Febin Benny

Cybersecurity Enthusiast · Junior Security Analyst

Thrissur, Kerala, India

🛡️ Cybersecurity 🌐 Web Security 🔍 Vuln Research 🐧 Linux 🐍 Python ⚡ Automation 🔒 Network Security 🔎 OSINT

Junior security analyst with hands-on experience in vulnerability research, bug bounty hunting, and web application security testing — including responsibly disclosed Broken Access Control, WAF bypass, and LFI vulnerabilities. I actively build security tools, explore home-lab environments, and develop Python-based automation workflows while continuously expanding into cloud and network defense.

"Learn · Build · Break · Secure"

febinmbenny@gmail.com

linkedin.com/in/febinbenny

GitHub

github.com/Fe3in

Phone (click to show)

+91 8075252709

ls ./projects

Projects

Security tools, automation, and applications built independently.

Breachlabs

Hands-on training platform covering all 10 OWASP Top 10 (2021) categories as self-contained, step-by-step labs in a HackTheBox-style interface. Built using HTML/CSS/JavaScript with a Supabase backend and server-side flag verification via a secured PostgreSQL function.

owasp-top-10supabasejavascript

Cybersecurity Quiz Bot

JavaScript-based Telegram bot delivering interactive cybersecurity quizzes via the Telegram Bot API — featuring task automation, API integrations, and community engagement.

JavaScripttelegram-api

cat ./writeups.log

Writeups

Bug bounty findings and vulnerability research.

Vertical Privilege Escalation via Permission Wildcard Injection

critical · vdp

TARGET: VDP Program · VECTOR: Client-Side Authorization Bypass · IMPACT: Admin Access

Identified a critical broken access control vulnerability where modifying the permissions[] scope array in an authentication response to a wildcard ("*") allowed a standard user to escalate privileges to full administrative access.

Local File Inclusion via Origin IP Disclosure & Cloudflare WAF Bypass

high · bug bounty

TARGET: Bug Bounty Program · VECTOR: Shodan OSINT + Direct Origin LFI · IMPACT: /etc/passwd Disclosure

Discovered a vulnerability chain bypassing Cloudflare WAF via origin IP reconnaissance, leading to direct-to-origin requests that exposed a Local File Inclusion (LFI) vulnerability on an unprotected media endpoint.

whoami --credentials

Education

Academic background and certifications.

Bachelor of Computer Applications (BCA)

University of Calicut, Kerala

NOV 2022

Certifications

Certified Ethical Hacker (CEH)

EC-Council

expired 2025

Google Cybersecurity Professional

Coursera

Google IT Support Professional

Coursera

open ./resume.pdf

Resume

Junior Security Analyst — full resume, viewable inline or as a download.

Download PDF Open in new tab