Vinit Lakra profile photo 1 on Tal

Vinit Lakra

Application Security Consultant | Android & iOS | Web & API | AI/LLM Security | 15+ CVEs | 35+ HoF | CRTP | eMAPT | CMPen-Android

Bengaluru

3+ years of work experience

Ampcus Cyber
Apr 20251 yr 4 mosPresent

Bengaluru, Karnataka, India

• Performed 90+ VAPT assessments on Mobile Applications (Android/iOS), identifying critical vulnerabilities and providing remediation guidance. • Bypassed Runtime Application Self-Protection (RASP) controls in fintech and banking Android applications using Frida-based instrumentation • Assessed AI/LLM systems for prompt injection, jailbreaks, RAG pipeline abuse, and sensitive data exposure via model outputs • Chained WebView vulnerabilities to achieve ATO across 3 client applications • Utilized Frida extensively to bypass Root Detection and SSL Pinning / Certificate Validation. • Performed security bypass techniques including: – Intent Redirection – WebView Exploitation – Deeplink exploitation & security checks bypass • Conducted penetration testing for Web Applications, APIs, Thick Client applications, and Python-based SCR (Source Code Review) engagements. • Identified and exploited vulnerabilities such as XSS, SSRF, IDOR, RCE, SQLi, Dependency Confusion, XXE, and other OWASP Top 10 issues. • Delivered detailed security reports, POCs, and collaborated with engineering teams to ensure secure patching and architecture improvements. • Enhanced overall security posture by identifying misconfigurations, insecure APIs, and platform-level weaknesses across diverse environments.
Deloitte
May 20241 yrApr 2025

Bengaluru, Karnataka, India

• Performed comprehensive penetration testing across multiple enterprise applications. • Developed custom Frida scripts to bypass root detection, SSL pinning, and biometric authentication in controlled testing environments • Executed security assessments for Web, API, Mobile (Android/iOS), and Thick Client applications, identifying issues such as IDOR, SSRF, SQLi, RCE, and business logic vulnerabilities. • Conducted Azure configuration reviews, ensuring secure setup of cloud resources and identity controls. • Designed and developed a Capture the Flag (CTF) challenge used for internal hiring and technical evaluations within the organization. • Delivered detailed VAPT reports, proof-of-concepts, and remediation guidance to development and architecture teams. • Collaborated with cross-functional teams to ensure timely fixes, secure coding practices, and overall security hardening.
AbnerSecurity
Oct 20238 mosMay 2024

Remote

• Trained 100+ students in Android Application Penetration Testing, covering advanced exploitation techniques and secure development practices. • Delivered hands-on labs and real-world scenarios, enabling students to practice and understand practical attack chains used in modern mobile pentesting. • Conducted deep-dive sessions on Android exploitation topics including: – Intent Redirect exploitation – RCE via third-party context misuse – Content Provider vulnerabilities leading to SQL Injection and Path Traversal – WebView exploitation & insecure WebView configurations – Deeplink exploitation & insecure routing – Pending Intent misuse and privilege escalation • Created vulnerable code snippets and guided students on analyzing insecure components to build strong exploit reasoning. • Assisted students in Android bug bounty hunting, teaching methodology, reconnaissance, crafting POCs, and writing impactful reports. • Provided personalized mentorship on Frida scripting, reverse engineering, static/dynamic analysis, and Android security best practices.
TMG Security
Mar 20238 mosOct 2023

Remote

Photoshooto
Apr 20222 mosMay 2022

As a Team Leader, my responsibilities are : - Mentoring a group of 10 members - Giving Tasks related to Web security and providing guidance if they face any technical difficulties. - Taking interviews of new hires. - Taking frequent feedbacks from the team and reporting their concerns to the higher management.
Photoshooto
Feb 20223 mosApr 2022

Education

Bachelor's degree, Computer Application

DR. SHYAMA PRASAD MUKHERJEE University, Ranchi

20203 yrs2023

Join Vinit and 10k+ other professionals on

Tal Boss

Tal is the app where bosses meet engineers & builders directly, without middlemen

Download Tal Boss

Vinit Lakra on Tal

Headline

Application Security Consultant | Android & iOS | Web & API | AI/LLM Security | 15+ CVEs | 35+ HoF | CRTP | eMAPT | CMPen-Android

