// About

Dilip Mallavarapu

Security Researcher  ·  M.S. Cybersecurity @ UAB
Jan 2025 – Dec 2026  ·  GPA 3.5

I research vulnerabilities in production software, open-source billing platforms, IoT firmware, and mobile payment SDKs, through manual source code review, binary analysis, and targeted exploitation. My work has produced 3 assigned CVEs and responsible disclosures accepted by Microsoft, Cisco, Western Union, and Mastercard. I approach each finding as a case study, understanding the root cause deeply enough to explain why the flaw exists, not just that it does.

I'm currently completing an M.S. in Cybersecurity at UAB, where my coursework has extended into adversarial robustness and prompt injection in large language models. I'm applying this year for PhD programs in systems and software security, and I'm also open to full-time security engineering and vulnerability research roles starting December 2026.

Email GitHub LinkedIn Bugcrowd Contact →
Research Interests

My research centers on finding and root-causing memory- and logic-level vulnerabilities in real deployed systems, then generalizing what I find into reusable methodology. Four areas I want to keep pushing on in a PhD:

01 Web Application Security
Source-code-review-driven vulnerability discovery in production web platforms, including injection, mass assignment, race conditions (TOCTOU), and authorization logic flaws. My FOSSBilling CVEs (RCE via config injection, promo-code race condition, mass assignment) are case studies in this space.
02 IoT & Embedded Firmware Security
Static binary analysis of ARM ELF firmware images to recover authentication logic, hidden endpoints, and no-auth code paths in physical access control and network devices, reversing compiled logic back into an exploitable model of the system.
03 Mobile & Payment SDK Security
Security analysis of mobile SDKs and payment integration libraries, examining how trust boundaries between client, SDK, and backend are (mis)enforced, motivated by disclosures to payment and financial infrastructure providers.
04 LLM & AI System Security
Adversarial robustness of LLM-integrated systems, including indirect prompt injection via tool/RAG outputs, jailbreak techniques, and empirical evaluation of guardrails and layered defenses. My Best Paper Award at DCS-CI'26 on prompt injection against LLM SOC copilots in industrial control systems is the anchor project in this space, and the direction I most want to extend in a PhD.
Publications & Awards
Indirect Prompt Injection Against LLM Copilots in Industrial Control Systems BEST PAPER
S. Shahid and D. Mallavarapu. DCS-CI'26 (International Conference on Design of Cyber Secure Critical Infrastructure).
→
Attack success rate up to 86.4% against LangChain-based SOC copilots, cut to 8.1% with a layered provenance/allowlisting/invariant-validation defense. Read the writeup or the full paper (PDF).
Vulnerability Research & Advisories

Findings below went through full responsible disclosure: private report, vendor fix, CVE assignment, then public advisory. Each is documented with root cause analysis, a working proof of concept, and a disclosure timeline.

CVE-2026-43921 HIGH
PHP Code Injection via Unescaped Config Serialization → RCE in FOSSBilling
→
CVE-2026-43925 MODERATE
Mass Assignment of group_id in FOSSBilling Guest Registration
→
CVE-2026-43927 MODERATE
TOCTOU Race Condition in FOSSBilling Cart Checkout
→
Four more findings (Akaunting RCE, InvoiceNinja SSRF, and two in Graylog covering an SSRF and a Beats input DoS) are in progress toward CVE assignment, see the full CVE list.
Bug Bounty & Responsible Disclosure
Microsoft — Stored HTML injection, MSRC Case 101912 (Sep 2025)
Western Union — Sensitive data exposure via ServiceNow instance, P3 Bugcrowd (Jul 2024)
Cisco — Reflected XSS via return_url parameter, P3 Bugcrowd VDP (Jan 2024)
Cisco — Exposed admin panel with default credentials, P4 (Jan 2025)
Mastercard — Open redirect in customer portal login, P4 Bugcrowd (Jan 2025)
Experience
Security Researcher Intern
Appsecrew
Web application penetration testing, vulnerability assessment, and detailed security report writing for enterprise clients. Conducted assessments covering OWASP Top 10, business logic vulnerabilities, and API security across client-facing production applications.
Aug 2024 – Dec 2024
Security Engineer & Researcher
Freelance / Bug Bounty
Independent vulnerability research across open-source billing software, IoT firmware, and mobile payment SDKs. Responsible disclosure to Cisco, Microsoft, Western Union, Mastercard, and government targets. Awarded 3 CVEs through GitHub's CNA for original vulnerability research in FOSSBilling.
Mar 2022 – Present
Education
M.S. Cybersecurity — University of Alabama at Birmingham
Jan 2025 – Dec 2026
GPA 3.5. Coursework: Network Security, Cryptography, Malware Analysis, Digital Forensics, LLM Security Research.
B.Tech Computer Science — JNTU Hyderabad
Jan 2020 – Jul 2024
GPA 7.0/10. Core CS fundamentals, networking, algorithms, and software engineering.
Skills & Tools
Offensive Security
  • Web Application Pentesting
  • Source Code Review
  • Binary Analysis (ARM ELF)
  • Mobile SDK Analysis
  • Race Condition Testing
  • OSINT Automation
Tools
  • Burp Suite Pro
  • Ghidra / Binary Ninja
  • Nmap / ZGrab2
  • Metasploit
  • Wireshark
  • Docker
Languages
  • Python (exploit dev)
  • PHP (source review)
  • Bash scripting
  • Kotlin (Android)
  • SQL
Platforms
  • Linux / Kali
  • AWS / GCP
  • Azure AD
  • IoT / Embedded
  • Windows Server AD