01 / Map the real surface
RECON
I inventory identities, endpoints, trust boundaries and the quiet paths between them before touching a control.
// OFFENSIVE SECURITY · AI SYSTEMS
I BREAK THINGSTO UNDERSTANDTHEM.
Prathamesh Dabir maps trust boundaries, reproduces impact and turns offensive evidence into engineering decisions.
Personal reply within one business day
MODEL / PROSTHETICSTATE / OBSERVEDTRACE / AUTHORISED
01 / AI RED TEAMING02 / WEB & API03 / PENETRATION TESTING04 / BUG BOUNTY05 / SECOPS06 / SECURITY EDUCATION
01ATTACK PATH / METHOD
PATH RESOLUTION025%
02 / Prove the first claim
FOOTHOLD
A finding is not a headline. I reproduce the smallest authorised path that proves the control can fail.
03 / Follow authority
ESCALATE
I trace what the compromised identity can read, trigger, impersonate or reach—across application, cloud and AI systems.
04 / Leave a usable decision
IMPACT
Evidence becomes a remediation sequence: business consequence, root control, owner, validation and a clean retest.
02PROOF / NOT DECORATION
THE RECEIPTS
BEFORE THE PITCH.
“Think like an attacker.
Defend like an engineer.”
03INSTRUMENTS / SELECTED
TOOLS CHANGE.
METHOD HOLDS.
01Burp Suite
02Nmap
03Wireshark
04BloodHound
05Nuclei
06Splunk
07Python
08Kali Linux
THE TOOL IS NEVER THE FINDING. THE OBSERVED CONTROL FAILURE IS.
04OPERATIONS / THREE FORMS OF PROOF
CASE FILES.
CASE 01
Evidence before severity
Security assessment
Trace an exposed path, reproduce each finding and connect it to business impact and recommendation ownership.
CASE 02
From signal to valid report
Responsible disclosure
Distinguish a real security issue from tool noise, minimise proof, document impact and communicate remediation without exposing sensitive data.
CASE 03
Teach the decision, not the payload
Security education
Turn authorised labs into durable mental models: evidence, hypothesis, least-invasive test, observed limit and next decision.
05 / LEAD OPERATOR
THE PERSON
BEHIND THE REPORT.
I’m Prathamesh Dabir: a penetration tester, bug-bounty researcher, cybersecurity educator and CTO at Arica Tech Security. The first reply—and the technical conversation after it—comes from me.
- TRYHACKME INDIA TOP 10
- 300+ MACHINES & ROOMS
- AI, WEB & API SECURITY
- RESPONSIBLE DISCLOSURE
06FIELD NOTES / LATEST SIGNAL
RESEARCH THAT
SURVIVES CONTACT.
Accepted Is Not Applied: When a Security Parameter Silently Does Nothing
Why an accepted parameter can create more dangerous confidence than a visibly absent control.
Adaptive Prompt-Injection Search Testing
A bounded way to explore instruction conflicts without confusing coverage with confidence.
ASCII Smuggling and Unicode Normalisation
When two text representations cross one trust boundary with different meanings.
07 / SECURE CHANNEL
LET'S
TALK.
Got a project, a bounty, or need someone to red-team your stack? Send the brief. The reply comes from me, not a ticketing bot.
hey@0xprathamesh.com