$ meher_
secure
~$

Meher Sudhakar
Abbireddi

// your friendly neighborhood pentester

Cybersecurity engineer with 3+ years across penetration testing, vulnerability exploitation, and adversarial testing of web, API, cloud, and production AI systems. Performed security engagements on RAG systems and hardened LLM guardrails at Cybertrust America.

View WorkResume
0+
years experience
0+
vulnerabilities surfaced
0
certifications
M.Eng
UMD Cybersec
Meher Sudhakar Abbireddi

about

I find exploitable vulnerabilities across web, cloud, and AI security through manual, adversary-driven testing, then translate them into actionable remediation that engineering teams actually ship.

3+ years across penetration testing, vulnerability exploitation, and adversarial testing of web, API, cloud, and production AI systems. Build and validate end-to-end attack chains spanning authentication and authorization bypass, privilege escalation, lateral movement, post-exploitation, source-level review for exploitation primitives, and adversarial testing of LLM and RAG pipelines.

Surfaced 30+ confirmed vulnerabilities, including a novel Denial-of-Wallet attack class on a production RAG pipeline, a high-severity JWT lifecycle flaw on a multi-tenant SaaS platform, and 25+ critical findings at DXC that drove a 35% reduction in production incidents.

I care about the fundamentals: understanding the target, writing tools when off-the-shelf ones fall short, and reporting findings with clear PoCs mapped to CVSS v3, OWASP Top 10, and MITRE ATT&CK.

// currently
  • → Conducting security research
  • → Pursuing OSCP
// based in
United States
// open to
Red team · AppSec · AI security roles

experience

Cybersecurity Analyst - Penetration Tester · Cybertrust America

Sep 2025 - Jun 2026
  • ▸Strengthened a multi-tenant SaaS platform's session security before SOC 2 attestation by surfacing a high-severity JWT lifecycle flaw that survived logout, confirmed by replaying tokens in Burp Suite.
  • ▸Discovered 4+ high-severity findings in a production RAG-based AI application, including a novel Denial-of-Wallet attack class and LLM prompt injection, using Burp Suite and custom Python exploit scripts.
  • ▸Escalated one prompt-injection entry point into data exfiltration and privilege escalation by scripting multi-step PoCs in Python across production LLM orchestration and identity integration layers.
  • ▸Exposed client-side information disclosure in a SOC 2-aligned pentest of a production SaaS platform by auditing frontend assets (role-constant enumeration, admin-route references) in browser DevTools.
  • ▸Strengthened production LLM systems by designing adversarial test suites that proved guardrail-bypass paths, with hardening recommendations adopted by client engineering pre-deployment.
  • ▸Uncovered prompt-injection entry points, hardcoded credentials, and data-leakage vectors through source-level static analysis with Snyk across production LLM orchestration and agentic code.
  • ▸Accelerated client remediation by delivering penetration-test reports scoped to CVSS v3 and OWASP Top 10, pairing technical PoCs with step-by-step guidance adopted pre-production by engineering stakeholders.
LLM SecurityBurp SuitePythonRAGOWASP LLM Top 10OAuth/JWTSnyk

AI Trainer - Cybersecurity Expert (Contract) · Handshake AI

Nov 2025 - Mar 2026
  • ▸Discovered exploitable model behavior across production AI surfaces through indirect prompt injection, refusal-bypass, and context-leakage attacks scripted in Python over layered multi-turn prompts.
  • ▸Strengthened deployed models by turning confirmed bypasses across 4 attack classes into shipped guardrails, input filtering, output validation, and response-policy tuning.
  • ▸Improved automated risk classifiers by scoring model outputs against MITRE ATLAS and OWASP LLM Top 10 across exploitation, malware, and exfiltration misuse classes.
  • ▸Advanced model refusal on dual-use security prompts by authoring adversarial datasets paired with harm rationales, shipping refusal-policy mitigations across 3 cross-team review cycles.
AI Red TeamPrompt InjectionMITRE ATLASOWASP LLM Top 10Python

Red Team Analyst · University of Maryland, College Park

Aug 2024 - May 2025
  • ▸Exploited injection, broken authentication, and access-control flaws on production web apps through authenticated and unauthenticated pentests, with working payloads in Burp Suite and sqlmap for owners.
  • ▸Escalated access across enterprise Linux and Windows infrastructure by chaining service misconfigurations and credential exposure into multi-host pivot paths using Impacket and CrackMapExec.
  • ▸Uncovered cloud workload risk across public-bucket exposure, IAM misconfiguration, and over-scoped roles by auditing IAM policies and CloudTrail logs in production AWS, routing fixes by exploitability.
  • ▸Accelerated recurring engagements by building Python automation for attack-surface enumeration and exploit validation, cutting per-engagement setup time and standardizing reporting output.
Web PentestLinux/WindowsAWS IAMImpacketCrackMapExecPython

