Jishnu EC — Cybersecurity Analyst

JISHNU EC

Offensive & Defensive Security Specialist

Penetration Tester · SOC Analyst · OSINT Researcher

View Projects Education & Certifications Research & Papers Get In Touch

jishnu@kali:~$ bash

❯ whoami

jishnu_ec — cybersecurity analyst

❯ cat skills.conf

pentesting = enabled

siem_analysis = enabled

osint = enabled

forensics = enabled

network_sec = enabled

❯ cat profile.conf

location = Kozhikode, Kerala

degree = BCA, Calicut Univ 2025

cert = CSA (EC-Council)

status = OPEN_TO_WORK ●

❯ tip

press / to search notes & research

// this terminal is live — click below and type 'help'

❯

OPEN TO WORK — HIRE ME SOC Analyst · Cybersecurity Analyst · Pentest

SCROLL

01About Me

I'm a cybersecurity enthusiast with a strong foundation in both offensive and defensive security. From understanding how attacks are carried out to building defenses that stop them — I'm passionate about both sides of the field.

My focus areas include penetration testing, privilege escalation, SOC operations, SIEM & log analysis, OSINT, network security, and digital forensics. I believe the best defenders think like attackers — so I invest heavily in understanding real-world attack techniques, not just theory.

I'm ready to contribute as a SOC Analyst or Penetration Tester — bringing a sharp eye for threats, a hands-on technical mindset, and the drive to protect what matters.

👤 Name

Jishnu EC

📍 Location

Kozhikode, Kerala

🎓 Degree

BCA — 2025

🛡️ Cert

CSA

✉ Email

jishnuwhoopofficial
@gmail.com

⌥ GitHub

github.com/Jishnuec

02Skills & Arsenal

● OFFENSIVE

Attack & Penetration

NmapMetasploitBurp Suite HydraNetcatJohn the Ripper NiktoGobusterSQLMap Aircrack-ngDirb

● DEFENSIVE

Detection & Monitoring

SplunkWiresharkOPNsense SIEM & Log AnalysisIncident Response Threat IntelligenceVulnerability Assessment OWASP Top 10TCP/IP & Networking Active DirectoryDigital Forensics VolatilityOSINTCTF Competitions Penetration Testing

// Languages & Scripting

PythonBashHTML / CSSSQL

// Operating Systems

Kali LinuxParrot OSArch LinuxLinux MintUbuntu / DebianWindows Server

// Virtualization & Infra

VirtualBoxDockerOPNsense FirewallVM NetworkingNAT / Bridge ConfigVLAN Setup

// Dev & Workflow

Git & GitHubVS CodeLinux TerminalMarkdown

03Education & Certifications

🎓

Completed

// Core Credential — Priority 01

Bachelor of Computer Applications

Calicut University, Kerala

Duration2022 — 2025

Undergraduate degree covering programming fundamentals, networking, databases, and systems — the foundation everything since has been built on.

Computer ScienceProgrammingNetworking

Foundational degree — no single-file certificate to view

Earned

// Core Credential — Priority 02

Certified SOC Analyst (CSA)

EC-Council

IssuedJun 29, 2026

Validates practical Tier I & II SOC skills — log management, SIEM operations, incident detection, and threat intelligence in real security operations.

SOC OperationsSIEMThreat Detection

View Certificate

🖥️

Earned

// Priority 03

CICSA V3 — Certified IT Infrastructure & Cyber SOC Analyst

RedTeam Hacker Academy

IssuedJun 30, 2026

Covers IT infrastructure fundamentals alongside SOC analyst skills — system administration, network defense, and cyber operations monitoring.

IT InfrastructureSOC AnalystCyber Operations

View Certificate

🔒

In Progress

// Priority 04

Certified in Cybersecurity (CC)

ISC2

StatusIn Progress

Entry-level credential covering the core domains of cybersecurity — security principles, incident response, access control, network security, and security operations.

