Protecting the digital world, one lab at a time.
Pasindu Sandeepa. Junior Researcher specializing in Penetration Testing and Network Defense. Based in Sri Lanka.
A self taught with a lot of interest in Cyber Security
Hi, I am Pasindu, a 2nd year Computer Science undergraduate at Eastern University Sri Lanka. My interest has always been in Cyber Security. I want to ensure that security is a top priority within our quickly developing world and would like to contribute to a more secure environment.
I like to keep myself relevant by solving Capture The Flags on HackTheBox and working through PortSwigger Web Security Academy labs - publishing 250+ detailed writeups along the way. I also build open-source security tools like an XSS Scanner and an HTTP Request Smuggling Detector to sharpen my practical skills.
I would like to improve myself within the Cyber Security field in order to become a professional Penetration Tester. I always keep a close eye on newly discovered vulnerabilities and like to challenge myself with unsolved weaknesses. I am someone who wants to make the world a more secure place, even if it goes unnoticed.
Driven by Curiosity, Proven by Labs.
I focus on turning complex security theory into hands-on execution. My approach is simple: detect, exploit, report, and defend.
Stats
Case Studies & Tools
Context-Aware XSS Scanner
Custom Python tool for automated, low-false-positive XSS detection.
- Problem: Generic XSS scanners flag reflections that never actually execute.
- Action: Built a scanner using raw TCP/SSL sockets with separate payload logic for HTML, attribute, JS, DOM, and AngularJS contexts.
- Outcome: Confirms exploitability in a real browser before reporting — cutting false positives significantly.
HTTP Request Smuggling Detector
Identifying CL.TE / TE.CL desync vulnerabilities at the raw request level.
- Problem: Standard HTTP libraries auto-normalize malformed headers, making desync attacks impossible to craft.
- Action: Built a raw-socket tool to send deliberately malformed CL.TE, TE.CL, TE.TE, and CL.0 requests.
- Outcome: Detects front-end/back-end parsing disagreements that standard scanners miss entirely.
Windows PhishGuard & Log Analyzer
Open-source Python utilities built for real-time security monitoring.
- Problem: Manual analysis of email threats and brute-force login attempts is time-consuming.
- Action: Developed a phishing detection engine analyzing email headers and a log ingestion tool for pattern matching and anomaly detection.
- Outcome: Automated threat alerting and structural analysis of malicious payloads.
Vulnerability Research
OWASP Top 10, SQL/NoSQL Injection, XSS, SSRF, Authentication Bypass, CSRF, IDOR, HTTP Request Smuggling.
Offensive Tools
Burp Suite, Nmap, RustScan, Metasploit, Wireshark, SQLMap, Hashcat, John the Ripper, Nuclei.
Development & Scripting
Python, Bash Shell Scripting, Java, Git, GitHub, Quartz V4.
Systems & Platforms
Kali Linux, Ubuntu, HackTheBox, TryHackMe, PortSwigger, Bugcrowd, HackerOne.
Get In Touch
I am currently open to new opportunities, particularly in penetration testing, vulnerability research, and security engineering roles. Whether you have a question about my writeups or want to discuss a potential project, feel free to reach out!
dilharawijesinghe86@gmail.com
Sri Lanka