Skip to content

$ whoami

Prayush Hada

SOC Analyst & Security Researcher

Building toward vulnerability research and systems/kernel security through structured study and independent low-level systems programming.

$ ls ./focus

  • detection-eng/
  • low-level-systems/
  • vulnerability-research/
  • ctf/
view CVgithublinkedinemail
Nepal CTF leaderboard (CTFtime)
4th
reduction in MTTD, automated triage
~85%
vulnerabilities disclosed & fixed
2
NahamCon 2025 — of 2,944 teams
153rd
01about

About

Cybersecurity professional with hands-on experience in SOC operations, detection engineering, and penetration testing. Currently SOC L1 Analyst at CryptoGen Nepal and a founding member of Y3ti@Sec, a Nepal-based CTF team competing internationally in pwn, web, reverse engineering, and forensics.

Most of that independent work is low-level: a DNS resolver written from scratch against RFC 1035, an ARP spoofing toolkit built on raw AF_PACKET sockets and libpcap, and a multithreaded LAN transfer utility in Rust. Working close to the wire is what pulled me toward detection engineering on one side and vulnerability research on the other.

As a founding member of Y3ti@Sec I compete in pwn, web, reverse engineering, and forensics, and I maintain the team's GZCTF competition platform — including hosting Kavach CTF with NCIT College. The team currently sits 4th on Nepal's CTFtime leaderboard.

currently
SOC L1 Analyst — CryptoGen Nepal
based
Bhaktapur, Nepal
education
Medhavi College, Pokhara University · 08/2023 — 08/2027
focus
Vulnerability research & systems/kernel security
02experience

Experience

Detection and response on the defensive side, competition and low-level systems work on the other.

  1. SOC L1 Analyst

    CryptoGen Nepal

    Dec 2025 — PresentKathmandu, Nepal

    • Monitor, triage, and investigate security events from SIEM, firewalls, and IDS/IPS — determine scope and impact, and document findings in detailed incident reports.
    • Automate incident-handling workflows, including scripts that programmatically detect and assign alerts via SIEM APIs, resulting in an ~85% average reduction in Mean Time to Detect (MTTD).
    • Develop and tune detection and monitoring rules across LogPoint and FortiSIEM to reduce false positives and improve alert accuracy.
    • Work within NIST/ISO 27001-aligned SOC processes for incident handling and reporting.
    • Participate in vulnerability assessments; track findings and coordinate remediation with system owners.
    • Troubleshoot SIEM agent deployment and connectivity issues across mixed Linux environments (Rocky Linux, RHEL, Debian-based systems), ensuring consistent log collection.
    • LogPoint
    • FortiSIEM
    • Wazuh
    • Linux
    • Detection Engineering

  2. Founding Member

    Y3ti@Sec

    May 2025 — PresentNepal

    • Core CTF player focusing on pwn, web, reverse engineering, forensics, and SIEM.
    • Deployed and maintain a GZCTF-based competition platform on a Dokploy/Traefik VPS stack.
    • Hosted Kavach CTF, an inter-college competition run jointly with NCIT College, on the platform.
    • Developed and maintained the team's website and internal resources.
    • Competed in international events such as BlitzCTF, DUCTF, and Hack A Flag, ranking among the top in Nepal.
    • Positioned 4th on Nepal's CTF team leaderboard according to CTFtime.
    • GZCTF
    • Dokploy
    • Traefik
    • pwn
    • Forensics
    ctf.yeticyberops.com.np

  3. Cybersecurity Intern

    Sapience Edu Connect

    Jan 2025 — Feb 2025

    • Set up and configured a security lab with Metasploitable and Kali Linux for vulnerability analysis.
    • Exploited a vsftpd vulnerability using Metasploit and performed privilege escalation.
    • Documented exploitation steps and mitigation measures for training purposes.
    • Metasploit
    • Kali Linux
    • Privilege Escalation
03research

Security Research

Vulnerabilities found outside of paid engagements, reported responsibly, and confirmed fixed by the site owners.

[ fixed ]Cross-Site Scripting

Stored XSS in the user registration flow

mbmmgt.com

Injected payloads persisted through registration and executed on every subsequent dashboard load, giving any authenticated visitor a path to session theft and arbitrary in-origin actions.

Discovered in the user registration flow. Reported to the site owner and confirmed fixed.

[ fixed ]Information Disclosure

Debug-mode information disclosure

mbmgetaway.com

A production Laravel deployment was running with debug mode enabled, exposing a full stack trace with sensitive configuration data — including credentials and application internals — to any unauthenticated visitor.

Identified on a live Laravel deployment. Reported to the site owner and confirmed fixed.

04projects

Projects

Grouped by discipline: the low-level systems work I do to understand the stack, and the security tooling I build on top of it.