Security PrinciplesIncident ResponseNetwork Security

In progress — certificate will be added once earned

04Projects

OSINT Tool

InstaGrep

v4.0 — ~3,000 Lines of Code

Professional Instagram OSINT desktop application. Extract public profile data, analyze posting patterns, download media, generate reports. Features dark UI, keyboard navigation, recent searches, activity charts, and multi-format exports.

PythonCustomTkinterInstagrapiMatplotlibPillowOSINT

GitHub Writeup

Recon Framework

ReconFrame

Advanced Reconnaissance Framework — 12 Integrated Tools

Professional-grade reconnaissance framework that unifies 12 security tools with intelligent automation. Features cinematic startup animation, smart IP/domain detection, and beautifully formatted results.

PythonNmapBashANSITerminal UI

GitHub Writeup

Terminal Application

TerminalChat

Anonymous Real-Time Terminal Chatrooms

Anonymous real-time chat rooms from the command line — no account, no signup. Create or join rooms with just a number. Password-protected rooms, admin controls, emoji reactions, typing indicators, DMs. Cross-platform.

GoBubble TeaLipglossAbly SSERenderTerminal UI

GitHub Writeup Medium

🚩 CTF Machine

Udyama (उद्यम)

Linux Privilege Escalation · Intermediate → Advanced · Feb 2026

A custom CTF VM I designed and released — 2 flags (User + Root) focused on Linux privilege escalation, persistence techniques, and incident response mindset. Packaged as Ubuntu OVA for VirtualBox.

LinuxPrivilege EscalationUbuntuVirtualBox OVACTF Design

Download OVA Writeup

🤖 ML / Computer Vision

Driver Vigilance

Real-Time Driver Monitoring & Distraction Detection System

A machine learning–powered driver monitoring system that analyzes live video to detect distracted driving behaviors — phone usage, turning around, reaching to the rear seat — and issues real-time alerts to prevent accidents. Built for drivers, fleet operators, and automotive integration.

PythonOpenCVMachine LearningComputer VisionReal-Time Detection

Writeup

Mood Tracker / Social App

Shitty Human

2,894 Lines of Code

Serverless social web app for daily mood tracking — real-time friend chat, voice notes, and a 13-item achievement system, running entirely on Firebase Auth and Firestore with no backend server. Features custom Firestore security rules as the full access-control layer, real-time listeners, MediaRecorder-based voice messages, Chart.js comparisons, and a complete light/dark theming system.

JavaScriptFirebaseFirestoreSecurity RulesChart.jsMediaRecorder API

Live App GitHub Writeup Docs

05Research, Papers & Write-Ups

📄 Case Study

Shitty Human — Case Study

A case-study style writeup on building a fully serverless social app on Firebase — the trick used to run password auth with no real email address, why Firestore security rules had to double as the entire backend, squeezing 30-second voice notes under Firestore's 1MiB document cap, and a real bug caught between the security rules and the Premium redeem button while writing the piece.

→ Click to read

📘 Documentation

Shitty Human — Engineering Documentation

Full engineering reference for Shitty Human — the complete Firestore data model, a line-by-line security-rules walkthrough, the 13-item Citations achievement system, and known limitations, written straight from the app's own source and rules file.

→ Click to read

🚩 Scenario Walkthrough

SOC Simulator: Introduction to Phishing — TryHackMe Walkthrough

Full walkthrough of TryHackMe's SOC Simulator — triaging five live alerts as a Tier 1 analyst, spotting typosquatted and lookalike-brand phishing domains, and separating true positives from false positives using firewall logs and correspondence review.

→ Click to read

🚩 CTF Writeup

Basic Pentesting — TryHackMe Writeup

Full walkthrough of the Basic Pentesting TryHackMe room — Nmap enumeration, Gobuster, Hydra brute-force, SSH exploitation, and Linux privilege escalation to root.

→ Click to read

📑 Security Report

Calicut University Vulnerability Assessment Report

A professional vulnerability assessment of the Calicut University web platform — identifying security weaknesses, risk ratings, and remediation recommendations.

→ Click to open PDF

📄 Project Writeup

TerminalChat — Technical Writeup

Deep-dive into building an anonymous real-time terminal chat application — architecture, tech stack, challenges, and how SSE-based messaging works across platforms.

