Open to VAPT & Security Roles

Mursalin
Molla

Bug bounty hunter & VAPT specialist. I break things to secure them — OWASP Top 10, network pentesting, and offensive security.

Get in touch → View projects
Mursalin Molla — Cybersecurity Professional
Profile

Breaking things
to secure them

Bug bounty hunter and VAPT specialist with hands-on experience in web and network penetration testing.

I'm a bug bounty hunter and aspiring VAPT professional skilled in web/network pentesting (OWASP Top 10), Burp Suite, and Nmap — sharpened through CTFs on HTB & TryHackMe.

I responsibly disclosed an info disclosure vulnerability in Grammarly and am currently preparing for OSCP while learning AWS & AI Security, with a goal of becoming a strong VAPT professional.

150+
CTFs Solved
Skilled
HTB Global Rank
Top 8%
TryHackMe Worldwide
1+
Responsible Disclosure
Expertise

My arsenal

Tools and technologies I use daily for offensive security, recon, and exploitation.

Burp Suite Pro
Nmap
Metasploit
BloodHound
Wireshark
SQLMap
FFUF
Amass
Nikto
LinPEAS
WinPEAS
Hashcat
John the Ripper
Python
Bash
Kali Linux
OWASP Top 10
⚡Active Directory
Docker
Git
Postman
VS Code
Linux
Shodan
Credentials

Certifications & training

🎓
Career Essentials
LinkedIn & Microsoft
🔴
OSCP
In Progress
☁️
AWS Associate
Learning
🛡️
AI Security
Exploring
Career

My experience

Jul 2026 – Present · 1 mo
CyberSecurity Engineer
WebAsha Technologies · Full-time · Pune City, Maharashtra, India · On-site
  • Internet Security
  • Security Implementation
  • Vulnerability assessment and penetration testing of web applications and networks
  • Collaborating with security teams to identify and remediate critical vulnerabilities
09/2025 – 03/2026
Security Analyst Intern
Craw Cyber Security · New Delhi
  • Worked on multiple real-world cybersecurity projects, delivering results within deadlines
  • Hands-on threat analysis, vulnerability assessment, and security monitoring
  • Assisted in identifying and mitigating security risks across systems and networks
  • Collaborated with senior analysts to strengthen organizational security posture
Ongoing
Independent Security Researcher
HackerOne & Intigriti · Bug Bounty
  • Responsible disclosure of information disclosure vulnerability in Grammarly
  • Active BAC hunting on Intigriti — focused on IDOR and privilege escalation
  • Recon and active testing on Telenor Sverige AB and European SaaS programs
  • All writeups and CVE analyses published on GitHub
Apr 2026 – Present · 4 mos
Root With Mursalin
YouTube Channel · Part-time
  • Educational content on pentesting, CTF walkthroughs, and tool demos
  • Sharing real-world bug bounty methodology and offensive security techniques
  • Research updates and CVE breakdowns published on GitHub
Writeups

CTF Walkthroughs

Detailed step-by-step walkthroughs of HackTheBox machines and real-world vulnerabilities I've researched.

HTB Walkthrough Thumbnail YouTube
HTB Walkthrough

Step-by-step exploitation and flag capture.

Watch on YouTube →
HTB Walkthrough Thumbnail YouTube
HTB Walkthrough

Detailed methodology and techniques.

Watch on YouTube →
HTB Walkthrough Thumbnail YouTube
HTB Walkthrough

Initial reconnaissance, exploitation, and post-exploitation.

Watch on YouTube →
HTB Walkthrough Thumbnail YouTube
HTB Walkthrough

Real-time problem-solving and explanation.

Watch on YouTube →
HTB Walkthrough Thumbnail YouTube
HTB Walkthrough

Vulnerability discovery and privilege escalation.

Watch on YouTube →
📂 More
Want More Walkthroughs?

Explore the full collection of CTF walkthroughs, live sessions, and writeups on my YouTube channel and GitHub.

Work

Projects & tools

Open-source offensive security tools built to automate real-world vulnerability discovery. Watch the demos below to see them in action.

▶️
Video unavailable to embed
Watch on YouTube →
OWASP A01:2021
BAC Hunter v3
Broken Access Control Testing Suite · Python

Automates 19 BAC test cases — IDOR, JWT bypass, HTTP verb tampering, mass assignment. Stealth mode + Burp Suite proxy + severity JSON reports.

PythonIDORJWTBurp Suite
View on GitHub → Watch Demo →
▶️
Video unavailable to embed
Watch on YouTube →
OWASP A10
SSRF Killer
Exploit Framework · Python

300+ bypass payloads, header injection across 50+ headers, multi-vector detection — error-based, time-based, OOB — and internal port scanning.

PythonSSRFOOB300+ Payloads
View on GitHub → Watch Demo →
▶️
Video unavailable to embed
Watch on YouTube →
Recon
WebScout
Web Technology Scanner · Python

Fingerprints 30+ web technologies, cross-references CVE databases, and audits HTTP security headers with severity-tagged HTML/JSON findings.

PythonCVE DBOSINTHTML Reports
View on GitHub → Watch Demo →
📡 Demo coming soon
Network
Network Scanner
Enumeration Tool · Python

Nmap-based host discovery and port scanning with HTML/JSON security reports, service version detection, and OS fingerprinting for pentest scoping.

PythonNmapHost DiscoveryJSON
View on GitHub →
Numbers

Stats that count

150+
CTF Challenges Solved
Skilled
HackTheBox Global Rank
Top 8%
TryHackMe Worldwide
4+
Open Source Tools
1+
Responsible Disclosure
19
BAC Test Cases Automated
Let's Talk

Let's work together

Open to Junior Penetration Tester, VAPT Analyst, Security Analyst, and Red Team Intern roles — India-based and remote global.

workmursalin@gmail.com
LinkedIn GitHub YouTube 📄 View CV