██████╗ █████╗ ███╗ ███╗███████╗███████╗██╗ ██╗
██╔══██╗██╔══██╗████╗ ████║██╔════╝██╔════╝██║ ██║
██████╔╝███████║██╔████╔██║█████╗ ███████╗███████║
██╔══██╗██╔══██║██║╚██╔╝██║██╔══╝ ╚════██║██╔══██║
██║ ██║██║ ██║██║ ╚═╝ ██║███████╗███████║██║ ██║
╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝╚═╝ ╚═╝
I find bugs in things that matter. Started with Linux in school when I was supposed to be studying. Never really stopped.
Commerce background. Self-taught everything else. Currently breaking IoT devices, embedded systems, and whatever fuzzer output lands on my screen.
| CVE | Project | Impact | Severity |
|---|---|---|---|
| - | libp2p-rendezvous (used by IPFS, Ethereum, Filecoin) | Unbounded memory growth → OOM DoS on public P2P discovery servers | 🔴 High |
| Pending | LibreOffice | allocation-size-too-big in HWP parser — attacker-controlled value reaches new[] without bounds check, confirmed DoS |
🟠 Medium |
libp2p in plain English: Any peer could register unlimited fake IDs on a public rendezvous server (a meeting point for decentralized apps). Server runs out of memory, crashes, peer discovery breaks for everyone. Fix: per-peer registration limits.
rapid7/metasploit-framework — world's most used pentesting platform
- PR #20830 — Fixed
Msf::Post::File.statcrashing on non-GNU systems (FreeBSD/BSD). Added behavior-based fallback parser preserving GNU compatibility. - PR #21028 — Fixed
reload_allcrash at globalmsf>prompt when no active module is loaded.
tailscale/tailscale — zero-trust mesh VPN, millions of users
- PR #18286 — Added unit tests for
tsconsensushelpers, fixing flaky CI and preventing regressions in core consensus logic.
Hardware → ESP32, nRF52840, ChipWhisperer, custom firmware
Protocols → MQTT, TLS/mTLS, BLE, JTAG, UART
RE Tools → Ghidra, OllyDbg, binwalk, AFL++, MemorySanitizer
Languages → Python, C, Ruby, Go, Rust (reading)
Domains → IoT security, embedded systems, vuln research, digital twin
I write hands-on security tutorials at iotsec.in — real hardware, real tools, no handwaving.
Current series:
- TLS for IoT Hackers — from cert chains to MITM attacks on live ESP32 devices
- Mirai Botnet — complete source code teardown, 6 parts
- Reverse Engineering with OllyDbg — assembly up, from absolute zero
- Side-channel attacks — stealing AES keys with ChipWhisperer
Started on YouTube videos about hacking at age 15. Couldn't figure out port forwarding. Got 56% in 10th grade.
Did a B.Com because science colleges wouldn't take me. Kept coding anyway. Taught myself Python, C, IoT, embedded systems, fuzzing, RE — all on the side. Built digital twin systems for 10 crore industrial machines. Found bugs in infrastructure used by millions.
Still learning. Always will be.
adhikari.resume@gmail.com · iotsec.in