Security Analyst & VAPT Engineer · Bug Bounty Hunter · Offensive Security
Abhishek Bhaskar, known online as Abhi HackZ, is a Security Analyst and VAPT Engineer from India with 5+ years of experience in offensive security. As Abhi HackZ, he tests web, API, mobile, cloud and AI systems the way real attackers would, and has secured over 1000 applications.
Abhishek Bhaskar holds Hall of Fame recognition from NASA for responsible vulnerability disclosure, is the creator of the SentryScan vulnerability scanner, and hunts bugs on HackerOne and Bugcrowd under the handle whi7ed3vil. Whether people search for Abhishek Bhaskar, Abhi HackZ or Cyber HackZ, this is the same person.
Looking to hire a freelance cybersecurity expert or an ethical hacker for hire? Abhi HackZ works as an independent freelance penetration tester — offering web and API pentesting, mobile app security testing, cloud VAPT, network assessments and AI/LLM red teaming for startups and founders worldwide, with fixed-price quotes and a free 30-minute scoping call.
SentryScan · SentryScan Mobile · Hall of Fame · Projects · Blog · Certifications · Contact
I help founders find the breach before attackers do — testing web, API, mobile, cloud and AI the way real adversaries would.
5+ years in offensive security, 1000+ applications secured, and Hall of Fame recognitions from NASA and others. Whether you want a look at my work or a security partner for your product — you're in the right place.
Focus areas: Offensive Security, Bug Bounty, AI Red Teaming, Security Automation, VAPT Engineer, Freelance Pentesting, Ethical Hacking.
Freelance penetration testing and security assessment services for founders, startups and enterprises.
Full-depth testing of your web app and APIs — auth flaws, IDORs, injection, business-logic abuse and the chained attacks scanners never find.
Deliverable: prioritised report · PoC per finding · free retest
Static and dynamic assessment of your mobile apps — insecure storage, broken crypto, API trust issues and reverse-engineering resistance.
Deliverable: OWASP MASVS-mapped findings · fix guidance per issue
Configuration and privilege-focused review of your cloud environment — IAM misconfigurations, exposed storage and services, and insecure defaults across AWS, Azure and GCP.
Deliverable: cloud posture report · misconfig findings · hardening plan
External and internal assessments of your network and infrastructure — exposed services, misconfigurations, and wireless and IoT environments included.
Deliverable: attack-surface map · risk-ranked remediation plan
Shipping AI features? I test for prompt injection, data leakage, jailbreaks and agent/tool-abuse before your users — or attackers — do.
Deliverable: threat model · exploit scenarios · guardrail recommendations
Continuous discovery of everything you've exposed to the internet — forgotten subdomains, staging boxes, leaked keys and shadow assets — powered by custom recon pipelines and tooling.
Deliverable: live asset inventory · exposure report · reusable tooling
A tight, predictable VAPT engagement — from the first scope call through reconnaissance, manual and automated testing, exploitation with proof-of-concept per finding, a prioritised report your engineers can act on, and a free re-verification of every fix.
SentryScan is a self-hosted web vulnerability scanner and VAPT platform I'm building for authorized security testing. It maps the attack surface, runs 64 detection modules mapped to the OWASP Top 10 and other industry security frameworks (WSTG, SANS, PTES), actively proves real findings instead of just flagging them, drops the noise, and writes the report.
Detects: SQL injection, Reflected XSS, DOM XSS, LFI, SSTI, NoSQL injection, CRLF, Security headers, CORS misconfig, Clickjacking, Open redirect, Cache poisoning, .git / .env leaks, Swagger exposure, GraphQL introspection, JWT weaknesses and more.
SQLi (error, blind, time, header, auth-bypass), reflected & DOM XSS, LFI, SSTI, NoSQL and CRLF — driven from a JS-aware crawl.
Security headers, CORS, clickjacking, open redirect, cache poisoning, and .git/.env source leaks.
Swagger/OpenAPI exposure, GraphQL introspection, JWT weaknesses, plus full authenticated scanning for SPAs.
Non-destructively reconstructs each exploitable finding to prove it, scores confidence, and drives false positives toward zero.
An optional AI pass double-checks borderline findings to cut false positives even further before they reach your report.
Evidence, reproduction steps and working proofs, exported to HTML, PDF, Markdown, JSON or CSV.
Learn more about SentryScan · SentryScan Mobile for Android & iOS
Offensive Security · VAPT · Bug Bounty · 5+ years
Web App Security · Mobile App Security · API Security · Thick Client · Network VAPT · Infrastructure VAPT · Wireless Security · IoT Security
Recon Automation · Asset Discovery · Subdomain Enumeration · Vulnerability Chaining · Advanced Methodologies · Report Writing
Prompt Injection · LLM Security Testing · AI Red Teaming · Agent Security · AI Threat Modeling
OWASP Top 10 · OWASP WSTG · OWASP MASVS · OWASP ASVS · MITRE ATT&CK · PTES · NIST CSF · SANS Top 25 · CVSS · Threat Modeling · Secure SDLC
Public recognitions earned by responsibly disclosing real vulnerabilities in production systems.
Active bug bounty hunter under the handle whi7ed3vil.
ASN-based recon grapher — maps an organisation to its ASNs and IP ranges to build attack-surface scope fast. (Shell · recon, asn, asset-discovery)
Go utility that merges, dedupes and hunts through large recon outputs to surface interesting findings quickly. (Go · recon, automation, go)
API endpoint discovery and reconnaissance tool for mapping and testing exposed API surfaces. (Go · api-security, recon, go)
DNS information-gathering automation that wraps dig-style lookups into a fast recon workflow. (Shell · dns, recon, osint)
Subdomain enumeration tool that aggregates multiple sources to discover an organisation’s subdomains. (Shell · subdomains, enumeration, recon)
A graphical network scanner for host and port discovery — point-and-click recon for internal assessments. (Python · network, scanner, python)
Published vulnerabilities and security advisories.
Broken object-level auth, mass assignment, GraphQL introspection and the rest — the OWASP API Top 10, the way I actually test it. (API · 2026-01-28)
The high-impact bugs that look like perfectly valid requests — why automation can't see them and how I hunt them by hand. (Web · 2026-01-24)
How a low-severity IDOR escalated into full account takeover by following the data instead of stopping at the first anomaly. (Bug Bounty · 2026-01-20)
A MASVS-mapped methodology for taking an Android app from a downloaded APK to a report full of proven findings. (Mobile · 2026-01-16)
How tool-calling AI agents leak data and take unintended actions — a practical model of indirect injection and how to test for it. (AI · 2026-01-10)
The false-positive tax, and why a finding should be actively proven before it ever reaches your report. (Web · 2026-01-05)
From ASN seeding to live-change triage — the four-stage methodology behind my open-source recon automation. (Recon · 2025-12-28)
Campus workshops, boot camps and conference sessions on offensive security and bug bounty.
Abhishek Bhaskar (Abhi HackZ) — Security Analyst & VAPT Engineer. Bug Bounty Hunter · Offensive Security. Based in India · works globally.
Email [email protected] for VAPT engagements, penetration testing, security assessments and bug bounty collaboration, or use the contact page.