SIMULATING ATTACKS.HARDENING DEFENSES.
OSCP, OSCP+, and CRTA certified Offensive Security Engineer with 1.5+ years of hands-on experience in penetration testing, red team operations, and adversary simulation across web, mobile, and Active Directory environments.
Kshitiz Kumar
Offensive Security Engineer
Levithan Technologies
Adversary simulation, MITRE ATT&CK mapping, and OWASP-aligned exploitation across enterprise environments.
Red Team Analyst & Offensive Security Engineer
I'm an Offensive Security Engineer with 1.5+ years of experience at Levithan Technologies, specializing in adversary simulation, privilege escalation, and penetration testing across web, mobile, Active Directory, and cloud environments. I hold the OSCP, OSCP+, and CRTA certifications. My experience includes executing high-impact VAPT engagements for government and enterprise clients — including critical infrastructure and toll-management systems — delivering professional, STQC/IHMCL-compliant security reports.
In addition to penetration testing, I focus on security engineering and automation. I design and build internal tools to streamline offensive operations, including Vulnessus (an enterprise-grade vulnerability management platform built with Rust and Axum) and a modular DPDP Act compliance scanner. I specialize in developing Python automation scripts, Cobalt Strike profiles, and custom exploit payloads that map directly to the OWASP Top 10 and MITRE ATT&CK frameworks to help organizations proactively secure their attack surface.
Kshitiz Kumar
Offensive Security Engineer
Full-time @ Levithan Technologies
My Expertise
Specializing in offensive security, application testing, threat intelligence, security engineering, and continuous research.
Web & Mobile Pentesting
Manual and automated penetration testing for government and enterprise applications, identifying critical OWASP Top 10 vulnerabilities.
Active Directory & Red Teaming
Multi-stage intrusion testing, pivoting, and Active Directory attacks leveraging BloodHound, Mimikatz, Cobalt Strike, and Impacket.
Offensive Security Automation
Developing automated threat intelligence, reconnaissance, and vulnerability correlation pipelines in Python and Rust to reduce triage time.
Security Engineering
Architecting enterprise security scanners, compliance scanner modules (like DPDP Act), and internal reporting frameworks.
Exploit Development & VAPT
Reconnaissance, vulnerability correlation, exploit modification, and compliance-aligned reporting under MITRE ATT&CK.
Want to learn more about my security approach?
View My WorkTactical Playbooks & References
An open-source repository of documentation, command cheat-sheets, and defense benchmarks. Built directly from active engagements, VAPT operations, and offensive security research.
My Work
Public tools and research I can share openly, plus a summary of 50+ professional engagements delivered under client NDAs.
Open Source & Public Projects
AD-Void — Active Directory Attack Cheat Sheet
A living reference for Active Directory offensive security — attack notes, Kerberos and LDAP abuse paths, scenario walkthroughs, and red team blog posts mapped to real-world AD engagements.
DPDP Act Compliance Scanner
A Python-based automated privacy scanner architecture implementing a 23-rule coverage matrix, analogous CVSS scoring, and seamless integration as a Vulnessus plugin.
Phishing Detection System
A Python-based multi-factor phishing URL detector achieving 95% accuracy through URL heuristics, WHOIS analysis, and threat intelligence feed correlation.
Vulnessus — Enterprise Vulnerability Scanning Platform
A high-performance full-stack vulnerability management platform utilizing a Rust (Axum) backend, Python dynamic plugin execution via PyO3, Elasticsearch, and AES-256-GCM credential encryption.
50+ Engagements Under NDA
Professional security engagements delivered under client NDAs — scope, findings, and deliverables are confidential. The categories below represent real professional work — anonymized by sector and engagement type.
Enterprise Web Application VAPT
Full-scope black-box and grey-box penetration testing for business-critical web platforms, covering authentication, authorization, injection, and business logic flaws.
Mobile Application Security Assessments
Static and dynamic analysis of Android and iOS applications — insecure storage, certificate pinning bypass, API abuse, and runtime manipulation.
Active Directory & Red Team Operations
Multi-stage internal network assessments with privilege escalation, lateral movement, and domain compromise paths mapped to MITRE ATT&CK.
7 more engagement categories on the full projects page
What People Say
Feedback from colleagues and collaborators I've worked with on security projects.
"Kshitiz brings a pragmatic approach to security challenges, combining technical depth with practical solutions. His red team reports are thorough and directly actionable."
"Outstanding work on vulnerability assessments and security automation. Kshitiz identified critical issues our internal team had missed and helped us close them fast."
"Excellent understanding of both offensive and defensive security. Kshitiz is a strong communicator who translates complex findings into business risk clearly."
"Kshitiz delivered a thorough mobile app security assessment with detailed findings and clear remediation guidance. A reliable and skilled security professional."
Want to work together? Let's talk
Frequently Asked Questions
Have any other questions? Feel free to reach out!
Still have questions?
I'm always happy to discuss your security needs and how I can help.
Get in TouchLet's Harden
Your Attack Surface
OSCP, OSCP+, and CRTA certified offensive security engineer with 1.5+ years delivering VAPT, red team, and adversary simulation for government and enterprise clients — including 50+ engagements under NDA.
Share your scope, environment, and compliance requirements — web, mobile, AD, cloud, or critical infrastructure. I'll follow up with availability, approach, and next steps within 1–2 business days.
Based in Faridabad, Haryana, India. Open to remote engagements across India and selective international consulting. Detailed reports and scoping calls available on request.
Direct Contact
- Emailakshitizk21@gmail.com
- Phone+91-8178471289
- LocationFaridabad, Haryana, India
- LinkedInConnect professionally
- GitHubOpen-source security tools
Engagement Types
Web & API Pentesting
Black-box and grey-box testing mapped to OWASP Top 10 and business logic flaws.
Mobile App Security
Android and iOS assessments — runtime analysis, API abuse, and insecure storage.
Active Directory & Red Team
Internal network intrusion, privilege escalation, and adversary simulation.
Critical Infrastructure VAPT
High-criticality government and enterprise audits with compliance-aligned reporting.
Cloud & Container Reviews
IAM misconfigurations, exposed services, and container escape path analysis.
Security Automation
Custom recon pipelines, reporting workflows, and offensive tooling in Python or Rust.