AJMAL Shan

Application Security Analyst with 2 years of hands-on industry experience, specializing in identifying and exploiting vulnerabilities across web, mobile (Android & iOS), and API environments. I have performed security assessments on 50+ applications through both onsite and remote engagements, covering diverse architectures and real-world attack surfaces. My experience includes direct client interaction, handling technical discussions, reporting findings, and communicating remediation strategies effectively with stakeholders. I focus on offensive security testing with an emphasis on authentication and authorization mechanisms, API security, and OWASP Top 10 vulnerabilities, prioritizing real-world exploitability over theoretical findings. My work involves simulating adversarial behavior to uncover high-impact issues such as IDOR, broken authentication, insecure API endpoints, and input validation flaws. I actively use tools like Burp Suite for traffic interception and manipulation, Nmap for network reconnaissance, and Frida for dynamic mobile analysis. In addition to VAPT, I have foundational exposure to malware analysis and understand how vulnerabilities can be leveraged in multi-stage attack chains during red team operations. I am passionate about thinking like an attacker and continuously enhancing my skills in offensive security, red teaming, and bug bounty hunting. My goal is to identify exploitable weaknesses, validate real-world impact, and deliver actionable, risk-driven remediation strategies that strengthen overall security posture.