Offensive security consultant breaking web apps, APIs, mobile, networks and cloud for a living — then writing the report that gets it fixed, building the tooling that speeds it up, and training the people who do it next. OSCP · CEH

$ scope --list
[+] web-app .......... exploited
[+] api .............. authz broken
[+] android .......... bypassed
[+] aws · azure · m365  cis gaps
[+] ext / int network   pivoted
$ report --exec-summary
[✓] risk reduced. shipped.

discipline: offensive security · VAPT · appsec · cloud security
breaks:     web apps · APIs · Android · external & internal networks · AWS · Azure · M365
depth:      authn/authz bypass · business-logic abuse · SSRF & RCE chains · privilege escalation
programs:   SAST & DAST · attack surface management · threat intel · phishing simulation
dast:       hands-on scanning; supported the Invicti PoC and onboarding, now enabling the team
teaches:    web · API · Android · cloud · AI/LLM — live labs, real tooling, report writing
writes:     https://suhelkathi.medium.com/
motto:      find it before someone else does.

Frameworks & standards — OWASP Top 10 (Web & API 2023) · PTES · OSSTMM · CIS Benchmarks

▸ Web application penetration testing
▸ API security testing — OWASP API Top 10 2023
▸ Mobile (Android) application penetration testing
▸ External network penetration testing
▸ Internal network penetration testing
▸ Cloud security review — AWS · Azure · M365/O365 · CIS Benchmarks
▸ Hands-on SAST & DAST — supported Invicti PoC, onboarding and team enablement
▸ Threat intelligence, attack surface management & CTI escalation
▸ Firewall & secure configuration review
▸ Security automation and AI-assisted tooling
▸ VAPT & cloud security training delivery

I teach practical offensive security across Web, API, Android, Cloud and AI/LLM security — with hands-on labs, real-world tooling, vulnerability assessment, exploitation techniques, and professional report writing.

The focus is on building practical skills that translate directly into real-world VAPT engagements and cybersecurity roles.

I teach practical AWS Cloud Security through hands-on labs — covering IAM, network security, S3, API security, monitoring, threat detection, and secure architecture using real AWS environments.

The focus is on learning how to audit, identify misconfigurations, assess security gaps, and harden AWS environments — not just understand cloud security concepts theoretically.

_{Certified Cybersecurity Educator Professional (CCEP)}

Read them all → suhelkathi.medium.com

Offline, zero-cost recon and triage agent that automates the repetitive first pass of a black-box web assessment — while keeping a human in the loop before any offensive action fires.

• Runs a full recon-to-active-scan pipeline (subdomain enumeration, port scanning, crawling, content discovery, OWASP ZAP active scanning) across 13 integrated open-source tools
• An AI layer classifies each discovered endpoint and proposes relevant follow-up tests — approved by the tester before anything runs
• A deterministic findings engine ranks every result by real evidence, so nothing critical gets silently dropped or downgraded by the AI layer
• Outputs a CISO-ready Excel report: severity, evidence, impact, recommendation, PoC steps and an AI-suggested verdict — with a final column for the tester's own confirmation

Why it's built this way: the AI assists — it decides what to test and helps triage results — but it never autonomously exploits. Detection stays evidence-based and deterministic; judgment stays human.

Python Ollama (local LLM) MariaDB OWASP ZAP subfinder · httpx · naabu · katana · nuclei sqlmap dalfox

_{Built on the open-source METATRON project (MIT) as a base CLI/LLM shell — the recon integration, verification layer, escalation engine, deterministic findings ranking, agent triage and reporting are original work on top of it.}

Point it at a list of root domains and it hands back a clean, verified black-box scope — ready to hand off. Fully deterministic, no AI involved: this is data processing, not judgment, so it should be boringly reliable every time.

• Enumerates every subdomain across a list of root domains
• Probes each one for live status with the full redirect chain (301 → 200) and resolved IP — not just a final code
• Cross-matches against known-covered and decoy lists, so scope stays clean of anything already tested elsewhere or intentionally out of bounds
• Deduplicates www. vs. bare domains only after checking which one actually works, so a live subdomain is never dropped for a dead duplicate
• Three-sheet Excel output: full audit trail, final filtered scope, and a summary

Python subfinder httpx openpyxl

🔗 github.com/suhelkathi/Blackbox_Scope_finalizer

Detects Cross-Origin Resource Sharing misconfigurations using confirmation-based logic that keeps false positives near zero. Rather than flagging every permissive header, it reports a finding only when the server provably reflects an attacker-controlled origin, and scores severity by whether credentials are actually in play — so a critical finding genuinely means cross-origin theft of authenticated data.

Python

Tests whether an application trusts client-supplied host information and reflects it into a security-relevant location. A two-pass canary technique — one triage request across all candidate headers, then isolated confirmation of each hit — extracts the exact reflected value to classify whether the attacker still controls the resulting host, cleanly separating exploitable reflections from harmless ones.

Python

$ contact --suhel

Open to offensive security engagements, red team collaboration, API security research and training.