whoami → loot → recon → arsenal → prod → exfil
harith@field:~$ whoami
h4rithdI'm Harith Dilshan. I find out how and why systems break, and I don't stop at the fix: I want the root cause.
My work is web, mobile and network penetration testing. Mobile holds a special place: apps that pin, obfuscate and detect, and the scripts it takes to see what they really do. Outside engagements I play CTFs, author Hack The Box machines, debug vulnerabilities down to the instruction, and write it all up on my blog and notes.
Every badge links to its verification page.
harith@field:~$ nmap -sV -p- --open h4rithd
Nmap scan report for h4rithd (h4rithd.com)
Host is up (0.00s latency, always).
PORT STATE SERVICE VERSION
443/tcp open web-appsec Burp Suite, ffuf, feroxbuster, SQLMap · manual-first, chain to impact
5555/tcp open adb Android, jadx, Magisk
27042/tcp open frida Frida · scripted pinning and root-detection bypass, Android + iOS
88/tcp open kerberos Rubeus, Certipy, Impacket
445/tcp open microsoft-ds BloodHound, Mimikatz, Nishang · pivots through Ligolo-ng
1234/tcp open gdbserver Ghidra, Cutter, radare2, dnSpy, GDB + GEF · read the binary
50050/tcp filtered cs-teamserver Cobalt Strike, Covenant, Empire, PowerSploit · still exploring
Nmap done: 1 IP address (1 host up), 7 services, 0 assumptions left untestedTools I needed during engagements, so I built them.
| id | tool | what it does | stack | |
|---|---|---|---|---|
0x01 |
PrecompiledBinaries | Curated precompiled Windows and Linux binaries for AD testing, privesc labs and post-exploitation | PowerShell |  |
0x02 |
VulnStudio | Open-source vulnerability report generation for pentesters and VAPT teams | TypeScript |  |
0x03 |
BurpSuiteCert | Magisk module that installs the Burp CA into Android's system trust store | Shell |  |
0x04 |
CVSS v3.1 Visual Calculator | Burp Suite extension: CVSS v3.1 scoring with an interactive risk meter | Java |  |
0x05 |
RevSh3ll-HTB | Reverse shell generator for Hack The Box, in pure bash | Shell |  |
0x06 |
SecHead | Audits security headers: CSP, HSTS, clickjacking and HTTP hardening | Python |  |
harith@field:~$ ls ~/scripts small tools from the field
| script | does |
|---|---|
| TimeQLInjection | Time-based blind SQLi: databases, tables, columns and data, GET or POST |
| SubD0m | Subdomain fetcher using crt.sh |
| CSPGenPro | Crawls a site and reports the external domains a CSP has to allow |
| csrfb33f | Brute-forcing through CSRF tokens |
| imp-fuzzer | Mass endpoint fuzzing |
| cruNch3r | Mass live-host checks |
| BruteSSH | Bulk SSH login checks |
| UserNameGen | Username lists in common corporate formats |
| awsTokenEx | Pulls temporary AWS credentials out of an env file into ~/.aws |
| FridaOnBoot | Magisk module that starts frida-server as root on every boot |
| KaliKonfiger | Automated Kali Linux setup and customisation |
Off the clock, I build native tools for the machines I work on:
| tool | what it does | stack | |
|---|---|---|---|
| OdinMac | Samsung firmware flashing, rebuilt for Apple Silicon: slot-aware loading, PIT mapping, live Heimdall logs | SwiftUI |  |
| RufusMac | Bootable Windows and Linux USB installers on macOS, with Windows 11 bypass and multiboot | SwiftUI |  |
| RufusPS | The same job from PowerShell, with safe USB selection | PowerShell |  |
| iAppGone | Lists and completely uninstalls macOS apps, Homebrew included · PyPI | Python |  |
Things I built properly and kept online. Most run entirely in your browser: nothing to trust but the code.
| host | what it is | trust model |
|---|---|---|
| bin.h4rithd.com | h4|Bin, a zero-knowledge pastebin. The paste lives inside the link. | AES-256-GCM in the browser · no servers · no tracking |
| passbox.h4rithd.com | PassBox, a password generator | Web Crypto API · nothing stored or sent |
| tools.h4rithd.com | A pentest workbench for encoding, cryptography and analysis | Client-side only |
| vulndb.h4rithd.com | VulnDB: CVE search, CVSS 3 calculator, remediation guidance | Public vulnerability data |
| vulnstudio.com | VulnStudio, report generation for VAPT teams | Open source |
| odinmac.h4rithd.com | OdinMac, a Galaxy flasher for Apple Silicon | Native app · open source |
harith@field:~$ cat ~/.contact
mail hello@h4rithd.com
web https://h4rithd.com
resume https://cv.h4rithd.com
x @h4rithdA security challenge, a research question, or something worth taking apart. I read everything that lands in my inbox.
break / understand / defend · only test what you're authorized to test