curriculum vitae

Shikhar Gupta.

Cybersecurity Researcher · Vulnerability Researcher · CTF Team Captain · Bug Hunter

I investigate software, build security tools, and turn the interesting parts into research and CTF challenges.

Mumbai, Indiashikhargupta435@gmail.com

work

Experience

Software Development Intern — Okynus Tech

  • Develop cybersecurity-focused software and research tooling, including OkPentEngine, a defensive security-testing orchestration platform.
  • Implemented and debugged finding deduplication, caching, evidence handling, request-method support, coverage tracking, and validation workflows.
  • Integrated workflows involving Katana and Nuclei while maintaining authorization, scope, and defensive-use guardrails.

Cybersecurity Intern — ForenSeize

  • Supported cybersecurity and digital-forensics casework, including evidence triage and structured investigation workflows.
  • Worked with Intella and Oxygen Forensic Detective; used Intella to search and triage email PST datasets using targeted keywords.
  • Prepared Chain of Custody and Consent forms and followed structured evidence-handling practices.
  • Built an AI-assisted batch image-triage workflow to scan a very large directory for potentially AI-generated images, reducing manual review.

security

Vulnerability research

Published findings and security advisories.

KestraHigh · CVSS 8.7

Stored XSS via custom Markdown [[link]] attribute injection

CVE-2026-55839 · GHSA-34pm-923j-7wf8

Snipe-ITHigh

Cross-company asset re-parenting via API

CVE-2026-55516 · GHSA-575r-357h-fhch

Snipe-ITModerate

Cross-company deletion of pending checkout acceptances

CVE-2026-55515 · GHSA-35cr-9hqq-p2mg

Snipe-ITModerate · CVSS 4.3

Audit log misattribution on API consumable checkout

GHSA-x9p8-vvc5-q754

Snipe-ITModerate · CVSS 5.4

API checkout endpoints bind live inventory to soft-deleted targets

GHSA-qffp-xpqv-gqr4

pnpmHigh

Path traversal in environment lockfile handling enabling symlink creation

CVE-2026-59195 · GHSA-qrv3-253h-g69c

eLabFTWHigh

Improper API key revocation mechanism

GHSA-647v-6537-75h6

building things

Research & selected projects

Draw2Seed / Drawing-RNG

Drawing-based authentication research

  • Built Drawing-RNG and StrokeTokenEncoder prototypes for converting freehand drawings into normalized, redraw-tolerant symbolic representations.
  • Implemented stroke cleaning, scale/position normalization, RDP simplification, equal-spacing resampling, direction/turn/structure tokens, ambiguity flags, and configurable tolerance profiles.
  • Evaluating genuine redraws against blind and informed forgery attempts; preparing the work as an academic research manuscript.

Forensic Video Watermarking

Security & forensics proof of concept

  • Built a public-key-bound forensic watermarking proof of concept embedding minimally visible, traceable fingerprints into video using DCT-based processing.
  • Demonstrated recovery from redistributed videos and screen recordings; explored crop/perspective correction, synchronization signals, and spread-spectrum variants.

CTFs

Leadership & competition

Team Captain — BlitzHack

  • Led a 40-member international cybersecurity team to a Top 5–6 India / Top 80 worldwide CTFtime ranking in 2025.
  • Specialized in cryptography and reverse engineering; set technical direction, training priorities, and competition strategy.

CTF Competitor — National & International

  • Solved 700+ challenges in cryptography, reverse engineering, forensics, web exploitation, and binary exploitation.
  • Podium finishes: 1st — UrchinSec CTF; 1st — BypassCTF; 2nd — INCTFJ Finals, PragyanCTF and 07CTF; 3rd — Cyberstorm Finals.

community

Events & volunteering

Organizer — OSCTF / BlitzCTF

Led two international Jeopardy-style CTFs with 1,000+ and 1,800+ participants, overseeing challenge coordination, infrastructure, live operations, and post-event delivery.

Volunteer — BSides Mumbai

Helped organize and run the official conference CTF for a 300–400+ attendee cybersecurity conference.

learning

Education

Mithibai Junior College

Science Stream (PCM + Bifocal Electronics) · Maharashtra State Board · Mumbai, India

St. Joseph's School, Orlem (Malad West)

Maharashtra State Board · Mumbai, India · Score: 93.8%

recognition

Honors & awards

  • Silver Medal (Individual) — International Cryptography Olympiad (NSUCrypto)
  • Bronze Medal (Team) — International Cryptography Olympiad (NSUCrypto)
  • Special Diploma (Individual) — International Cryptography Olympiad (NSUCrypto)
  • 2nd Place — Regional Science Quiz
  • Qualifier — Regional Science Exhibition

toolkit

Technical skills

Cybersecurity
Vulnerability Research · Web & API Security · Source Code Review · Cryptography · Reverse Engineering · Binary Exploitation · Digital Forensics · OSINT
Programming
Python · C/C++ · JavaScript · TypeScript · Bash
Security tools
Burp Suite · Semgrep · CodeQL · Nuclei · Katana · Wireshark · IDA · Binary Ninja
Forensics & platforms
Intella · Oxygen Forensic Detective · Docker · Linux · Git