance.

    Read the analysis →

$ cat ./skills.txt

Offensive

  • Web application security
  • Exploit development & PoC writing
  • Privilege escalation & lateral movement
  • API and authentication testing
  • Network service enumeration

Defensive & research

  • Malware analysis & reverse engineering
  • Threat hunting & OSINT
  • Detection engineering (Osquery, Sigma)
  • Incident response
  • CVE research & disclosure

Tooling

  • Burp Suite, Nuclei, Nmap, Nessus
  • Ghidra, IDA, Volatility
  • Wireshark, Sysmon, Zeek
  • Python, Bash, PowerShell
  • Pandas, NumPy, Jupyter

$ contact --info

Open to security research roles, freelance assessments, and collaboration on tooling or interesting problems. The fastest way to reach me is email.