Offensive Security Engineer · DXC Technology

Jun 2022 - Aug 2023
  • ▸Discovered 25+ critical vulnerabilities across web, mobile, and API clients, spanning injection, broken access control (IDOR), and authentication bypass, contributing to a 35% reduction in production incidents.
  • ▸Escalated domain privileges across enterprise test Active Directory environments by enumerating attack paths with BloodHound and Kerberoasting and extracting credentials with Mimikatz.
  • ▸Compromised user-awareness and email-security controls through phishing simulations and pretext payloads in recurring red-team social engineering campaigns using GoPhish and Evilginx.
  • ▸Reduced critical-vulnerability detection-to-fix time 30% by running threat-emulation drills across 100+ Linux and Windows systems with Nessus, prioritizing remediation by CVSS score and exploitability.
Active DirectoryBloodHoundMimikatzNessusGoPhishEvilginx

Web Application Penetration Tester · Verzeo

Oct 2021 - Jun 2022
  • ▸Exploited SQL injection, XSS, and IDOR on production web targets, proving each end-to-end with hand-crafted payloads in OWASP ZAP and sqlmap, driving risk-prioritized remediation.
  • ▸Identified input-validation, authentication, and authorization flaws that dynamic scanners missed through manual source code review with SonarQube across high-risk production modules.
  • ▸Reduced manual enumeration effort 30% by automating reconnaissance and attack-surface mapping with Nmap and custom Python tooling, expanding coverage across components and backend services.
SQLiXSSIDOROWASP ZAPsqlmapSonarQubeNmap

cve research

$ grep -rl "CVE-2026" ~/disclosures

▸ selected disclosures · top severity 8.8 · object injection · IDOR · SQLi · missing-auth · stored & reflected XSS · arbitrary file write across the WordPress plugin ecosystem

CVE-2026-12081HIGH 8.8PHP Object InjectionDatabase for CF7, WPForms & Elementor Forms<= 1.5.1

An unauthenticated visitor stores a serialized payload in a file-type form field that a bare maybe_unserialize() instantiates when an admin opens the entry — an incomplete fix of two prior deserialization CVEs. 70,000+ installs.

CWE-502auth: Unauthenticatedslug: contact-form-entriesvia WPScan
CVE-2026-12274HIGH 7.1IDOR / Broken AuthTutor LMS<= 3.9.11

The quiz-builder save handler passes an attacker-controlled post ID straight to wp_insert_post() with no per-object capability check, letting an instructor overwrite and take over any post — including admin pages. 90,000+ installs.

CWE-639auth: Instructor+slug: tutorvia WPScan
CVE-2026-12395MEDIUM 6.5SQL InjectionWP Job Portal<= 2.5.4

The Applied Resumes view concatenates the ta parameter into an unquoted numeric SQL comparison where esc_sql() can't neutralize it, letting an Employer read any data in the database — including user password hashes. 10,000+ installs.

CWE-89auth: Employer+slug: wp-job-portalvia WPScan
CVE-2026-12907MEDIUM 6.5Missing AuthorizationRTMKit Addons for Elementor<= 2.0.8

The Theme Builder render layer selects any published, active template with no author or capability constraint, letting an Author publish site-wide header, footer, and 404 chrome shown to every visitor and administrator. 40,000+ installs.

CWE-862auth: Author+slug: rometheme-for-elementorvia WPScan
CVE-2026-11766MEDIUM 6.4Stored XSSUltimate Member<= 2.11.4

An entity-encoded payload survives sanitize_textarea_field() on save, then html_entity_decode() revives it into live markup at render — a bypass of the biography-only fix shipped for CVE-2025-15064. 200,000+ installs.

CWE-79auth: Subscriber+slug: ultimate-membervia WPScan
CVE-2026-12970MEDIUM 6.1Reflected XSSLearnPress<= 4.3.9.1

The Course Builder reflects the c_search request parameter into the page without escaping, executing attacker-supplied script in the victim's browser with no authentication required. 90,000+ installs.

CWE-79auth: Unauthenticatedslug: learnpressvia WPScan
CVE-2026-12511MEDIUM 4.3Arbitrary File WriteAI Engine<= 3.5.4

A traversal sequence in a generated image filename escapes the uploads directory to write attacker-controlled bytes anywhere on disk; a .php.png double-extension write yields RCE under a permissive PHP handler. 100,000+ installs.

CWE-22auth: Editor+slug: ai-enginevia WPScan

A selection of assigned CVEs from independent WordPress plugin research; IDs assigned by WPScan and Wordfence / MITRE. Links resolve on NVD.

projects

Selected offensive-security work spanning autonomous pentesting, adversarial AI, and reconnaissance automation.

