Employee records service
- Findings
- Impact
- Runtime detail leaked; a suspected mass-authorization gap was tested and refuted.
- Outcome
- Hygiene defects fixed; access-control model confirmed sound.
HI, I'M PARTHA
Partha Bishwas – Offensive Application Security Engineer
Offensive Application Security Engineer
- 10+ Years
- 200+ Apps Tested
- 100+ Criticals Found
- Banking, FinTech, Govt, Telecom
Offensive security professional specializing in mobile, API, and web application security. Experienced in conducting full-scope VAPT, business logic testing, and secure architecture reviews for financial and enterprise systems. Passionate about breaking complex systems responsibly and strengthening security before attackers do.
Skills
SKILLS
Mobile
Security
Security
0%
Web
Security
Security
0%
Achievements
ACHIEVEMENTS
COORDINATED DISCLOSURE CHANNELS
Secure uplink required
Awaiting secure handshake...
Capabilities
CAPABILITIES
OFFENSIVE SECURITY WORKS
ACTIVE MODULES
Awaiting secure handshake...
WEB
APPLICATION
VAPT
APPLICATION
VAPT
Web Application VAPT
Executed comprehensive web application VAPT, including OWASP Top 10 and SANS Top 25 testing. Discovered critical access control flaws, insecure session handling, and misconfigured security headers, significantly improving the application's security posture.
MOBILE
APPLICATION
VAPT
APPLICATION
VAPT
Mobile Application VAPT
Conducted end-to-end mobile application VAPT covering authentication, authorization, insecure storage, reverse engineering, root/jailbreak bypass, and API abuse. Mapped findings against OWASP MASVS and OWASP Mobile Top 10, resulting in critical risk remediation before production release.
AI-AUGMENTED
OFFENSIVE
TESTING
OFFENSIVE
TESTING
AI-Augmented Offensive Testing
Run agent-assisted assessments where LLM workers handle recon correlation, bundle static analysis, and evidence capture under human direction, with every finding manually verified. Findings feed a structured pipeline that generates client-ready reports and retest deltas, cutting reporting time without lowering rigour.
API
SECURITY
ASSESSMENT
SECURITY
ASSESSMENT
API Security Assessment
Performed deep API security testing, including IDOR, privilege escalation, mass assignment, and business logic abuse on microfinance APIs. Identified high-impact authorization flaws affecting fund transfer and beneficiary management workflows.
BUG BOUNTY
&
DISCLOSURE
&
DISCLOSURE
Bug Bounty & Responsible Disclosure
Actively participated in private and public bug bounty programs. Reported multiple valid security issues through responsible disclosure channels, focusing on access control, data exposure, and authentication weaknesses.
Field Reports
FIELD REPORTS
OPERATIONS LOG
Career track · selected engagements, identities withheld under NDA
Decrypting case files...
- 2017 –Bug Bounty HunterPrivate & Public Programs
- 2018 – 2019Cyber Security ResearcherOrangeBD
- 2018 – 2021Founder & CTOInnerLoop
- 2021 – 2025Cyber Security EngineerDotlines Bangladesh Ltd.
- 2025 –Senior Security EngineerBRAC IT Services Ltd.
CEH v11 · EC-Council
M.Sc. Computer Science · Jahangirnagar University
B.Sc. CSE · BUBT
Admission & payment portal
- Findings
- Impact
- Server compromise and applicant data exposure; a prior third-party breach surfaced.
- Outcome
- Coordinated disclosure with remediation guidance.
Payroll & HR platform
- Findings
- Impact
- Duplicate bank payments and single-actor money movement with no second approver.
- Outcome
- Money-path controls rebuilt; verified on retest.
Document management portal
- Findings
- Impact
- Read-only user to admin in one call; whole repository readable without login.
- Outcome
- Server-side authorization enforced; bypass battery passed.
Sanitised to finding class and impact. No client, product, or system identifiers. Full reports available under NDA.
Arsenal
ARSENAL
PUBLIC TOOLING
Built from knowing what attackers leave behind
Repository online
Vestigium
Cross-platform live-response evidence collection for Linux and Windows.
Turns a live endpoint into a self-verifying evidence package: a timestamped evidence tree, provenance for every copied file, a SHA256 inventory, a JSON manifest, and one archive with its own hash sidecar. YARA scanning and offline IOC matching produce a single severity-ranked findings report for both platforms. Nothing is installed on the host, and nothing leaves it.
# stage once, on a machine with internet $ git clone https://github.com/parthabishwas/vestigium.git $ sudo ./vestigium.sh setup # on the host under investigation $ sudo ./vestigium.sh --case-id IR-2026-014 --output /media/evidence $ ./vestigium.sh verify /media/evidence/<host>_<ts>.tar.zstgithub.com/parthabishwas/vestigium