Open to opportunities

Rojan Shrestha

@rojanshrestha4

Message

I uncover web application vulnerabilities and validate SIEM detection through adversarial testing.

Nepal

Message

What I'm looking for

I'm looking to grow in penetration testing and offensive security, performing hands-on web application assessments, documenting impactful findings, and validating detection coverage through adversarial attack simulation.

I've tested web applications at Xelvian Solutions and Cryptogen Nepal, uncovering SQL Injection, XSS, broken authentication, CSRF, command injection, and file inclusion vulnerabilities. My work includes clear proof-of-concept evidence, CVSS v3.1 ratings, and remediation guidance for development teams.

At Xelvian Solutions, I simulated privilege-escalation and unauthorized-access attack chains in staging environments, validated SIEM detection coverage, and helped reduce open security issues by approximately 40%.

I'm a Cyber Security undergraduate on the Dean's List with a 3.70 GPA, a Cisco Certified Ethical Hacker, and a CTF competition second-place finisher. I also build hands-on labs with Wazuh, OSSEC, Kali Linux, Burp Suite, Metasploit, and DVWA to strengthen offensive testing and detection validation skills.

Experience

Work history, roles, and key accomplishments

Offensive Security Intern

Xelvian Solutions Pvt. Ltd.

Jan 2026 - Jun 2026 (5 months)

Identified SQL Injection, Reflected XSS, and Broken Authentication vulnerabilities across 3+ web modules through manual black-box testing and automated scanning. Simulated privilege escalation and unauthorized access attack chains against staging environments, validating SIEM detection rule coverage and reducing open security issues by ~40%.

SQL Injection XSS OWASP ZAP Nikto Gobuster Black Box Testing SIEM Wazuh Ossec

Penetration Testing Intern

Cryptogen Nepal

Jun 2025 - Nov 2025 (5 months)

Exploited SQL Injection, Stored/Reflected XSS, CSRF, Command Injection, File Inclusion, and Broken Authentication across 5+ production web applications; demonstrated unauthorized database access and persistent script injection to illustrate real-world business impact. Authored 3+ penetration test reports with CVSS v3.1 ratings, step-by-step exploit reproduction, PoC evidence, and prioritized remed

SQL Injection XSS CSRF Command Injection File Inclusion CVSS Penetration Testing Reporting