Rohan Rajendra Deshmukh

Offensive Security Researcher · Red Team Enthusiast · VAPT & Web Exploitation

I am an offensive security researcher specializing in web application penetration testing, web exploitation, and red team operations. My work centers on enumerating attack surfaces, identifying vulnerabilities, and demonstrating realistic exploitation and privilege escalation paths across Linux and web environments.

I hold the eJPT (eLearnSecurity Junior Penetration Tester) certification, rank in the top 1% globally on TryHackMe, and was selected as an Associate System Engineer at TCS through HackQuest Season 10, a national-level CTF competition, after clearing multiple rounds of offensive security challenges.

My hands-on learning is built through CTFs, Boot2Root labs, and vulnerable web applications on TryHackMe and Hack The Box, where I consistently practice the full attack lifecycle — from reconnaissance to post-exploitation.

"Hack the system, not the ethics."

Hands-on practice across TryHackMe rooms and CTF/Boot2Root environments, covering:

• SUID / SGID abuse
• Linux capabilities
• Sudo misconfigurations
• Cron job exploitation
• Writable files & directories
• PATH hijacking
• Weak file permissions
• Service & process enumeration
• Kernel / software enumeration
• Credential discovery
• LinPEAS-assisted and manual privilege escalation

Typical attack path:

Initial Access → Enumeration → Identify Weakness → Exploit
Misconfiguration → Privilege Escalation → Root → Post-Exploitation

Web security and exploitation is my primary area of focus — identifying and exploiting vulnerabilities in real and intentionally vulnerable applications through structured VAPT methodology.

Areas of Practice: Authentication & Authorization Flaws · SQL Injection · Command Injection · Local & Remote File Inclusion · File Upload Vulnerabilities · Path Traversal · SSRF · XSS · IDOR · Session Vulnerabilities · API Security · Information Disclosure · Directory Fuzzing & Web Enumeration

Tools: Burp Suite · Nmap · Gobuster · FFUF · SQLMap · Nikto · Netcat

My long-term goal is to build a career in Offensive Security, Penetration Testing, and Red Teaming, with focus on the complete attack lifecycle:

Reconnaissance → Enumeration → Initial Access → Exploitation →
Privilege Escalation → Credential Access → Lateral Movement → Post-Exploitation

Currently strengthening practical fundamentals before advancing into Active Directory attacks and deeper red team tradecraft.

A wireless security research project focused on detecting rogue access points and identifying Evil Twin attacks using RSSI analysis, encryption classification, and machine learning.

Published Research: AirFence: IoT-Based Wireless Threat Detection and Evil Twin Identification Using ESP32 and Machine Learning — IJIRT

Tech: ESP32 · Python · Django · scikit-learn · pandas

An automated attendance system built with RFID and ESP32, integrated with a Django backend for session-based tracking and data synchronization.

Tech: ESP32 · PN532 · Python · Django

Hands-on Areas: Web Application Exploitation · Linux Privilege Escalation · Network & Service Enumeration · Authentication Attacks · Vulnerability Discovery · File Upload & Command Injection · SQL Injection · Post-Exploitation · Boot2Root Challenges

eLearnSecurity Junior Penetration Tester (eJPT) Score: 83% · Passed on First Attempt Enumeration · Web Attacks · Exploitation · Pivoting · Networking

Web Security → Network Security → Linux / Windows Security →
Privilege Escalation → Active Directory → Post-Exploitation → Red Team Operations

I aim to become a practitioner capable of enumerating an environment end-to-end, identifying its weaknesses, exploiting vulnerabilities responsibly, and demonstrating realistic attack paths — while upholding strong ethical and professional standards.

Discord: rdx04_09553

Offensive Security • Web Security • Linux • Red Teaming

Building. Breaking. Learning. Repeating.