Mokksh Parekh

Penetration Tester: Mobile, Web, API & Thick Client

Gray-box and black-box security testing of Android and iOS, web, API and thick client applications. Chennai, India. 6 published CVEs. LPT (Master), CPENT, CEH (Master).

▸ 01 // ABOUT

$ cat ~/about.txt

NAMEMokksh A ParekhROLEPenetration Tester ⋅ Security Analyst @ TechDefence LabsFOCUSMobile (Android & iOS) ⋅ Web ⋅ API ⋅ Thick Client gray-box & black-boxSTANDARDSOWASP Top 10 ⋅ OWASP API Top 10 ⋅ OWASP MASVS / MASTGLOCATIONChennai, Tamil Nadu, IndiaEDUCATIONB.E. Computer Science (Cybersecurity major) ⋅ Parul University ⋅ 8.22/10STATUS● AVAILABLE
$ cat ~/summary.md

Penetration tester specializing in gray-box and black-box security testing of Android and iOS, web, API, and thick client applications. Hands-on mobile SAST/DAST, reverse engineering, and bypass of SSL pinning and root/jailbreak detection using Frida, objection, and Magisk. Tests against OWASP Top 10, OWASP API Security Top 10, and OWASP MASVS/MASTG. Credited researcher behind 6 published CVEs, with 400+ vulnerabilities reported across 75+ engagements. EC-Council LPT (Master), CPENT, and CEH v12 (Master) certified.

▼ DOWNLOAD RESUME .pdf⋅ 1 page ⋅ pgp-signed on request

▸ 02 // WORK / EXPERIENCE

Security Analyst

AUG 2025 - PRESENT
▸ TechDefence Labs Solutions Limited ⋅ Ahmedabad, IN
  • Executed 45+ gray-box and black-box penetration tests across web, mobile (Android and iOS), API, thick client, network, and Active Directory environments, including red team engagements.
  • Static and dynamic analysis of Android APKs and iOS IPAs with MobSF, jadx, apktool, dex2jar, adb, otool, and plutil: insecure data storage, hardcoded secrets, insecure configs, parameter tampering.
  • Reverse engineered mobile binaries and native libraries (.so/.dylib); bypassed SSL pinning, root/jailbreak detection, obfuscation, and tamper checks with Frida, objection, Magisk, and Xposed.
  • Manually tested web apps, REST APIs, and thick clients with Burp Suite and OWASP ZAP against OWASP Top 10 and API Security Top 10, scoping each assessment and designing test scenarios.
  • SAST/DAST and configuration reviews identifying 400+ vulnerabilities, each documented with PoC evidence and risk-rated remediation guidance.

Security Analyst (Intern)

DEC 2024 - JUL 2025
▸ TechDefence Labs Solutions Limited ⋅ Ahmedabad, IN
  • Executed 30+ security assessments across web, API, mobile, network, and Active Directory environments, including VAPT and red team activities.
  • Identified 50+ vulnerabilities through SAST/DAST scans and configuration reviews; validated and documented findings with PoC evidence across 20+ engagements.

▸ 03 // CREDENTIALS / CERTIFICATIONS

LPT Master

Licensed Penetration Tester (LPT Master)

▸ EC-Council ⋅ 2026
Elite-level practical cert: network pivoting, custom exploit chaining, repeatable/measurable pentest methodology, SQLi/XSS/LFI/RFI attacks on web apps.
● VALID▸ VERIFY
CPENT

Certified Penetration Testing Professional v2

▸ EC-Council ⋅ 2026
Advanced pen-testing mastery: pivoting, double pivoting, privilege escalation, defense evasion, attack automation, binary exploitation, professional reporting.
● VALID▸ VERIFY
CEH v12 Master

Certified Ethical Hacker (CEH v12 Master)

▸ EC-Council ⋅ 2025
Hands-on ethical hacking: network, web, system exploitation aligned with real-world VAPT.
● VALID▸ VERIFY
CRTA

Certified Red Team Analyst

▸ CyberWarFare Labs ⋅ 2025
AD-focused adversary simulation: recon, exploitation, lateral movement, privilege escalation.
● VALID▸ VERIFY
ACP

APIsec Certified Practitioner

▸ APIsec University ⋅ 2025
API vulnerability identification & exploitation: auth flaws, business logic, modern architectures.
● VALID▸ VERIFY
CNSP

Certified Network Security Practitioner

▸ The SecOps Group ⋅ 2025
Threat detection, secure configurations, network vulnerability assessment.
● VALID▸ VERIFY
CAP

Certified AppSec Practitioner

▸ The SecOps Group ⋅ 2024
Secure coding, vuln identification, application-level risk assessment.
● VALID▸ VERIFY
SC-900

Security, Compliance & Identity Fundamentals

▸ Microsoft ⋅ 2022
Core security, compliance, identity concepts across cloud & enterprise.
● VALID▸ VERIFY
▸ verify links open the issuer's public verification page in a new tab.

