Nilanjan Chowdhury

Selected for CodeAlpha Cyber Security Internship (July 2026). Completed Task 1: Network Packet Analyzer (Python + Scapy — live traffic capture, protocol detection, HTTP analysis). Completed Task 3: Secure Code Review — audited a vulnerable Flask app, identified 10 vulnerabilities with working PoC exploits (SQLi, Command Injection, Path Traversal, Insecure Deserialization, Broken Access Control, and more), built fully fixed secure version.

Built DIVYASTRA, an automated LLM prompt injection and jailbreak testing framework. Modular adapter architecture (Ollama, OpenAI-compatible APIs, Custom HTTP). 18 payloads across 6 attack categories mapped to OWASP LLM Top 10. Heuristic detection engine with confidence scoring. First real scan: 9/18 payloads flagged VULNERABLE — DAN roleplay jailbreak leaked simulated system prompt. Published Medium article and open-sourced on GitHub.

Reached [0xB] MASTER rank on TryHackMe. Promoted to Diamond League. Top 3% worldwide. 54,000+ points, 88+ rooms completed, 14 badges including 4 Epic badges (Platinum League 1st 0.9%, Sapphire League 1st 0.8%, Defrosted Five 0.3%, Return of the Yeti 0.6%). 365+ day streak.

Installed and ran NVIDIA's Garak LLM security scanner against llama3 via Ollama. Found 50+ vulnerabilities — 100% success rate on ANSI escape probes. Identified key attack vectors: ANSI escape injection, hyperlink generation, green text rendering. Compared Garak (research-grade) vs DIVYASTRA (practical) — distinct use cases confirmed.

Designed and developed a modular Python-based reconnaissance platform capable of recursive website crawling, robots.txt discovery, security header assessment, sensitive endpoint detection, risk scoring, and automated JSON/CSV reporting. Multi-module architecture: crawler, analyzer, reporter, utils. Scanned python.org — 50 pages, timestamped reports.

Competed alone as team Hack4Fun in a 24-hour inter-college CTF. Finished Top 10 with 1521 points against multi-member teams. Solved challenges across Web Exploitation, Cryptography, Steganography, Reverse Engineering and Forensics. 2nd place in prelims out of 54 teams.

Completed all 33 Bandit levels (Linux privilege escalation, SSH, SSL/TLS, cryptography). Progressed through Natas levels 0–25 covering LFI, XOR cookie forgery, file upload RCE, SQLi automation, time-based blind SQLi, session ID brute forcing, and encoding reversal.

Completed the full Web LLM Attacks curriculum. Exploited LLM APIs for excessive agency, OS command injection through LLM, indirect prompt injection + RAG poisoning, XSS + indirect prompt injection chained (iframe payload), SSRF + AI agent + indirect prompt injection, fake vuln report triggering CSRF on /my-account/delete, jailbreak leaking API key, and bypassing AI scanner defenses via "redaction test" reframing.

Completed all Business Logic labs. Expert lab: UTF-7 encoded email parser differential attack — validator sees @ginandjuice.shop, mail server decodes to attacker address. 5 hours of independent research. Carlos deleted.

Completed full XXE curriculum including Expert blind XXE — local DTD repurposing to exfiltrate /etc/passwd via error messages without Burp Collaborator. Also solved XInclude bypass and SVG file upload XXE.

Completed all 8 levels of Lakera's Gandalf challenge including Gandalf the White. Used acrostic poetry technique to extract the final password, then reconstructed remaining characters through permutation and combination. Top 8% worldwide.

Identified critical security exposures on a live production network. Produced a professional-grade security report and formally disclosed to administrators — not exploited.

Received commendation for outstanding performance on Deloitte Australia Cybersecurity Job Simulation. Also completed EY Technology Risk and TATA Cybersecurity Analyst Forage simulations with commendations. IBM SkillsBuild certificate. HackerDNA Rank #475.