// SECURITY RESEARCHER | APPSEC & AI

VARUN SINGH

$ whoami — AppSec Researcher

Security Researcher specializing in application security and offensive testing, with growing expertise in AI/LLM system security. Documenting everything — for the community.

VIEW RESEARCH EXPERIENCE CONTACT

vrun@kali:~$

vrun@kali:~$ cat whoami.txt [ OK ] Loading... Name : Varun Singh Chauhan Role : Security Researcher Location : Indore, India Focus : AppSec · AI/LLM · Red Team Platform : HTB · TryHackMe vrun@kali:~$ ls -t certs/ AIWPT_July2026.pdf AIWAPT_July2026.pdf Eschaton_CTF_Certificate.pdf THM_AdventOfCyber.pdf AICLSA_July2025.pdf AICWSE_June2025.pdf AICWSA_Dec2024.pdf vrun@kali:~$ _

01 //

ABOUT

I am a Security Researcher specializing in application security and offensive testing, actively extending my methodology into AI red-teaming and prompt injection testing.

My core competency lies in translating complex technical exploits into actionable business risk. I have a proven Coordinated Vulnerability Disclosure (CVD) track record, including infrastructure-scale findings across 35+ government-linked systems through national CERTs.

Professionally trained in Offensive Security and VAPT at Armour Infosec. I am currently pursuing my MCA at Maharaja Ranjit Singh College while giving back to the community as an active Volunteer at Security BSides Indore.

35+

GOV SYSTEMS

20+

REPORTS

27 WK

HTB STREAK

1200

CTF POINTS

02 //

SKILLS & ARSENAL

Web App Security

OWASP Top 10 Web/API, manual testing methodology, exploitation and report writing.

BURP SUITESQLMAPFFUFCURL

AI/LLM Security

Prompt Injection & Jailbreak Testing, Black-Box Chatbot Behavioral Analysis, and LLM Output-Handling Review.

PROMPT INJECTIONLLMJAILBREAK

Red Teaming

Adversary simulation, attack chain development, evasion, lateral movement.

MITRE ATT&CKMETASPLOITC2

Network Pentesting

Recon, enumeration, protocol attacks, exploitation on internal/external networks.

NMAPWIRESHARKAIRCRACK-NG

Linux Systems

Deep internals, server admin, privilege escalation paths, hardening.

KALIBASHPRIVESC

OSINT & Compliance

Passive/active recon, attack surface mapping, target profiling, and GDPR Compliance.

GDPROSINTCVD PROCESS

03 //

VULNERABILITY DISCLOSURE

CERT.PL / DEVCOMM CMS REMEDIATED

Discovered a critical multi-vector attack chain in a widely deployed government CMS. Identified Unauthenticated Reflected XSS and full database Information Disclosure triggered by breaking query structures, leaving 36 public infrastructure websites vulnerable. Further target profiling via subdomain enumeration exposed 4 new live Sygnalista whistleblower employee portals leaking highly classified PII and directly violating GDPR. Coordinated remediation directly through CERT.PL to secure all production assets.

UNAUTH XSS QUERY INJECTION GDPR / PII LEAK SUBDOMAIN ENUM

VIEW WRITE-UP ↗

PUBLIC AI CHATBOT ASSESSMENT BEHAVIORAL ANALYSIS

Conducted structured black-box prompt injection and behavioral testing on a production public AI chatbot. Used targeted prompting to surface internal function/tool names not intended for user disclosure, and identified inconsistent reliability between fabricated and genuine live-data responses. Applied hypothesis-driven testing with independent ground-truth verification to confirm findings and rule out false positives.

PROMPT INJECTION BLACK-BOX LLM SECURITY

GLOBAL AGENCY REPORTS 20+ REPORTS

Submitted over 20+ independent vulnerability reports to national agencies including NCSC-NL, NCSC.CH, and CERT.PL, as well as directly to corporate asset owners. Successfully identified and triaged critical vulnerabilities encompassing advanced SQLi, Unauthenticated Reflected XSS, Authentication bypasses (ATO), sensitive Information Disclosure, and complex flaws in core business logic.

SQLi / XSS BUSINESS LOGIC AUTH FLAWS NCSC-NL / NCSC.CH

04 //

EXPERIENCE & ACADEMICS

NOV 2025 — PRESENT

Independent Security Analyst

Self-Directed Research

Conducting high-impact VAPT on live public infrastructure and enterprise SaaS platforms. Spearheading CVD processes with international CERTs, and extending offensive methodologies into AI/LLM chatbot testing.

JAN 2026 — PRESENT

Conference Volunteer

Security BSides Indore 2026

Assisting with community engagement and coordination for Central India's premier cybersecurity conference.

2025 — 2026

Cybersecurity Trainee

Armour Infosec

Executed manual VAPT and network auditing. Drafted technical remediation reports and completed the full expert training program.

EXPECTED 2027

Master of Computer Applications (MCA)

COMPLETED 2024

Bachelors

ACTIVE TRAINING

Hack The Box: Active Silver Subscriber maintaining a 27-week continuous streak focused on practical machine compromise and privilege escalation. Pursuing official HTB certification tracks.

VIEW CERTS

05 //