Protecting the digital world, one lab at a time.
Pasindu Sandeepa. Junior Researcher specializing in Penetration Testing and Network Defense. Based in Sri Lanka.
A self taught with a lot of interest in Cyber Security
Hi, I am Pasindu, a 2nd year Computer Science undergraduate at Eastern University Sri Lanka, based in Kandy. My interest has always been in Cyber Security. I want to ensure that security is a top priority within our quickly developing world and would like to contribute to a more secure environment.
I like to keep myself relevant by solving Capture The Flags on HackTheBox and working through PortSwigger Web Security Academy labs — publishing 250+ detailed writeups along the way. I also build open-source security tools like an XSS Scanner and an HTTP Request Smuggling Detector to sharpen my practical skills.
I would like to improve myself within the Cyber Security field in order to become a professional Penetration Tester. I always keep a close eye on newly discovered vulnerabilities and like to challenge myself with unsolved weaknesses. I am someone who wants to make the world a more secure place, even if it goes unnoticed.
Driven by Curiosity, Proven by Labs.
I focus on turning complex security theory into hands-on execution. My approach is simple: detect, exploit, report, and defend.
Stats
Case Studies
Context-Aware XSS Scanner
Custom Python tool for automated, low-false-positive XSS detection.
- Problem: Generic XSS scanners flag reflections that never actually execute.
- Action: Built a scanner using raw TCP/SSL sockets with separate payload logic for HTML, attribute, JS, DOM, and AngularJS contexts, verified via Playwright.
- Outcome: Confirms exploitability in a real browser before reporting — cutting false positives significantly.
HTTP Request Smuggling Detector
Identifying CL.TE / TE.CL desync vulnerabilities at the raw request level.
- Problem: Standard HTTP libraries auto-normalize malformed headers, making desync attacks impossible to craft.
- Action: Built a raw-socket tool to send deliberately malformed CL.TE, TE.CL, TE.TE, and CL.0 requests.
- Outcome: Detects front-end/back-end parsing disagreements that standard scanners miss entirely.
Web App Pentesting
SQL/NoSQL Injection, XSS, CSRF, IDOR, HTTP Request Smuggling, Nmap Scripting (NSE), Burp Suite.
Network & Recon
Traffic Analysis (Wireshark), Nuclei, Service Enumeration, Vulnerability Reporting.