Systems & Low-Level Programming

Implemented from the protocol up, in C and Rust.

ARP Spoofing / Detection Toolkit

Toolkit in C for detecting and simulating ARP spoofing, built directly on raw sockets and libpcap rather than on an existing library.

  • C
  • Raw AF_PACKET sockets
  • libpcap
  • Networking

DNS_TOOL2024

A DNS resolver implemented from scratch in C, following RFC 1035.

  • C
  • Raw Sockets
  • DNS
  • RFC 1035

LAN2LANd2025

Cross-platform LAN file transfer utility in Rust with a multithreaded receiver for concurrent transfers, a Zenity GUI on Linux and an interactive CLI.

  • Rust
  • TCP Sockets
  • Zenity
  • Linux

Security Engineering

Production systems that detect and teach.

YetiNELv2

A production mini SIEM with real-time log ingestion, a WebSocket-based live security dashboard, and RBAC/JWT-based access control. Designed, built, and maintained independently, end to end.

  • Real-time log ingestion
  • WebSockets
  • JWT/RBAC
  • Node.js

Phishy2025

Multi-perspective cybersecurity education platform simulating Attacker, Victim, and Defender roles, with RBAC, password strength tracking, secure authentication, and real-time bot simulations driven by probability-based scoring.

  • Laravel 11
  • PHP 8.4+
  • MySQL/PostgreSQL
  • Bootstrap 5.3
  • Node.js
older projects (4)
  • Orrery Web App

    Dynamic 3D solar system simulation built with Three.js for the NASA Space Apps Challenge 2024.

    React · Three.js

  • GitHub Repository Automation

    Python script automating GitHub repository creation and cloning through the GitHub API with customised parameters.

    Python · GitHub API · Automation

  • Packet Sniffer

    Python packet sniffer using socket programming to capture and analyse network traffic for diagnostics.

    Python · Sockets

  • TCP Client-Server

    Simple TCP client-server architecture in Python using socket programming for secure, reliable communication.

    Python · Sockets

05skills

Skills & Tooling

What I reach for, grouped by where it sits in the stack.

Offensive Security & Exploitation

  • Metasploit
  • Burp Suite
  • gdb
  • radare2
  • Wireshark
  • Nmap
  • Tcpdump
  • ExifTool
  • steghide

Defensive / SOC & SIEM

  • Wazuh
  • LogPoint SIEM
  • FortiSIEM
  • Detection Tuning
  • Incident Response

Networking & Systems

  • LAN/WAN
  • DNS
  • Routing
  • IP addressing
  • Netcat
  • libpcap
  • Raw sockets

Programming Languages

  • Python
  • JavaScript (ES6+)
  • Bash
  • PHP
  • C
  • C++
  • Java
  • PowerShell
  • Rust

Other Technical

  • Docker
  • Git
  • GitHub
  • REST APIs
  • Linux (Arch, Kali, Ubuntu Server, Rocky Linux, RHEL)
06credentials

Certifications & Education

certifications

SOC Level 1 Certificate

Feb 2026

TryHackMe

Expires Feb 2029 · SIEM, Splunk, and 4 additional skills

id: THM-PN4VKGTRIZ

Certified AppSec Practitioner (CAP)

Apr 2025

TheSecOps Group

OWASP Top 10 and web application security fundamentals

Student SOC Program Foundations Training

Sep 2025

Microsoft

Cybersecurity fundamentals, Microsoft XDR, and Microsoft Sentinel

Pre Security Certificate

Oct 2025

TryHackMe

Linux 100

Apr 2025

TCM Security

NASA Space Apps Challenge — Participation

Oct 2024

NASA

competitions

  • NahamCon 2025 CTF

    NahamSec

    May 2025

    153rd of 2,944 teams globally

  • Holmes CTF 2025

    Hack The Box

    Sep 2025

  • BlitzCTF 2025

    OffSec

    Jul 2025

  • DownUnderCTF 6

    Tanto Security

    Jul 2025

  • Hack A Flag 2025

    IEEE Computer Society

    Jul 2025

  • Advent of Cyber 2024

    TryHackMe

    Dec 2024

  • MetaCTF Flash CTF

    MetaCTF

    Dec 2024

education

  • Bachelor in Computer System and Information Technology

    Medhavi College, Pokhara University

    08/2023 — 08/2027 · Kathmandu, Nepal

  • +2 Level

    Chanakya College of Management

    04/2021 · Bhaktapur, Nepal

languages

  • NepaliNative
  • EnglishB2
  • JapaneseBasic
07contact

Get in Touch

$ contact --email

reachprayush@gmail.com

Open to conversations about detection engineering, low-level systems work, CTF, or security research — and to the right full-time role.

$ ls ./links