About Me
I'm Ishan Oshada, a Backend Developer and Security Researcher based in Colombo, Sri Lanka. I build secure backend systems in Python, Go, and PHP, and I take software apart to see how it fails: web apps, APIs, Android apps, Active Directory, and Windows binaries.
🔐 Security Research: My interests include red teaming, Active Directory attacks, Windows internals, reverse engineering, and web/API/Android penetration testing. I work with Ghidra, Frida, Burp Suite, jadx, and apktool. I claim only what I can prove, and each report states exactly what was demonstrated.
⚙️ Backend Development: I build backend applications, APIs, and automation tools using Python, Go, and PHP. I also work with Flask, Django, JavaScript/TypeScript, MongoDB, MicroPython, and ESP32.
🛡️ Open Source: I publish security tools and research on GitHub, including Frida-Toolkit, Ultimate Frida Bypass, SentinelX Security Inspector, and Antox. I'm passionate about open-source development and learning through real-world projects.
Vulnerability Research (CVEs)
I actively research and disclose security vulnerabilities. Here are the CVEs I have discovered, credited with official CVE.org records and public Proof-of-Concept (PoC) Gists:
Certifications & Courses
Professional certifications and specialized training in Red Teaming, AI Security, and Application Security.
Featured Projects
Highlighting some of my recent open-source tools and security research projects.
🛡️ SentinelX Security Inspector
Open-source Android RASP & Environment Inspection Toolkit built with Kotlin & Jetpack Compose. 65+ security checks (Frida, Root, SSL Pinning, LSPosed).
📱 Antox
Blazing-fast, automated Android APK security analysis tool written in pure Go. Combines static analysis with JADX and MCP for deep reverse engineering.
🌐 MicroWeb
A lightweight web framework for MicroPython + ESP32. Reduces boilerplate for creating web servers, routing, and JSON handling on IoT devices.
Open Source & GitHub Repositories
I actively maintain several open-source tools, security research repositories, and Python packages on GitHub. Here are some of the most popular projects:
🔍 GDorks
Google Dork List - Uncover the Hidden Gems of the Internet. (320+ categories) + Web App.
📱 Frida-Toolkit
650+ Frida scripts + native anti-tamper bypasses for mobile security research (SSL pinning, root, etc).
📡 Esp32-Deauth
A Python tool for Wi-Fi deauthentication attacks using ESP32 with webserver firmware.
🛡️ Ultimate-Frida-Bypass
Bypasses 19 layers of Android security including Talsec, freeRASP, PairIP, and SSL pinning.
🔎 laravelScanner
Massive scanner to detect exposed .env files across multiple targets.
🔍 Vulnerability-Research
A collection of my security advisories, PoCs, and CVE write-ups.
Let's Connect
I'm open to backend, application security, penetration testing, and vulnerability research roles in Colombo or remote. Feel free to reach out!
📧 Email: ic31908@gmail.com | 🔗 LinkedIn: linkedin.com/in/ishan-oshada