Pentigo

Autonomous AI Penetration Testing Platform

A multi-agent orchestration system that autonomously chains reconnaissance, scanning, enumeration, exploitation, and post-exploitation phases. Each phase is gated on prior findings to mirror how a human pentester scopes follow-up. Standard pentest tooling (Nmap, Metasploit, sqlmap, ffuf) integrates through a unified tool-calling layer that passes findings between phases and triggers context-aware follow-up probes against intentionally vulnerable VMs and CTF targets.

Multi-agent orchestrationPhase-gated chainingContext-aware follow-up
PythonNmapMetasploitsqlmapffuf

ReconX

Modular reconnaissance automation framework

A framework automating subdomain enumeration, port scanning, service fingerprinting, and HTTP probing across attack-surface engagements. Normalizes heterogeneous tool output into a structured schema for analysis. Configurable scan profiles with Shodan and ffuf integrations, plus per-module rate limiting to evade WAF and IDS detection during early-phase recon, keeping per-engagement scoping flexible.

Configurable scan profilesShodan + ffuf integrationsRate-limited / WAF-aware
PythonNmapShodanffuf

Cloud-Based Healthcare Hardening

HIPAA-aligned AWS security review

Diagnosed architectural security gaps and implemented security-by-design controls across a HIPAA-aligned AWS environment, mitigating 80% of vulnerabilities and misconfigurations through risk-prioritized remediation. Refined IAM policies, enforced MFA on privileged accounts, and applied least-privilege controls per role and service, reducing excessive permissions 40% with KMS-managed encryption and CloudTrail audit logging.

80% misconfig mitigation40% permission reductionKMS + CloudTrail
AWSIAMKMSCloudTrailHIPAA

skills & tooling

$ nmap -sV --open localhost

✓ scan complete · 66 services discovered

Offensive Security
port: 80 · 12 open
  • Manual Web/API Exploitation
  • Network Pentesting
  • Auth Bypass (OAuth/OIDC/JWT/SAML)
  • Exploit Chains
  • Exploit Dev
  • Privilege Escalation
  • Lateral Movement
  • Attack-Surface Enum
  • Post-Exploitation
  • Social Engineering
  • Phishing Simulation
  • Bug Bounty / Responsible Disclosure
AI Red Team & LLM Security
port: 1337 · 10 open
  • Prompt Injection (Direct/Indirect)
  • Denial-of-Wallet Attack Design
  • Multi-Step LLM Exploit Chaining
  • Jailbreak Taxonomy
  • Guardrail-Bypass Testing
  • RAG Pipeline Attack Surface
  • Agentic Access-Control Bypass
  • Adversarial Test Design
  • OWASP LLM Top 10
  • MITRE ATLAS
AppSec & Code Review
port: 8080 · 8 open
  • Manual Source Code Review
  • STRIDE Threat Modeling
  • SAST/DAST/SCA Integration
  • CI/CD Security Gates
  • Attack-Surface Analysis
  • Vulnerability Triage
  • OWASP Top 10
  • OWASP API Security Top 10
Programming
port: 22 · 11 open
  • Python
  • JavaScript
  • PowerShell
  • Bash
  • Unix Shell
  • C
  • C++
  • SQL
  • Exploit Scripting
  • Automation Tooling
  • JSON Schema Design
Security Tools
port: 443 · 12 open
  • Burp Suite
  • Nmap
  • Nessus
  • Metasploit
  • sqlmap
  • ffuf
  • BloodHound
  • Mimikatz
  • Wireshark
  • SonarQube
  • Veracode
  • Checkmarx
Cloud, Infra & Standards
port: 9001 · 13 open
  • AWS (IAM, S3, EC2, Lambda)
  • Active Directory
  • Docker
  • Linux (Kali, Ubuntu)
  • Windows Server
  • Jenkins
  • GitHub Actions
  • MITRE ATT&CK
  • NIST CSF
  • CVSS v3
  • SOC 2
  • PCI DSS
  • HIPAA

certifications

OSCP

In Progress

Offensive Security

sha: 0x8fe3...3ef8

eJPT · Junior Penetration Tester

Certified

INE

sha: 0x4a91...19a4

CompTIA Security+

Certified

CompTIA

sha: 0xc20b...b02c

education

Master of Engineering, Cybersecurity

Aug 2023 - May 2025

University of Maryland, College Park

Coursework
Hacking of C Programs & Unix BinariesCloud SecurityReverse EngineeringDigital ForensicsCryptographyOperating SystemsInformation SecurityNetwork SecurityCloud Computing

contact

Have a target to test, a system to harden, or a role to fill?

I'm open to penetration testing, offensive security, application security, and AI security roles.

msabbi2022@gmail.com(240) 340-0064/in/meher-sudhakar@Mehersudhakar
Download resume (PDF)
SEC:HOME
scan
00%
TLS1.3