→ Click to read

🚩 CTF Writeup

Udyama (उद्यम) — CTF Machine Writeup

Full writeup for the Udyama CTF VM — Linux privilege escalation path, persistence techniques, and solution walkthrough.

→ Click to read

📄 Project Writeup

InstaGrep — Technical Writeup

Deep-dive into building a professional Instagram OSINT tool — architecture, GUI design, data analysis, and ethical constraints.

→ Click to read

📄 Project Writeup

ReconFrame — Technical Writeup

How I built a professional terminal reconnaissance framework — 12 integrated tools, cinematic UI, smart target detection.

→ Click to read

🤖 Project Writeup

Driver Vigilance — Technical Writeup

Deep-dive into building a real-time driver monitoring system — ML model pipeline, distraction detection, alert system design, and safety implications for road accident prevention.

→ Click to read

▶ Video Series

Home Lab Setup Guide

Video series walking through building a cybersecurity home lab — attacker, targets, SIEM integration.

// COMING SOON

📄 Research Paper

Network Threat Detection

Research covering network-based attack detection techniques, traffic analysis, and automated alerting with SIEM platforms.

// COMING SOON

Showing 3 of 12

06Home Labs

● Active Lab

Kali vs DVWA Attack Lab

Kali Linux attacker vs Linux Mint running DVWA. Full red team kill chain with Splunk SIEM monitoring.

Kali Linux DVWA Splunk VirtualBox

Click to read writeup →

⏳ Planned

Active Directory Lab

Windows Server 2019 domain controller — AD enumeration, privilege escalation, pass-the-hash attacks.

// COMING SOON

Click for details →

⏳ Planned

Network Security Lab

OPNsense firewall + segmented VLANs + IDS/IPS. Traffic analysis with Wireshark and Zeek.

// COMING SOON

Click for details →

⏳ Planned

Malware Analysis Sandbox

Isolated VM sandbox for safe malware execution and behavioral analysis.

// COMING SOON

Click for details →

⏳ Planned

CTF Practice Environment

VulnHub and HackTheBox machines spun up locally. Writeups published once challenges are completed.

// COMING SOON

Click for details →

⏳ Planned

Docker Security Lab

Containerized vulnerable applications for web app security and container escape practice.

// COMING SOON

Click for details →

Showing 3 of 6

07Field Notes

RSS

MALWARE

Aug 05, 2026

🦠 Completed: History of Malware — TryHackMe

Worked through TryHackMe's History of Malware room — a walkthrough tracing malicious software from Von Neumann's 1949 theoretical work on self-replicating programs all the way to the Morris Worm's real-world fallout in 1988. Interesting seeing how much of today's malware taxonomy — worms, Trojans, boot-sector viruses, fork bombs — traces back to experiments and pranks that spiralled out of their creators' control long before "cybersecurity" was a job title.

Creeper & Reaper (1971) — The first self-replicating program spread over ARPANET and just displayed a taunting message; Reaper followed soon after as arguably the first antivirus, built specifically to hunt it down

ANIMAL (1975) — The first Trojan, disguised as a guessing game while a companion routine quietly copied itself into every directory the user could reach

Elk Cloner (1982) — Written by a 15-year-old as a prank, it became one of the first viruses to spread "in the wild" via floppy disk using a boot-sector infection technique

Morris Worm (1988) — A research experiment gone wrong that knocked out a meaningful share of the early internet and led to the first felony conviction under the US Computer Fraud and Abuse Act

Key Takeaway — Most of today's malware categories were first defined by accident, decades before defending against them was anyone's job

View TryHackMe Room

Digital Forensics

DEV

Aug 01, 2026

🎭 Built Shitty Human — Serverless Mood Tracking & Social App

Shipped Shitty Human — a 2,894-line mood tracker that grew into a full social app: friend requests, real-time chat, 30-second voice notes, and a 13-item achievement system the app calls "Citations." The whole thing is one HTML file talking straight to Firebase — no backend server, no framework, no build step. Firestore security rules do the job an API layer would normally do, validating a different required shape per chat-message type and locking fields like isPremium from ever being changed by a normal client write.

