Zishan Ahamed Thandar
Offensive Security Expert and Ethical Hacker helping SaaS, startups, and enterprises discover and fix real-world vulnerabilities in their web applications, APIs, and infrastructure — before attackers do.
Services
Cyber Security Consultancy
End-to-end manual web application penetration testing, API & Backend Security Testing aligned with OWASP, focused on authentication, authorization, access control, business logic, and real attacker-style exploitation paths that matter to your business. High-creativity, adversarial assessments inspired by years of bug bounty experience across 50+ programs. Ideal when you want research-grade findings and complex chains, not just a basic vulnerability scan.
Notes, Training & Mentoring
Structured, battle-tested notes and guidance for certifications and red-team learning. Designed for professionals who want to move from theory to hands-on offensive security skills.
Open Source & Sponsorship
Maintaining and improving open-source security projects that speed up recon, testing, and learning for the wider security community. Sponsorship helps me dedicate more time to building better tools.
Hall of Fame & Recognitions
Recognized over twenty times by international organizations for impactful, responsible disclosure that helped protect millions of users and critical systems.
…and additional organizations across technology, education, and government sectors that have trusted my work to improve their security posture.
Experience
Independent Security Researcher & Bug Bounty Hunter
2018 — Present · HackerOne · Yogosha
Conducted independent security research across real-world production systems, responsibly disclosing high-impact vulnerabilities including access control flaws, authentication issues, stored XSS, and complex business logic vulnerabilities.
Recognized through public Hall of Fame acknowledgements and verified reports on industry-standard vulnerability disclosure platforms.
Projects
Hacker Proxy Pro (Firefox Add-on)
Lightweight Firefox extension used by security professionals to toggle quickly between Burp Suite proxy and TOR, reducing setup overhead and keeping one browser dedicated to offensive security work.
Hackify
Bash script that automates installation of common wordlists and penetration testing tools on Debian-based systems, so new lab or VPS environments are ready for testing with a single command.
WebsiteDorkerPro
OSINT and recon tool for red teamers, bug bounty hunters, and web app pentesters to quickly generate dorks, discover exposed endpoints, and map attack surfaces around a target domain.
CyberTerminus (Firefox Theme)
Sleek, hacker-inspired Firefox dark theme with deep blacks and neon highlights in green, cyan, and sharp red — mirroring the glow of a terminal. Designed for coders, ethical hackers, and cyberpunk lovers who live in the browser.
Testimonials
“We greatly appreciate your effort in disclosing a security vulnerability responsibly and confirming the fix.”
“Thanks for your hard work, Zishan!”
“We appreciate you bringing this to our attention.”
“Thank you for bringing the following vulnerability to our attention.”
Certifications & Education
Cyber Security Certifications
Academic Qualification
Coding & Technology Certifications
Contact
If you need a professional Web or API penetration test, a bug bounty style assessment, or help improving your security posture, share a brief about your application and timelines. I typically respond within 24 hours with next steps.