About

Application Security Consultant specializing in Web, API, Mobile (Android & iOS), and AI/LLM security assessments for fintech, banking, and enterprise clients. 🔴 What I Do: ✅ Android & iOS penetration testing — RASP bypass, WebView ATO chains, intent redirection, deep link exploitation ✅ Web & API security — IDOR, SSRF, auth bypass, SQLi, business logic flaws ✅ AI/LLM red teaming — prompt injection, jailbreaks, RAG pipeline abuse, sensitive data leakage ✅ Source code review — Python, Java, Kotlin security audits 🏆 Recognition: - 15+ CVEs acknowledged on Patchstack - 35+ Hall of Fame — Red Hat, Sony, Philips, ZOHO, Deutsche Telekom (80+ vulnerabilities reported) 🔬 Open Source Contributions: - Merged CVE-2018-20463 Nuclei detection template → projectdiscovery/nuclei-templates (12.5k ★) 🛠️ Tools: Burp Suite • Frida • MobSF • Objection • APKTool • ADB • Jadx • dex2jar • Reqable • Postman 📜 Certifications: CRTP | eMAPT | CMPen-Android | CMPen-iOS | eJPTv1 Open to Application Security Consultant / Mobile Security / Product Security roles — feel free to connect or message here on LinkedIn.

Location

Bengaluru

Work experience

Security Consultant at Ampcus Cyber, Apr 2025 - Present · 1 yr 4 mos, Bengaluru, Karnataka, India, • Performed 90+ VAPT assessments on Mobile Applications (Android/iOS), identifying critical vulnerabilities and providing remediation guidance. • Bypassed Runtime Application Self-Protection (RASP) controls in fintech and banking Android applications using Frida-based instrumentation • Assessed AI/LLM systems for prompt injection, jailbreaks, RAG pipeline abuse, and sensitive data exposure via model outputs • Chained WebView vulnerabilities to achieve ATO across 3 client applications • Utilized Frida extensively to bypass Root Detection and SSL Pinning / Certificate Validation. • Performed security bypass techniques including: – Intent Redirection – WebView Exploitation – Deeplink exploitation & security checks bypass • Conducted penetration testing for Web Applications, APIs, Thick Client applications, and Python-based SCR (Source Code Review) engagements. • Identified and exploited vulnerabilities such as XSS, SSRF, IDOR, RCE, SQLi, Dependency Confusion, XXE, and other OWASP Top 10 issues. • Delivered detailed security reports, POCs, and collaborated with engineering teams to ensure secure patching and architecture improvements. • Enhanced overall security posture by identifying misconfigurations, insecure APIs, and platform-level weaknesses across diverse environments.

Security Analyst at Deloitte, May 2024 - Apr 2025 · 1 yr, Bengaluru, Karnataka, India, • Performed comprehensive penetration testing across multiple enterprise applications. • Developed custom Frida scripts to bypass root detection, SSL pinning, and biometric authentication in controlled testing environments • Executed security assessments for Web, API, Mobile (Android/iOS), and Thick Client applications, identifying issues such as IDOR, SSRF, SQLi, RCE, and business logic vulnerabilities. • Conducted Azure configuration reviews, ensuring secure setup of cloud resources and identity controls. • Designed and developed a Capture the Flag (CTF) challenge used for internal hiring and technical evaluations within the organization. • Delivered detailed VAPT reports, proof-of-concepts, and remediation guidance to development and architecture teams. • Collaborated with cross-functional teams to ensure timely fixes, secure coding practices, and overall security hardening.

Cyber Security Trainer at AbnerSecurity, Oct 2023 - May 2024 · 8 mos, Remote, • Trained 100+ students in Android Application Penetration Testing, covering advanced exploitation techniques and secure development practices. • Delivered hands-on labs and real-world scenarios, enabling students to practice and understand practical attack chains used in modern mobile pentesting. • Conducted deep-dive sessions on Android exploitation topics including: – Intent Redirect exploitation – RCE via third-party context misuse – Content Provider vulnerabilities leading to SQL Injection and Path Traversal – WebView exploitation & insecure WebView configurations – Deeplink exploitation & insecure routing – Pending Intent misuse and privilege escalation • Created vulnerable code snippets and guided students on analyzing insecure components to build strong exploit reasoning. • Assisted students in Android bug bounty hunting, teaching methodology, reconnaissance, crafting POCs, and writing impactful reports. • Provided personalized mentorship on Frida scripting, reverse engineering, static/dynamic analysis, and Android security best practices.

Security Analyst at TMG Security, Mar 2023 - Oct 2023 · 8 mos, Remote

Team Lead at Photoshooto, Apr 2022 - May 2022 · 2 mos, As a Team Leader, my responsibilities are : - Mentoring a group of 10 members - Giving Tasks related to Web security and providing guidance if they face any technical difficulties. - Taking interviews of new hires. - Taking frequent feedbacks from the team and reporting their concerns to the higher management.

Cyber Security Intern at Photoshooto, Feb 2022 - Apr 2022 · 3 mos

Education

Bachelor's degree, Computer Application, DR. SHYAMA PRASAD MUKHERJEE University, Ranchi

Vinit Lakra - Security Consultant in Bengaluru | Tal