Zero Backend — Firebase Auth + Firestore only; a generated username@dayvibe.local address lets password auth work with no real email collected

Security Rules as the Backend — Hand-written Firestore rules validate message schemas per type, freeze immutable fields, and gate every read/write directly at the database

Voice Notes Under a Byte Ceiling — MediaRecorder-captured voice notes are base64-encoded and capped client- and rule-side to stay well under Firestore's 1MiB document limit

13 Citations — A full achievement system (Century Club, Night Owl, Comeback, and 10 more) unlocked by real usage patterns, not manual toggles

Key Takeaway — Firestore security rules alone can replace a surprising amount of what a traditional backend would normally guard

Read Full Writeup View Documentation Try the Live App

Web Development

SOC

Jul 18, 2026

🎣 Completed: TryHackMe SOC Simulator — Introduction to Phishing

Worked through TryHackMe's SOC Simulator as a Tier 1 analyst, triaging five live alerts in a simulated Splunk environment. Identified three true positive phishing attempts — including a typosquatted Microsoft domain and a lookalike Amazon shipping scam — and correctly cleared two false positives after pivoting through firewall logs and internal correspondence to confirm context.

Alerts Triaged — 5 live alerts worked end-to-end as a Tier 1 SOC analyst inside a simulated Splunk environment

True Positives — 3 confirmed, including a typosquatted Microsoft domain and a lookalike Amazon shipping scam

False Positives Cleared — 2, confirmed by pivoting through firewall logs and internal correspondence for context

Result — 95 points, 1st place on the leaderboard, 60% true positive rate

Read Full Writeup

Incident Response Splunk

CTF

Jul 04, 2026

🚩 General Skills — CyLab Security Academy

Completed the General Skills category — the foundational track every CTF player starts with. Most of the modules were finished back when the platform was still known as picoCTF, before its 2026 rebrand to CyLab Security Academy.

Linux Fundamentals — navigating the filesystem, permissions, and piping commands together to hunt down flags

Basic Scripting — quick Python/Bash one-liners to automate repetitive CTF grunt work

Encoding Schemes — Base64, hex, and other common encodings used to hide flags in plain sight

Key Takeaway — General Skills is the on-ramp; every other category (crypto, forensics, web) leans on these fundamentals

View CyLab Profile

CTF

DFIR

Jun 17, 2026

📈 Detection and Analysis — TryHackMe

Picked up where alert triage leaves off — this room dives into the Detection and Analysis phase of incident response. Learned to write SPL queries to dig deeper into logs and build a clearer picture of what actually happened after an alert fires.

SPL Queries — Writing Splunk Search Processing Language queries to pivot through logs and surface relevant events

Post-Triage Analysis — Moving past the initial alert to confirm scope, timeline, and root cause of an incident

Detection Logic — Understanding how correlation rules turn raw log data into actionable alerts

Key Takeaway — Triage tells you something happened; detection and analysis tells you exactly what, how, and how far it spread

View TryHackMe Room

Incident Response Splunk

SOC

Jun 16, 2026

🚨 SOC L1 Alert Triage — TryHackMe

Worked through a hands-on SOC L1 alert triage room with a real dashboard simulation — great way to practice prioritizing alerts, distinguishing false positives from genuine threats, and learning the day-to-day triage workflow analysts use on the job.

Real Dashboard Simulation — Practiced triage inside an actual SOC-style alert console, not just theory slides

Alert Prioritization — Sorting alerts by severity and business impact to decide what gets investigated first

False Positive Reduction — Identifying noisy or benign alerts to keep analyst attention on real threats

Key Takeaway — Fast, accurate triage at L1 is what keeps a SOC from drowning in alert fatigue

View TryHackMe Room

Incident Response Splunk

Jun 15, 2026

📋 Preparation — TryHackMe

Covered the Preparation phase of incident response — the foundation every SOC team needs before an incident ever happens. Dug into IR frameworks, building a Playbook/Procedure Pyramid (PPP), and the role of visibility, logging, and detection in being truly ready.

