SYSTEM_ONLINE // GCP SECURITY & BUG HUNTING

Securing Cloud Infrastructure & Uncovering Web Vulnerabilities.

SureshKumar | Computer Engineer | GCP Cloud Security | Independent Bug Hunter (HackerOne, Bugcrowd)

View Security Research Contact Me
0+
Validated Reports
0+
Tested Platforms
0
GCP Badges
zsh — sureshkumar@gcp-sentinel:~
$ status: OPEN TO WORK
$ focus: GCP Security, Web App Security, OWASP Top 10
$ platforms: HackerOne | Bugcrowd | Intigriti
# Type 'help', 'skills', 'nobroker', 'clear' or 'matrix' below:
>
01 // AUDIT PROFILE

About SureshKumar

Bridging Computer Engineering, Database Management, and Cloud Offensive Security.

Hi, I'm SureshKumar. With a strong foundational background in Computer Science Engineering (BE) and hands-on experience in Database Administration (PostgreSQL & MySQL), I specialize in dissecting complex systems to identify architectural security flaws and cloud configuration risks.

My journey evolved from managing enterprise databases and technical analysis into active offensive security research. Today, I focus on Google Cloud Platform (GCP) Security Architecture, web application penetration testing, and independent bug hunting across leading global disclosure platforms.

Core Philosophy: "Security is not a single layer, but a continuous chain of validated configurations, robust access controls, and deep vulnerability research."
Practical Bug Hunting
Uncovering high-severity business logic flaws, IDORs, and auth bypasses.
GCP Security Arch
Auditing IAM roles, storage buckets, CSPM, and Cloud Audit Trail logs.
Web App Pentesting
Systematic testing against OWASP Top 10 vulnerabilities and API flaws.
DBA & Access Control
Deep knowledge in SQL, query optimization, and relational database privilege isolation.
SureshKumar - Cloud Security Specialist Avatar
SURESH KUMAR
Cloud Security Specialist & Bug Hunter
02 // ARSENAL

Skills & Toolkit Grid

Categorized competencies spanning cloud security, penetration testing, database systems, and security tooling.

Google Cloud Platform
Cloud & Infra
Proficiency 92%
GCP IAM Cloud Armor CSPM Audit Logs
IAM & Cloud Security Posture
Cloud & Infra
Proficiency 90%
Least Privilege Service Accounts Bucket Security
OWASP Top 10 & Web Pentest
Security Testing
Proficiency 95%
IDOR SQLi XSS CSRF SSRF
Vulnerability Assessment
Security Testing
Proficiency 88%
Business Logic Auth Bypass Responsible Disclosure
PostgreSQL & MySQL
Databases & Systems
Proficiency 89%
Query Tuning Access Control Replication Hardening
Linux Systems & Scripting
Databases & Systems
Proficiency 87%
Bash Python Security Log Analysis
Burp Suite Professional
Security Tools
Proficiency 94%
Repeater/Intruder Turbo Intruder Autorize
Nmap, Wireshark & Metasploit
Security Tools
Proficiency 91%
Network Mapping Packet Inspection SQLmap
03 // DISCLOSURES & RECOGNITION

Hall of Fame & Research

Responsible vulnerability disclosures, security advisories, and platform recognition.

FEATURED CASE STUDY

NoBroker.com Vulnerability Disclosure

Identified and responsibly disclosed a critical authorization flaw (IDOR) impacting user endpoint data. Provided detailed proof-of-concept steps, remediation guidelines, and validated the hotfix patch alongside the security team.

TARGET
NoBroker.com
SEVERITY
HIGH (CVSS 8.5)
STATUS
RESOLVED & PATCHED
NoBroker Vulnerability Badge
0
Validated Security Reports
0
Tested Applications & Infra
0
Cloud & Security Certifications
0%
Responsible Disclosure Rate
HackerOne Profile Bugcrowd Research Intigriti Hall of Fame
04 // CAREER PATH

Professional Journey

A chronological timeline from Computer Science Engineering to Cloud Security Specialist.

2022 – PRESENT

Independent Security Researcher & Bug Hunter

HackerOne | Bugcrowd | Intigriti

Conducting web application penetration testing, API vulnerability assessments, and GCP cloud environment security audits. Disclosed high-impact bugs (including NoBroker.com) with 100% adherence to disclosure guidelines.

2019 – 2022

Freelance Technical & Database Analyst

Independent Contracting

Managed database administration (PostgreSQL, MySQL), query optimization, access control policies, and server hardening for SMB clients. Developed custom data validation & audit scripts.

CONTRACTUAL

Research Analyst

RR Donnelley

Analyzed structured technical data, performed rigorous compliance checks, and audited documentation workflows for high-volume enterprise projects.

GRADUATED 2019

BE in Computer Science & Engineering

Computer Engineering Degree ('19)

Graduated with a strong foundation in computer networks, operating systems, database management systems (DBMS), software engineering principles, and cryptography.

05 // INTERACTIVE SANDBOX

Security Research Lab

Interactive payload encoder/decoder tool for security researchers & developers.

06 // TRANSMISSION

Send Encrypted Message

Reach out to SureshKumar for security consulting, cloud security audits, or bug bounty collaboration.

PGP KEY FINGERPRINT
4A8F 9C21 3D7B 108E 94F2 :: 80B1 C742 E91A 550D
Generating RSA 4096-bit Payload Key...
DISCLOSURE REPORT: NoBroker.com
VULNERABILITY ID: VULN-2023-NB01

Insecure Direct Object Reference (IDOR) in User API Endpoint

TARGET
NoBroker.com
SEVERITY
HIGH (CVSS 8.5)
REWARD
Bounty & Hall of Fame

1. Executive Summary

During a security assessment of NoBroker's user management APIs, an IDOR flaw was identified within the profile management microservice. An authenticated user could manipulate the `user_id` query parameter in API requests to inspect and modify unauthorized user attributes.

2. Proof of Concept (PoC)

GET /api/v2/user/profile?id=1049582 HTTP/1.1
Host: www.nobroker.in
Authorization: Bearer [ATTACKER_TOKEN]

The server failed to validate whether the token owner matched the requested `user_id`, returning confidential account information.

3. Remediation & Patch Verification

Recommended implementing server-side session claim validation matching `sub` claims against the requested resource. The engineering team deployed a hotfix within 48 hours and verified the patch.

CYBER_CLI INTERACTIVE TERMINAL
=== CYBER SECURITY CLI v2.4 (SureshKumar - GCP & OFFENSIVE RESEARCH) ===
Type 'help' to see list of available commands.
sureshkumar@gcp-terminal:~#