I'm V, online as v1xtron: a founder, purple teamer and software engineer who lives where offensive security meets software engineering. I break systems for a living and build the tooling that finds the next break faster, from Vulnspire, an AI-native PTaaS, to a drawer full of open-source recon tools.

Seven-plus years, 200+ engagements and 1,000+ reports across 100+ companies, including critical and high-severity findings in Fortune 500, government-adjacent and multinational organizations: responsibly disclosed, and written up so engineers and executives can act on them. I also train and mentor penetration testers in recon, reporting and offensive tradecraft.

proof before posture. A finding only counts when something (a browser, a packet, a debugger) actually proved it.

• Vulnspire · founder — AI-native PTaaS for autonomous web vulnerability discovery, HTTP-history analysis and evidence-driven validation, engineered to surface up to 95% of common web vulnerabilities. A shared-agent runtime puts the AI Scanner and the Companion on one search-first pentest brain, while replayable requests, findings & leads, proof-based workflows and operator-grade debug visibility keep manual pentesting first-class. Try it free ↗
• CyberPars · co-founder — offensive-security services: red-team operations, adversary simulation, offensive tooling and recon automation in Go, plus AI-assisted social-engineering simulations inside approved client scopes.
• Bug bounty · independent, since 2022 — public, private and invite-only programs. Ranked a top performer across multiple leading platforms, with every report written for impact, reproduction and remediation.
• AI movie studio · side quest — building an AI movie studio on the side, a generative-AI path from idea to finished film. In development.

Open-source tools I've written: recon, discovery and exploit-validation helpers, mostly in Go and Python.

• Banshee-AI Go — AI-powered Google & Brave dorking for OSINT and recon: dual-engine search, API-key rotation, adaptive rate limiting, query optimization. ▶ demo
• bounty-search-engine JS — dork-driven discovery of sensitive information across GitHub, Google and Shodan.
• Arsenal Shell — tools, scripts, one-liners, templates, dorks and field notes.
• rHunter Python — Burp Suite extension that hunts open redirects automatically.
• SSL-Hunter Python — certificate intelligence and WAF-bypass research, with SSL scan results and cloud IP ranges in MongoDB behind a Flask UI. ▶ demo
• wayfuzz Go — concise, targeted wordlists generated from Wayback Machine URLs.
• sXtract Go — pulls IPs out of Shodan results for origin-IP and WAF-bypass research.
• Reclaim Go — verifies subdomain-takeover candidates, CNAME check first, HTTP proof second.
• dominator Go — finds DOM-XSS and injection candidates by analyzing inline JavaScript.
• burp-notes Java — per-target markdown notes, tags, checklists and attachments inside Burp.
• smapper Go — lightweight, high-accuracy asset discovery and subdomain enumeration.
• NC-Framework Python — red-team C2 framework with secure comms, multi-platform support and file transfer.

_{More in all repositories.}

• Web · API · AI: authentication, authorization, session and business-logic testing against the OWASP Top 10 and API Top 10: IDOR / BOLA / BFLA, privilege escalation, injection, SSRF, XXE, SSTI, XSS, CSRF, JWT, OAuth, SAML, cache and header attacks, WAF / CSP bypasses. AI security: prompt injection, jailbreaks, data leakage, insecure tool / function calling, agent-workflow abuse and guardrail bypass.
• Internal & Active Directory: enumeration, attack-path mapping, lateral movement, privilege escalation and domain-compromise simulation: Kerberoasting, AS-REP roasting, delegation and ACL abuse, relay attacks, credential access.
• Red team & purple team: objective-based adversary simulation from recon and initial access through persistence and defense evasion; phishing and social-engineering assessment; payload staging and C2 tradecraft. Mapped to MITRE ATT&CK and handed back as detection opportunities.
• Malware & reverse engineering: static and dynamic analysis, debugging, unpacking and indicator extraction; binary analysis and vulnerability triage; protocol inspection; memory, disk and network forensics.
• Cloud & infrastructure: AWS, GCP, Azure, IBM Cloud and DigitalOcean: IAM review, exposed-asset discovery, storage security, misconfiguration, segmentation and privilege-escalation paths; container and Linux security.
• Recon & automation: large-scale attack-surface discovery, OSINT, distributed recon, endpoint discovery and asset correlation; automated vulnerability discovery with replayable validation and AI-assisted pentest systems.
• PrivEsc & pivoting: Windows and Linux privilege escalation through misconfigurations, credential exposure and weak permissions; tunnelling, SOCKS and port forwarding; blast-radius mapping and remediation guidance.

Home labs where I take things apart on purpose.

• Active Directory attack-path lab: a controlled Windows AD environment (VirtualBox, Arch Linux) for researching internal attack paths, domain misconfigurations, privilege escalation, lateral movement, credential exposure, relay attacks and trust abuse with Nmap, ntlmrelayx, NetExec, smbexec, Impacket, PowerView, Responder and BloodHound. Realistic enterprise compromise scenarios, graph-mapped attack paths and documented defensive recommendations.
• Malware analysis & reverse-engineering lab: isolated environments for static and dynamic analysis of real-world samples, including WannaCry and NotPetya. Behavioral analysis, debugging, unpacking and indicator extraction with Ghidra, Radare2, REMnux, FLARE VM and GDB, plus custom C samples to study how defenses react.
• RF / SDR security lab: signal analysis, spectrum monitoring, protocol decoding and satellite communications with RTL-SDR, DragonOS, GQRX, SDR#, URH, GR-GSM, SatDump and Jaero, in controlled environments and on publicly observable transmissions.

*  now          Vulnspire    founder
│                            AI-native PTaaS: autonomous discovery, proof-based validation
*  2025 ─ now   CyberBrio    cybersecurity consultant · part-time, remote
│                            enterprise pentests, red-team & assessments for external clients
*  2024 ─ now   CyberPars    co-founder · red teamer · Go developer
│                            offensive tooling, recon systems, exploit validation, adversary sims
*  2022 ─ now   Bug bounty   independent researcher · part-time, remote
                             1,000+ reports · 100+ companies · ranked top performer

Off the clock I'm building an AI movie studio: using generative AI to take a story from idea to finished film. It's early and in development. I'll share more when there's something worth watching.

Open to red-team and pentest engagements through CyberPars, product conversations about Vulnspire, and research collaboration. The sites above are the fastest way in.