▸ 04 // RESEARCH & DISCLOSURES (CVES)

6 CVEs in WordPress and npm software (1 critical ⋅ 3 high ⋅ 2 medium), coordinated through Patchstack, WPScan, and Snyk.

CVE-2026-56070

CVSS 9.3 · CRITICAL
Unauthenticated SQL Injection - Advance Product Search (WordPress)
▸ Patchstack ⋅ Jun 2026 ⋅ affected ≤ 1.4.4 ⋅ fixed 1.4.5
Unauthenticated SQL injection in the Advance Product Search WordPress plugin, enabling direct database interaction.
▸ VIEW ADVISORY

CVE-2026-13613

CVSS 8.8 · HIGH
Authenticated SQL Injection via REST API - KiviCare Clinic & Patient Management (WordPress)
▸ WPScan ⋅ Aug 2026 ⋅ affected < 4.5.2 ⋅ fixed 4.5.2
User-supplied parameters on a settings/listing REST endpoint reach a SQL query unsanitised, letting authenticated clinic staff (Doctor/Receptionist+) run SQL injection against the EHR database.
▸ VIEW ADVISORY

CVE-2026-11572

CVSS 8.7 · HIGH
OS Command Injection - degit (npm)
▸ Snyk ⋅ Jun 2026 ⋅ affected all versions ⋅ fixed patched via coordinated disclosure
Improper sanitisation of user-supplied input passed to git shell commands in degit, a project-scaffolding package with millions of weekly npm downloads. Co-discovered.
▸ VIEW ADVISORY

CVE-2026-12877

CVSS 8.6 · HIGH
Unauthenticated SQL Injection - Project Management, Bug & Issue Tracking (WordPress)
▸ WPScan ⋅ Jul 2026 ⋅ affected < 5.1.0 ⋅ fixed 5.1.0
Plugin does not sanitise/escape user-supplied input before using it in a SQL query, exploitable in the plugin's standard front-end issue tracker, allowing unauthenticated SQL injection.
▸ VIEW ADVISORY

CVE-2026-15153

CVSS 6.8 · MEDIUM
Authenticated SQL Injection - WP Hotel Booking (Booking List Search)
▸ WPScan ⋅ Jul 2026 ⋅ affected < 2.3.2 ⋅ fixed 2.3.2
Search parameter on an administrative booking-list listing is not sanitised/escaped before use in a SQL query, allowing SQL injection for Hotel Manager+ roles.
▸ VIEW ADVISORY

CVE-2026-18777

CVSS 5.3 · MEDIUM
Unauthenticated Broken Access Control - TrueBooker Appointment Booking (WordPress)
▸ WPScan ⋅ Aug 2026 ⋅ affected < 1.2.7 ⋅ fixed 1.2.7
Missing authorisation check on an AJAX action lets unauthenticated users change the status of arbitrary appointments and trigger notification emails to affected customers.
▸ VIEW ADVISORY
$ cat ~/bug_bounty/hall_of_fame.txt
Allcargo Group
▸ Com Olho
Tata Motors
▸ Com Olho
Sai Life Sciences
▸ Com Olho
Wibmo
▸ Com Olho
KOMOJU
▸ YesWeHack
Dojo Challenge
▸ YesWeHack

▸ 05 // SKILLS / TOOLING

▸ MOBILE SECURITY
  • 01Android Penetration Testing
  • 02iOS Penetration Testing
  • 03Static & Dynamic Analysis (SAST/DAST)
  • 04Reverse Engineering (.so / .dylib)
  • 05Runtime Hooking
  • 06SSL Pinning Bypass
  • 07Root / Jailbreak Detection Bypass
  • 08OWASP MASVS / MASTG
▸ APPLICATION SECURITY
  • 01Web Application Pentesting
  • 02API Pentesting
  • 03Thick Client Pentesting
  • 04Gray-box & Black-box Testing
  • 05Security Test Design
  • 06Source Code Review (SAST)
  • 07OWASP Top 10
  • 08OWASP API Security Top 10
▸ RED TEAM / NETWORK / AD
  • 01Red Team Engagements
  • 02Active Directory Pentesting
  • 03ADCS Abuse
  • 04Network VAPT
  • 05Configuration Review
▸ SCRIPTING
  • 01Python
  • 02Bash
▸ MOBILE TOOLS
  • 01Frida
  • 02objection
  • 03Magisk
  • 04Xposed
  • 05MobSF
  • 06jadx
  • 07apktool
  • 08dex2jar
  • 09adb
  • 10Xcode
  • 11otool
  • 12plutil
  • 13Cydia
  • 14Sileo
  • 15Zebra
▸ WEB & NETWORK TOOLS
  • 01Burp Suite
  • 02OWASP ZAP
  • 03Postman
  • 04sqlmap
  • 05Kali Linux
  • 06Nmap
  • 07Nessus
  • 08Metasploit
  • 09Wireshark
  • 10BloodHound
  • 11Impacket
  • 12NetExec
  • 13CrowdStrike EDR

▸ 06 // CONTACT / OPEN TO WORK

$ cat ~/contact.txt
EMAILmaparekh11@gmail.comPHONE+91 86675 04887LINKEDINlinkedin.com/in/mokksh-parekhLOCATIONChennai, TN ⋅ IndiaSTATUS● OPEN TO WORK: ROLES & ENGAGEMENTS
▸ Open to full-time security roles and freelance / contract engagements.
▸ Recruiters and hiring managers are welcome, always happy to connect.
▸ Pentest enquiries: share the scope and I will reply with next steps.
▸ Usually replies within 24-48 hours.
$ ./send_message