Dilip Mallavarapu
I find vulnerabilities in open-source web applications, billing platforms, IoT firmware, and mobile SDKs, through careful source code review, binary analysis, and targeted security testing. My work doesn't stop at finding a bug, I trace each one back to its root cause, build a working exploit to prove real impact, and write it up clearly enough for a vendor to fix it fast. That process has produced 3 assigned CVEs and responsible disclosures accepted by Microsoft, Cisco, Western Union, and Mastercard. Open to PhD research positions and full-time security engineering roles starting December 2026.
Symmetric file encryption utility with recursive directory traversal. Implements AES-256 in four modes (CBC/CTR/OFB/CFB) and ChaCha20 with per-file IV randomization. Ships both a Python CLI for batch operations and a zero-dependency browser GUI built on the WebCrypto API, drag-and-drop, no server required.
View on GitHub →Python automation pipeline that ingests an organization name or ASN and outputs a workflow diagram of all associated IPs, domains, netblocks, and infrastructure relationships. Integrates BGP ASN data, passive DNS, and certificate transparency logs for OSINT-driven attack surface enumeration, designed for recon at scale.
Peer-reviewed research on indirect prompt injection against LLM SOC copilots in industrial control systems, published and awarded Best Paper at DCS-CI'26. Built a full testbed (SWaT + OpenPLC), an attack generator across three channels, and a layered defense that cuts attack success rate from 68.8% to 8.1%.
Read the writeup →Static analysis and reverse engineering of router, camera, and BMC firmware, plus the tooling behind it. Numbers come from binaries I unpacked and measured, not from vendor claims.
Measured stack canary coverage across three OpenWrt 23.05 architectures. Protection is on by default (74 to 80 percent), and the same core packages opt out on every build. Includes the measurement bug that made an earlier pass read zero.
Read the study →A firmware scanner whose confirmed findings carry a proof you can re-check offline, and which reports present, absent, or unknown rather than reporting a mitigation as missing when it could not read it.
Read →Device firmware research across a Hikvision access terminal (reported to HSRC), an OpenBMC finding under coordinated disclosure, and an ongoing QNAP QTS review. Details on the firmware page.
View all →- Web Application Pentesting
- Source Code Review
- Binary Analysis (ARM ELF)
- Mobile SDK Analysis
- Race Condition Testing
- OSINT Automation
- Burp Suite Pro
- Ghidra / Binary Ninja
- Nmap / ZGrab2
- Metasploit
- Wireshark
- Docker
- Python (exploit dev)
- PHP (source review)
- Bash scripting
- Kotlin (Android)
- SQL
- Linux / Kali
- AWS / GCP
- Azure AD
- IoT / Embedded
- Windows Server AD