Skip to content
Subz3r0x01
Parth Padhiyar / Subz3r0x01

Offensive security.Real-world impact.

Senior Consultant at EY, specializing in VAPT, red teaming, and security research.

I find the weaknesses that matter, validate the impact, and build practical tools to help teams secure their systems.

Let’s talk View resume Selected work

Open to full-time cybersecurity opportunities worldwide, including international relocation.

researcher@subz3r0x01

$ whoami

Parth Padhiyar

offensive security / security engineering

$ cat focus.txt

webapimobileinfrastructurecloudred teamingresearchautomationai

$ cat principles.txt

Manual validation.
Meaningful impact.
Actionable remediation.

researching · building · breaking
Years in VAPT / Red Teaming
5+
Security assessments delivered (EY + iAppSecure, DAST/SAST/IAST)
750+
Unique findings reported — employer engagements + freelance
3000+
Public CVEs — real vulnerabilities, not lab exercises
3
Security analysts trained and mentored
25+
Industries served — finance, government, and more
8+
Faster assessment delivery using AI-assisted workflows
~40%
01 / SELECTED WORK

Security problems. Practical tools.

Tools I build to make discovery, validation, and reporting more useful. Explore the source, the problem, and why it matters.

ACTIVE

SharePointDirBuster

Custom script that identifies anonymous page access in Microsoft SharePoint deployments.

WHY IT MATTERS

Used in real engagements to identify access control gaps in SharePoint configurations.

Problem & approach
Problem
SharePoint sites commonly leak anonymously-accessible pages through misconfigured permissions, and manual enumeration doesn't scale.
Approach
Automated directory/page enumeration against SharePoint sites to surface anonymous-access exposure for follow-up manual validation.
Python
View source
ACTIVE

PenTest Report Generator

AI-powered penetration testing report generator with evidence handling, multiple input modes, and multi-format export.

WHY IT MATTERS

Cuts down reporting time while keeping findings structured and consistent.

Problem & approach
Problem
Writing up findings into a client-ready report is one of the most time-consuming parts of an engagement.
Approach
Structured finding capture (text, dictation, or detailed form) with AI-assisted drafting and export to common report formats.
JavaScriptNode.js
View source
ACTIVE

PyServeX

Zero-config, pure-Python LAN file server — no accounts, no database, no Docker. Published on PyPI.

WHY IT MATTERS

Secure-by-default posture: LAN devices connect freely, anything external must authenticate.

Problem & approach
Problem
Sharing a folder over a LAN usually means spinning up more infrastructure than the task deserves.
Approach
A single Python process serves a folder with QR-code pairing, authentication for anything outside the LAN, and optional SFTP/tunnel extras.
Python
View source Package on PyPI
ACTIVE

llama.cpp.Fuzz

AFL-based fuzzing setup for llama.cpp.

WHY IT MATTERS

Applies classic fuzzing to AI inference infrastructure — reverse engineering / AI security crossover.

Problem & approach
Problem
Memory-safety bugs in widely-used LLM inference engines are worth hunting for, but AFL setup for a project like llama.cpp has real friction.
Approach
Scripted, interactive setup for AFL fuzzing against llama.cpp, including model selection.
ShellAFL
View source
More from the workbench — private, in active development

Valkyrie, Valxcan, and Burp Proxy Viewer are private tools under active development, live-verified against real targets rather than just code-reviewed. Kept separate from the published, source-visible tools above.

ACTIVE

Valkyrie

Self-hosted VAPT orchestration platform (private, active development) — full assessment lifecycle from intake through findings, evidence, and client reporting, with built-in RBAC and multi-tenant support. Running as a live internal deployment.

WHY IT MATTERS

Used to run and track real engagements, not just a demo shell.

Problem & approach
Problem
Commercial vulnerability-management platforms (Archer, ServiceNow VR, Kenna-style tools) are expensive and heavyweight for running an in-house VAPT practice.
Approach
A self-hosted alternative covering the assessment workflow end to end — intake, assignment, execution, findings, evidence storage, and PDF/executive reporting.
TypeScriptAIAutomation
ACTIVE

Valxcan

AI-driven VAPT scanning engine behind Valkyrie (private, active development) — four scanner types (mobile, API, network, and an agentic AI-VAPT path), live-verified against real targets, not just code-reviewed.

WHY IT MATTERS

Gives a usable result immediately, with manual validation still the final word on anything the AI pass flags.