IR Frameworks — Structured approaches (NIST, SANS) that define how an organization prepares for and responds to incidents

Playbooks & Procedures (PPP) — Documented response steps that turn chaotic incidents into repeatable, consistent action

Visibility & Logging — Centralized log collection across endpoints and network as the backbone of any detection capability

Detection Engineering — Translating visibility into actionable alerts that catch real threats early

Key Takeaway — You can't respond to what you can't see — preparation is 90% of incident response

View TryHackMe Room

Incident Response

DFIR

Jun 14, 2026

🔍 Spectrum Challenge — Blue Team Labs Online

Tackled the Spectrum challenge on BTLO — a surprisingly realistic forensic investigation combining audio steganography, zip cracking, and hidden data extraction. Audacity, fcrackzip, and steghide made this one a proper toolchain workout.

Audacity — Analyzed audio files for hidden data embedded in spectrograms and waveform anomalies

fcrackzip — Brute-forced password-protected zip archives to extract concealed evidence

steghide — Extracted hidden payloads embedded inside image files using steganography techniques

Key Takeaway — Real investigations rarely use one tool — the ability to chain techniques is what separates good analysts

View Challenge

Digital Forensics Incident Response

DFIR

Jun 10, 2026

📧 Phishing Email Analysis — LetsDefend

Deep-dived into phishing email analysis — covering static and dynamic techniques to dissect malicious emails, read and trace headers, analyze suspicious attachments, and identify threat actor infrastructure.

Email Header Analysis — Tracing Return-Path, Received headers, and X-Originating-IP to detect spoofing and map the full delivery chain

Static Analysis — Inspecting raw email source, embedded URLs, and attachment hashes without execution

Dynamic Analysis — Safely detonating phishing links and attachments in sandboxed environments for behavioral observation

Key Takeaway — Headers never lie — even the most convincing phish leaves forensic trails in the metadata

View LetsDefend Training

Digital Forensics Incident Response

Jun 09, 2026

📊 Training Impact on Teams — TryHackMe

Explored how structured cybersecurity training drives measurable ROI for security teams — covering skill progression frameworks, detection rate improvements, and how to justify training investment to stakeholders.

ROI of Training — Quantifying the return on security training through reduced incident response time and improved detection accuracy

Skill Gap Analysis — Identifying team weaknesses and mapping training paths to close coverage gaps in the security posture

Team Performance Metrics — How training translates directly into faster triage, better threat identification, and lower MTTR

Key Takeaway — A well-trained SOC team is the most cost-effective security control an organization can invest in

View TryHackMe Room

Incident Response

ML / AI

Jun 08, 2026

🤖 AI, ML, DL & LLM Security Threats — TryHackMe

Covered the fundamentals of how AI, ML, DL, and LLMs work — and how they intersect with cybersecurity as both dangerous attack vectors and powerful defensive tools.

AI — The overarching field enabling machines/systems to mimic human behaviour and decision-making

Machine Learning — A subfield of AI where models are trained on input data to learn patterns and make predictions

Deep Learning — A subfield of ML using Neural Networks to self-learn and process mass amounts of data without human interaction

LLMs & Cyber Offense — AI-powered phishing, automated vulnerability discovery, deepfake social engineering

AI in Defense — Anomaly detection, intelligent SIEM correlation, and ML-driven threat hunting

View TryHackMe Room

Machine Learning

DFIR

Jun 06, 2026

🛡️ D3FEND Challenge — Blue Team Labs Online

Looks like a small one, but it’s deeply rooted to the core of MITRE D3FEND — a knowledge graph of cybersecurity countermeasures that maps defensive techniques against adversarial TTPs.

View Challenge

Digital Forensics Incident Response

Pentest

CTF

Jun 04, 2026

🔓 Basic Pentesting — TryHackMe

Worked through the Basic Pentesting room on TryHackMe — a beginner-to-intermediate Linux box covering the full kill chain: enumeration, exploitation, and privilege escalation to root.

