Download CV

Rojit Lamichhane

Junior penetration tester focused on web application security.

I find vulnerabilities in web apps and networks, prove they are real, score them with CVSS, and write up how to fix them. I also build detection tools, so I know how defenders see an attack.

Download CV (PDF) View projects GitHub

About

BSc (Hons) graduate in Ethical Hacking and Cybersecurity.

I am a cybersecurity graduate from Softwarica College of IT & E-Commerce (Coventry University) with hands-on experience in penetration testing, vulnerability assessment and security monitoring.

My daily toolkit is Burp Suite, OWASP ZAP, Nmap and Metasploit on Kali Linux, backed by Python and Bash to automate the repetitive parts. I test against the OWASP Top 10 and document every finding with evidence, severity and a practical fix.

I also work on the defensive side with Wireshark, Suricata, Splunk and Wazuh, which helps me explain risk in terms both attackers and defenders understand.

  • Looking forJunior Pentester / Web Security / Junior SOC
  • Based inDhulikhel, Kavre, Nepal
  • DegreeBSc (Hons) Ethical Hacking & Cybersecurity
  • LanguagesEnglish, Nepali
  • Latest certificationTryHackMe Junior Penetration Tester

Projects

Web security work first, followed by detection and tooling projects.

Web Application Penetration Testing

OWASP Top 10 | lab environments

End-to-end testing of web applications in controlled labs: map the attack surface, find vulnerabilities, exploit them to prove impact, then report.

  • Tested for SQL injection, XSS, CSRF, broken access control and authentication weaknesses.
  • Manual testing with Burp Suite (Proxy, Repeater, Intruder); automated scanning with OWASP ZAP.
  • Scored findings with CVSS 3.1 and wrote reproduction steps with remediation advice.
  • Burp Suite
  • OWASP ZAP
  • SQLi
  • XSS
  • CSRF
  • CVSS 3.1

Vulnerability Remediation and Secure Coding

Fix and verify | PHP, JavaScript, Python

Finding a bug is half the job. I patch vulnerable code, then re-test to confirm the fix actually closes the hole.

  • Parameterised queries to stop injection, output encoding against XSS, anti-CSRF tokens on state-changing requests.
  • Before-and-after re-testing to verify each fix.
  • Secure coding
  • Input validation
  • Re-testing

Network Vulnerability Assessment

Recon and exploitation | Kali Linux

  • Host discovery, service enumeration and vulnerability assessment with Nmap.
  • Exploit validation with Metasploit; findings prioritised by risk and documented with recommendations.
  • Nmap
  • Metasploit
  • Kali Linux

NETRA: Hybrid IDS

Suricata + Isolation Forest

A lightweight intrusion detection system for resource-constrained networks. It pairs signature-based detection with anomaly detection, and ships a real-time React dashboard, alert correlation, CVSS 3.1 scoring, SHAP explainability and automated or manual IP blocking.

  • Suricata
  • FastAPI
  • React
  • PostgreSQL
  • scikit-learn

Security Monitoring and SIEM Simulation

Traffic analysis | Wireshark

Investigated network traffic to spot anomalous activity, unauthorised access attempts and indicators of compromise, then documented the investigation and recommended remediation.

  • Wireshark
  • Splunk
  • Wazuh

Custom Security Tools

Python | cryptography

A Python port scanner for automated reconnaissance, plus an AES-encrypted password manager and a file-encryption utility.

  • Python
  • AES
  • Sockets

Docker Security Lab

Isolated environments

Disposable Docker environments for controlled vulnerability analysis and system-hardening practice, so testing stays safe and repeatable.

  • Docker
  • Hardening
  • Linux

Skills

Offensive skills first, with detection and engineering skills behind them.

Penetration testing

  • Web app testing
  • OWASP Top 10
  • Vulnerability assessment
  • Network recon
  • Exploitation
  • CVSS 3.1
  • Reporting

Offensive tools

  • Burp Suite
  • OWASP ZAP
  • Nmap
  • Metasploit
  • Kali Linux

Monitoring and detection

  • Wireshark
  • Suricata
  • Splunk
  • Wazuh
  • Log analysis
  • Alert triage

Code and platforms

  • Python
  • Bash
  • JavaScript
  • PHP
  • C
  • Assembly
  • Docker
  • FastAPI
  • React
  • PostgreSQL

Systems and networking

  • Windows 11
  • Windows Server 2019
  • Ubuntu
  • TCP/IP
  • DNS
  • VPN
  • Firewalls

How I work

  • Structured investigation
  • Attention to detail
  • Clear technical writing
  • Continuous learning

Credentials

 

Education

  • BSc (Hons) Ethical Hacking & CybersecuritySoftwarica College of IT & E-Commerce, affiliated with Coventry University, Kathmandu, Nepal

Certifications

  • Junior Penetration TesterTryHackMe, 2024
  • CCEP2024
  • Cisco Networking BasicsCisco Networking Academy, 2023

Let's talk

Open to junior penetration testing, web application security and entry-level security operations roles.

rojit57270@gmail.com
Download CV (PDF) github.com/roseiiitt +977 9746441870