Problem & approach
Problem
Full manual VAPT on an API/app surface takes real engagement time before a client sees a first result.
Approach
An instant interim pass flags known CVEs/CWEs, with a deeper AI-driven assessment pass available on top (roughly 1 hour per 25 APIs, depending on the model used) aiming for close to full VAPT-equivalent coverage.
AIAPI SecurityAutomation
ACTIVE

AI-Based API Security Testing

Private, unnamed tool (not yet published) — AI-driven API security testing, live-verified against real targets. Model-agnostic: works with hosted LLM API providers or an offline/local LLM for clients with data-protection requirements.

WHY IT MATTERS

Separate from Valxcan — a distinct tool, not one of its four scanner types.

Problem & approach
Problem
Full manual API security testing takes real engagement time before a client sees a first result, and some clients can't send data to a third-party LLM API.
Approach
AI-driven testing against real API targets, with the LLM backend swappable between hosted providers and a self-hosted/offline model so sensitive-data clients never need to leave their own environment.
AIAPI SecurityAutomation
ACTIVE

Automated Mobile Penetration Testing Pipeline

Private, unnamed tool (not yet published) — automated end-to-end mobile VAPT pipeline covering Android and iOS applications, live-verified against real targets. Model-agnostic: hosted LLM API providers or an offline/local LLM.

WHY IT MATTERS

Separate from Valxcan — a distinct tool, not one of its four scanner types.

Problem & approach
Problem
Manual mobile VAPT (Android/iOS) is time-consuming per engagement.
Approach
An automated pipeline that runs the mobile assessment workflow end to end against real applications.
AIMobile SecurityAutomation
ACTIVE

Agentic Web VAPT

Private, unnamed tool (not yet published) — automated web application VAPT driven by AI agents, live-verified against real targets. Model-agnostic: hosted LLM API providers or an offline/local LLM.

WHY IT MATTERS

Separate from Valxcan — a distinct tool, not one of its four scanner types.

Problem & approach
Problem
Manual web-application VAPT doesn't scale to cover every engagement's full surface quickly.
Approach
AI agents drive automated web VAPT against real targets, with a swappable hosted/offline LLM backend.
AIAutomation
ACTIVE

Burp Proxy Viewer

Exports Burp Suite proxy traffic into Postman collections, plus a 13-scanner security dashboard (JWT analysis, header/CORS checks, CVE correlation, SSL/TLS scanning, and more) with AI-assisted analysis.

WHY IT MATTERS

Speeds up the recon-to-testing handoff and catches common misconfigurations automatically.

Problem & approach
Problem
Burp Suite captures everything, but turning that traffic into a usable Postman collection or a quick security read is manual.
Approach
A companion Burp extension streams captured traffic to a REST API; this tool turns it into deduplicated Postman collections and runs a suite of automated checks against it.
Python
02 / PUBLISHED RESEARCH

Findings you can verify.

Three disclosed vulnerabilities in production frameworks. Read the technical analysis, or go straight to the public record.

All published research
03 / EXPERIENCE

From findings to better defenses.

5+ years delivering enterprise-grade VAPT across web, API, mobile, cloud, network, and source code. Currently at EY, working on penetration testing engagements, testing methodology, technical reviews, and executive reporting.

Actively researching and building AI-driven automation across development, security, and compliance workflows.

Continuous learning

OSCP — in progress

  1. Sep 2026 — Present

    Senior Consultant

    EY

  2. Apr 2025 — Sep 2026

    Consultant

    EY

  3. Jun 2021 — Mar 2025

    Senior Security Analyst / Researcher / Consultant

    iAppSecure Solutions Pvt. Ltd.

  4. Jun 2018 — Jun 2021

    IT Manager

    The South International School

04 / LET’S CONNECT

Have a role or a security challenge in mind?

Open to full-time cybersecurity opportunities worldwide, including international relocation.

parthpadhiyar0x01@gmail.com
LinkedIn GitHub Resume (PDF)

05 / UNDER THE HOOD

The technical details

Explore my background, security practice, and the environments where I keep learning.

Background, education & availability
A / BACKGROUND

About

Parth Padhiyar — Senior Consultant, EY

5+ years delivering enterprise-grade VAPT across web, API, mobile, cloud, network, and source code. Currently at EY, working on penetration testing engagements, testing methodology, technical reviews, and executive reporting.

Published security researcher with 3 CVEs identified in production frameworks (Silverpeas CMS, Oqtane). OSCP in progress.

Actively researching and building AI-driven automation across development, security, and compliance workflows.

