Portfolio | Kalash Kundaliya - Cybersecurity Professional

Portfolio

A showcase of my cybersecurity projects, certifications, TryHackMe rooms, and internships.

Featured Projects

Five projects that best show how I approach security work — full write-ups below, everything else in the filterable catalog underneath.

The RAT and Keylogger projects below were built and used strictly in isolated lab environments for authorized learning and security research — not deployed against real targets.

Network Analysis Tool

Network Analysis Tool

A tool built to capture, analyze, and visualize network traffic in real time — designed to help identify potential security threats quickly and precisely during triage.

Remote Access Trojan (Authorized Lab Research)

Remote Access Trojan (Authorized Lab Research)

Built a RAT in a controlled lab environment for authorized penetration testing, to study remote-access attack techniques from the offensive side and inform better detection and defense.

Write-up

Keylogger (Malware Analysis, Educational)

Keylogger (Malware Analysis, Educational)

Built a keylogger in an isolated lab environment to study how this class of malware captures keystrokes and exfiltrates data — used to inform better detection and defense strategies.

Write-up

API Testing

API Vulnerability Testing

Documented and tested API vulnerabilities, including BOLA (Broken Object Level Authorization) and authentication flaws, and wrote up the findings and remediation approach.

GitHub

App Hacking Hub

App Hacking Hub

In-depth walkthroughs of application hacking challenges and labs — practicing and documenting exploitation techniques against deliberately vulnerable apps.

GitHub

Full Portfolio

Browse all projects, certifications, TryHackMe rooms, internships, and Medium write-ups — filter by category below.

Projects
Certifications
TryHackMe
Internships
Medium

StudyZone

StudyZone

Flappy bird

Flappy bird

Windows Analysis

Windows Analysis

PasteJacking

PasteJacking

Network Analysis Tool

Network Analysis Tool

Keylogger (Malware Analysis, Educational)

Keylogger (Malware Analysis, Educational)

Remote Access Trojan (Authorized Lab Research)

Remote Access Trojan (Authorized Lab Research)

App Hacking Hub

App Hacking Hub

JAVA Fundamental

JAVA Fundamental

API Testing

API Testing

MAC Changer

MAC Changer

Steganography

Steganography

MITM

MITM

Certificate of Internship Completion

Certificate of Internship Completion

Certificate of Course Completion

Certificate of Course Completion

Cyber Security Intern

Cyber Security Intern

Internship Completion Certificate in Cyber Security

Internship Completion Certificate in Cyber Security

Hash cracker

Hash cracker

Security Awareness

Security Awareness

Intro to Offensive Security

Intro to Offensive Security

Advent of Cyber 4

Advent of Cyber 4

Ohsint

Ohsint

OWASP Top 10

OWASP Top 10

Blue

Blue

Streak 7

Streak 7

Streak 30

Streak 30

Linux Privesc

Linux Privesc

Webbed

Webbed

Linux

Linux

Advert of Cyber 2023

Advent of Cyber 2023

Advance SQL Injection

Advance SQL Injection

World Wide Web

World Wide Web

CEH v13

CEH v13

EWPTX

EWPTX

CRTA

CRTA

CRTA

CRTA

Password security

Password security

Advent-of-cyber-2023

Advent-of-cyber-2023

Cyber Hygiene

Cyber Hygiene

Digital Forensics

Digital Forensics

Advent-of-cyber-2022

Advent-of-cyber-2022

Cyber Ethics

Cyber Ethics

Linux Capabilities Explained

Linux Capabilities Explained: How Attackers Escalate Privileges Without Root Passwords

How Linux capabilities let a process do "just enough" root-level work — and how attackers abuse that for silent privilege escalation.

The disk Group: The Quietest Root Shell

The disk Group: The Quietest Root Shell You'll Ever Hand Out

Why one throwaway usermod command can be worse than giving someone your root password.

I Just Cleared the CRTA Exam

I Just Cleared the CRTA Exam — Here's Everything I Wish Someone Had Told Me

My honest, unfiltered journey through one of the most intense red-team certifications out there.

VulnHub DC-8 Walkthrough

VulnHub DC-8 Walkthrough: The Ultimate Learning Experience

A full walkthrough of the DC-8 VulnHub box — enumeration through to root, for educational purposes only.

VulnHub DC-7 Walkthrough

VulnHub DC-7 Walkthrough: Advanced Drupal Exploitation

Exploiting a vulnerable Drupal install on the DC-7 VulnHub box, from initial foothold to privilege escalation.

Metasploitable 3 Write-up Part XII

Metasploitable 3 (Windows) Write-up — Part XII: Double Trouble on Port 8585 (WebDAV + WordPress)

Chaining a WebDAV misconfiguration and a vulnerable WordPress install for a foothold on Metasploitable 3.

Metasploitable 3 Write-up Part XI

Metasploitable 3 (Windows) Write-up — Part XI: Port 8484 — Jetty Server Web Application

Exploiting an exposed Jetty web application on port 8484 as part of the ongoing Metasploitable 3 series.

Metasploitable 3 Write-up Part X

Metasploitable 3 (Windows) Write-up — Part X: Port 8282 — Tomcat Directory Traversal & Credential Access

Using a Tomcat directory traversal flaw to pull credentials and move deeper into the Metasploitable 3 environment.

Metasploitable 3 Write-up Part XIII

Metasploitable 3 (Windows) Write-up — Part XIII: Port 9200 — Leveraging Elasticsearch

Abusing an unauthenticated Elasticsearch instance on port 9200 to gain further access in the Metasploitable 3 series.

Metasploitable 3 Write-up Part IX

Metasploitable 3 (Windows) Write-up — Part IX: Port 5985 — Windows Remote Management Exploitation

Abusing exposed WinRM on port 5985 for remote command execution on Metasploitable 3.

View all articles on Medium