classSuraj:
name="Suraj Gupta"alias="0xmr"role="Pentester & Cloud Security Engineer"domains= ["Web", "Active Directory", "AWS", "AI/LLM"]
language= ["Python", "Bash"]
defmission(self):
return"Find it before the bad guys do."- 🔭 Currently pentesting Web, AD, AWS & AI/LLM
- 🌱 Deep-diving AWS Security, AI/LLM attacks, Web Advanced
- 🐛 Disclosed IDOR vulns, exposed S3 buckets, Grok/Kimi findings
- 📖 Personal cheatsheet & notes → 0xmr.qzz.io
- 🤝 Open to collaborate → github.com/0xmrsecurity
| # | Vulnerability | Target | Impact |
|---|---|---|---|
| 🔓 | IDOR × 2 | Live Production Systems | Unauthorized data access exposed |
| 🪣 | Exposed S3 Bucket | Live Production | Sensitive data publicly accessible |
| 💉 | Command Injection | Grok AI (via Chatbot) | Remote command execution vector |
| 📤 | System Prompt Extraction | Kimi AI (Chinese LLM) | Full system prompt leaked |
Languages
Pentesting Tools
Cloud & OS
Netspray:- NetSpray is a wrapper script designed to save time when performing password or hash spraying across multiple protocols. It leverages the power of NetExec to automate the process efficiently.
Usage: NetSpray <protocols|all><targets|subnet> -u <username> [-p <password>| -H <hash>] [OPTIONS]Scrad:- This tool finds hidden endpoints across the entire website using js.
Usage Ready to use from brower, just click on scrad bookmark and it will open a new page with in a 2 seconds.Public POC (Proof of Concepts):- list of public Exploit in python and bash languages.
Pentesting Notes
"Certifications are expensive. Skills are not. Here's the proof of work."
🏫 Cybrary — Offensive Penetration Testing | ⚔️ TryHackMe — Offensive Pentesting Path |
☁️ AWS Security ███████████ Deep dive: IAM escalation, Lambda abuse, EC2 , S3 etc.
🤖 AI/LLM Security ███████████ Prompt injection, model extraction, System Prompt Extract and Jail Break. 🌐 Web Advanced ████████ OAuth/OTP, SSRF chains, LFI, Command Injection.
"The quieter you become, the more you are able to hear."