Security is the job and the hobby — freelance engagements and off-hours research run alongside full-time work, not instead of it.

operating between
Offensive Security
↕
Engineering
↕
Automation
↕
AI
B / EDUCATION

Education

M.Sc. Cyber Security
National Forensic Sciences University
Jul 2019 — Jun 2021
BCA
Govt. BCA College, Gujarat University
Jul 2015 — Jul 2018
C / AVAILABILITY

Availability

Open to full-time cybersecurity opportunities worldwide, including international relocation.

Available for freelance security consulting engagements.

Prior engagements span sectors below. Client names are not disclosed due to NDA.

  • UAE-based financial institution
  • Indian stock exchange institution
  • Gujarat Government

Industries served (job + freelance)

NGOsGovernmentAutomotiveStock ExchangeOil & GasForeign BanksCMS PlatformsConsumer Support
Capabilities, methodology & AI security
A / CAPABILITIES

Security Expertise

Web Application Security

  • OWASP Top 10
  • Authentication
  • Authorization
  • Session management
  • Business logic
  • SSRF
  • SQLi
  • XSS
  • API security
  • File upload
  • Deserialization
  • Access control
  • Race conditions

API Security

  • REST
  • GraphQL
  • OAuth
  • JWT
  • API authorization
  • Object-level authorization
  • Rate limiting
  • Business logic
  • API fuzzing

Mobile Security

  • Android
  • iOS
  • Static analysis
  • Dynamic analysis
  • Runtime instrumentation
  • Frida
  • SSL pinning analysis
  • Root/jailbreak detection
  • Secure storage
  • IPC
  • Reverse engineering

Network / Infrastructure

  • External attack surface
  • Internal networks
  • Active Directory
  • Privilege escalation
  • Lateral movement
  • Network segmentation
  • Configuration review

Cloud Security

  • IAM
  • Storage
  • Network configuration
  • Secrets
  • Containers
  • Cloud misconfiguration
  • Attack paths

Red Teaming

  • Reconnaissance
  • Initial access
  • Execution
  • Persistence
  • Privilege escalation
  • Lateral movement
  • Command & control
  • Detection evasion
  • Attack simulation

Tools

Burp SuiteNessusQualysHCL AppScanVMDRNucleiSubfinderhttpxKatanaSQLMapffufTruffleHogGitleaksFridaMobSFHTTP ToolkitCheckmarxVeracodeJenkinsGitLab CIGitHub ActionsDockerGitPythonPowerShellLinux
B / METHODOLOGY

Security Methodology

RECON
↓
ENUMERATION
↓
ATTACK SURFACE
↓
EXPLOITATION
↓
PRIVILEGE ESCALATION
↓
LATERAL MOVEMENT
↓
IMPACT
↓
REMEDIATION

"Manual validation over scanner output."

Tools accelerate discovery. Every finding is validated manually before it is reported.

C / AI

AI × Offensive Security

  • Automated reconnaissance analysis
  • Vulnerability triage
  • Source-code analysis
  • Finding correlation
  • Report generation
  • Attack-path reasoning
  • Payload generation assistance
  • Security test-case generation
  • Reverse engineering assistance
  • Large-scale vulnerability analysis
  • Security automation agents
Human Researcher
+
Security Tools
+
AI Reasoning
↓
Security Automation
↓
Faster Research
↓
Better Coverage
Research labs & interactive terminal
A / LABS

Labs

LAB-01ACTIVE

Mobile Security

Static/dynamic analysis workflows for Android and iOS apps.

Live, self-hosted MobSF instance. Login required.

FridajadxMobSF
open lab
LAB-02ACTIVE

Web / API

Business logic and API authorization testing playground.

OWASP Juice Shop deployed for hands-on web/API practice. A CyberChef instance also runs on this infra but is temporarily unreachable.

Burp SuiteffufOWASP Juice Shop
open lab
LAB-03RESEARCH

Active Directory

AD attack path and privilege escalation practice environment.

No public instance yet.

ImpacketBloodHound
LAB-04EXPERIMENTAL

Cloud

Cloud misconfiguration and IAM attack path research.

No public instance yet.

AWSAzure
LAB-05EXPERIMENTAL

Reverse Engineering

Binary and mobile reverse engineering practice.

No public instance yet.

GhidrajadxAFL
LAB-06RESEARCH

AI Security

AI-assisted triage and reasoning workflows for security research.

No public instance yet.

LLM APIsPython

Prefer the command line? Explore this portfolio with a few familiar commands.

Type 'help' to get started.
$
Subz3r0x01