Executive Dossier • Police Forensics • Credentials • AUTHENTIX Flagship • Tool Arsenal • Skills Matrix • Contact

┌─────────────────────────────────┐  ┌─────────────────────────────────┐  ┌─────────────────────────────────┐
│     ⚖️ Law Enforcement Casework │  │     🏆 Offensive Architecture   │  │    📜 Verified Credentials      │
│  • 15+ Live Police Cases        │  │  • AUTHENTIX Enterprise (v2.1)  │  │  • CEH v13 (EC-Council Accred)  │
│  • ISO/IEC 27037 Chain-of-Cust  │  │  • 34 Invariants · 16 ATO Chains│  │  • Exam ID: ECC8042517936       │
│  • CDR / IPDR & Wireshark PCAP  │  │  • Java 17/21 Offensive Engine  │  │  • CCNA & B.Tech Cyber Security │
└─────────────────────────────────┘  └─────────────────────────────────┘  └─────────────────────────────────┘

I am an Offensive Security Engineer, EC-Council Certified Ethical Hacker (CEH v13), and Security Tool Architect. My tradecraft bridges the gap between deep manual penetration testing (specializing in authorization logic flaws like BOLA/IDOR, OAuth/JWT bypasses, and time-based injection) and custom offensive systems engineering.

Rather than relying purely on off-the-shelf automated scanners that produce noise and false positives, I architect purpose-built offensive software: native Java 17/21 Burp Suite Montoya extensions with deterministic state-machine invariant tracking, statistical Interquartile Range (IQR) blind SQL injection engines, and context-aware headless browser DOM XSS validation engines. Grounded in live forensic investigations with the Cyber Police Station, Nashik Police Commissionerate, I evaluate security postures with an attacker's ingenuity and evidentiary precision.

Jan 2026 – May 2026 | Nashik, Maharashtra, India

• Live Cybercrime Investigations: Investigated 15+ live cybercrime, unauthorized server intrusion, identity theft, and multi-lakh financial fraud cases alongside senior cyber cell officers, strictly enforcing Chain of Custody standards aligned to ISO/IEC 27037.
• Packet-Level Traffic Reconstruction: Conducted deep packet inspection and network stream analysis using Wireshark to reconstruct malicious HTTP/TCP sessions, uncover command-and-control (C2) communication patterns, and isolate malware payload delivery vectors.
• Telecom & Digital Evidence Triage: Triaged suspicious Android APK packages, correlated Call Detail Records (CDR) and IP Detail Records (IPDR) telecom intelligence with banking transaction logs, identifying fraudulent payment gateways and compromised endpoints to assist officers in formal charge sheet preparation.

2023 – Present | Pune, India

• Burp Montoya API Engineering: Designed and maintained AUTHENTIX Enterprise, automating multi-tenant authorization testing (BOLA/IDOR) across role and tenant boundaries using deterministic finite-state automata in Java 17/21.
• Statistical Vulnerability Detection: Engineered BlindStrike v7.0.0, eliminating latency noise on unstable networks by applying Interquartile Range (IQR) statistical distribution filtering for time-based blind SQL injection extraction.
• Context-Aware DOM XSS Engine: Developed Reflectra v7.0.0, weaponizing 2,600+ context-prioritized payloads evaluated through headless Chrome dialog interception with zero false positives.
• Reconnaissance Operating System: Built ReconForge v3, a zero-install client-side bug bounty recon engine comprising 30 structured phases and 52,630+ curated dorks.

Autonomous Multi-Tenant Authorization, BOLA/IDOR & Secret Analysis Suite for Burp Suite
(Engineered on PortSwigger Montoya API • Java 17/21 • Deterministic State Machine)

       [ Burp Suite HTTP Proxy / Repeater / Scanner / Intruder ]
                                   │
                                   ▼
                       [ TrafficInterpreter.java ]
                 (Actor Attribution & Flow Classification)
                                   │
         ┌─────────────────────────┴─────────────────────────┐
         ▼                                                   ▼
[ FlowGraphEngine.java ]                        [ TokenLifecycleTracker.java ]
(Per-Actor State Machine)                     (SHA-256 Hashes, Shannon Entropy,
                                                Single-Use, Expiration, JWT)
         │                                                   │
         └─────────────────────────┬─────────────────────────┘
                                   ▼
         ┌─────────────────────────┴─────────────────────────┐
         ▼                                                   ▼
[ InvariantEngine.java ]                        [ FileAnalyzerEngine.java ]
 (34 Formal Invariants)                          (30+ Secret / Logic Rules)
         │                                                   │
         └─────────────────────────┬─────────────────────────┘
                                   ▼
                      [ AttackPathCorrelator.java ]
                (Chains Findings into 16 Compound ATO Graphs)
                                   │
         ┌─────────────────────────┴─────────────────────────┐
         ▼                                                   ▼
[ Burp Suite Modern UI Tabs ]                       [ Telegram Alerts Push ]
  - Findings & Cross-Actor Matrix                     - Zero UI Latency Async
  - Attack Chains Graph Studio                        - Kali cURL PoC Generator
  - 3-Way Differential IDOR Engine                    - Soft-200 Filter

• 🎯 3-Way Differential IDOR / BOLA Engine: Automates cross-actor state substitution across 3 concurrent user sessions with intelligent Soft-200 and customized error suppression (OWASP API1:2023, API5:2023).
• 🛡️ 34 Formal State-Machine Invariants: Deterministic verification of authorization states including OTP replay flaws, session fixation, token Shannon entropy, race conditions, and structural JWT integrity (alg:none, key confusion).
• 🔬 30+ Secret & Token Detection Rules: Real-time stream inspection targeting leaked JWT signing keys, AWS, GCP, Azure, OpenAI, Claude, Stripe, GitHub, Firebase, and SendGrid credentials.
• ⛓️ 16 Compound Attack Chain Rules: Automatically synthesizes discrete low/medium severity vulnerabilities into actionable Account Takeover (ATO) kill-chain graphs.
• 🌐 Documentation & Live Architecture: 👉 https://pratik-khairnar-sec.github.io/authentix-enterprise/

Pratik Sanjay Khairnar
_{⚡ Certified Ethical Hacker (CEH v13) • Offensive Security Engineer • Security Tool Architect ⚡
🌐 pratikkhairnarsec.web.app • ✉️ pratik.khairnar.sec@gmail.com • 💼 LinkedIn Profile • 📞 +91 87999 81052
📍 Pune, Maharashtra, India (Open to Worldwide Relocation)}