Enumeration — Nmap service scan, Gobuster directory brute-force, SMB enumeration

Exploitation — Weak SSH credentials discovered via Hydra brute-force — initial foothold gained

Privilege Escalation — Linux privesc to root via misconfigured sudo permissions

Key Takeaway — Thorough enumeration is the foundation of every successful pentest

View TryHackMe Room Read Full Writeup

Penetration Testing CTF

DFIR

Apr 09, 2026

🧠 Learning Volatility — A Path Toward Forensic Archiving

Mastering Volatility isn't just about live incident response — it's a foundational step toward forensic archiving. Memory artifacts captured today can be preserved and referenced in case files long after the incident closes.

Forensic Archiving — Volatility outputs (pslist, netscan, malfind) exported as structured evidence for case records

Memory Artifact Preservation — volatile evidence captured before power-off becomes a permanent forensic record

Plugin Deep Dive — cmdline, dlllist, handles, and filescan reveal attacker footprint even without disk artifacts

Key Insight — Fileless malware leaves no trace on disk, but memory never lies

Digital Forensics

DFIR

Apr 08, 2026

🚀 Completed Memory Analysis Introduction — TryHackMe

Dived into the fundamentals of memory forensics — how RAM works, how attackers exploit it, and how defenders catch threats in-memory before any trace hits disk.

RAM & Memory Structures — Stack, Heap, User vs Kernel Space

Process & Full Memory Dumps — capturing volatile data before it's gone

Code Injection Detection — identifying injected shellcode inside process memory

First Steps with Volatility — hands-on dump analysis and plugin usage

View TryHackMe Room

Digital Forensics Incident Response

CTF

Pentest

Feb 15, 2026

🚩 Released Udyama — My First Custom CTF Machine

Designed and packaged a fully custom Linux CTF VM with 2 flags — User and Root. Focused on real-world privilege escalation paths, not contrived puzzle challenges. Packaged as Ubuntu OVA for VirtualBox.

Platform — Ubuntu 22.04 OVA, runs in VirtualBox

Difficulty — Intermediate to Advanced

Focus — Realistic Linux privilege escalation & persistence techniques

Hosted on archive.org — free to download for the community

Download OVA

CTF Penetration Testing

Mar 10, 2025

🛡️ Completed DFIR Introduction — TryHackMe

Solid grounding in Digital Forensics & Incident Response fundamentals — the methodology that separates a reactive responder from a structured, methodical analyst.

PICERL Framework — Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned

Evidence Handling — Chain of Custody, Evidence Preservation, Order of Volatility

Tools Covered — EZ Tools, KAPE, Autopsy, Volatility

Key Takeaway — Always collect most volatile evidence first; RAM disappears at shutdown

View THM Room

Digital Forensics Incident Response

DFIR

OSINT

Feb 24, 2025

🔥 MemLoot Challenge — Ransomware Hidden as Spotify Installer

Analyzed a Windows memory dump using Volatility 3. A fake Spotify installer turned out to be Dark Havoc ransomware — a classic trojan delivery technique caught through memory forensics.

Malicious File — Spotify_setup.exe identified as Dark Havoc ransomware

C2 Server — 104.152.52.238:6548 · Encryption extension: .havoc

Execution Vector — Parent process explorer.exe, user double-clicked the fake installer

Detection Method — Process tree analysis + network artifacts from memory dump

View Challenge

Digital Forensics Incident Response OSINT

ML / CV

May 10, 2025

🛡️ Built Driver Vigilance — Real-Time Distraction Detection with ML

Designed and built a machine learning–driven driver monitoring system capable of detecting dangerous driving behaviors in real time — phone usage, turning around, reaching to the rear — and issuing instant alerts before they cause accidents.

Detection Scope — Phone usage, rear-seat distraction, abnormal head & body orientation

Core Stack — Python + OpenCV + ML classification model on live video input

Alert System — Real-time warnings triggered at configurable confidence thresholds

Key Insight — Most accidents begin 0.5–2 seconds before impact; real-time is the only acceptable latency

Read Full Writeup

Machine Learning

// No posts found

Showing 2 of 19