Keyur Aghao

The first public proof-of-concept for a critical buffer-overflow in ClamAV's PDF-scanning path, used inside Cisco Secure Email/Web. Published after coordinated disclosure and patch, for defensive research and detection engineering. Documents the vulnerable logic, trigger conditions, the affected/fixed version matrix, and a core-dump analysis of the crash.

A cross-platform Mobile & IoT SAST / DAST / pentest toolkit unifying MobSF, Frida, objection, mitmproxy, nmap and binwalk behind one interface: desktop app, CLI and MCP server over the same engine layer. Bundles 20+ one-click Frida hooks, traffic interception over Wi-Fi/USB/WireGuard, a built-in simulator, and consolidated PDF/HTML/XLSX reporting.

A cross-platform GUI, CLI and MCP server for forensic database analysis. Opens ESE (ntds.dit, SRUDB, Exchange, WebCache), SQLite, Windows event logs, LevelDB, Access, dBase and SQL/BSON dumps, strictly read-only, with pure-Python parsers, SQL over any format, a cross-database timeline, artifact views for ~60 applications, and signed encrypted project files for hand-over.

Device-free sensing that detects motion and objects using the RF ordinary WiFi hardware already transmits, with no router modification. A single-link RSSI track (validated end-to-end at 82,886 frames / 1041 Hz on real hardware) plus a ~12-node ESP32 mesh for 3D radio-tomographic imaging, sharing one signal-processing and modelling pipeline. Firmware builds for six ESP32 families.

An installable CLI for external attack-surface discovery: aggregates subdomains from five OSINT sources, resolves them in parallel with a compiled C++ DNS resolver, optionally runs Nuclei for vulnerability scanning, and delivers a rich terminal report plus a self-contained HTML report, with optional AI-powered security analysis.

A multi-cloud tool that discovers publicly reachable object storage across AWS S3, Azure Blob, GCS and DigitalOcean Spaces from a browser dashboard: live scanning with a real-time log stream, concurrent multiprocessing scans, Azure blob enumeration, scheduled recurring scans, and optional AI-based risk classification.

Took 1st place in MITRE's national embedded-systems security competition. Built a secure embedded design: hardened C firmware with UART/SPI/I2C protocol handling and custom KiCad PCBs, then broke rival designs with voltage-glitching fault injection on ChipWhisperer, bypassing secure-boot signature checks and debug-lock fuses, plus side-channel and protocol-replay analysis.

A structured security evaluation of the DJI Mavic Mini. Reverse-engineered the DJI DUML protocol over Enhanced Wi-Fi from monitor-mode captures, recovered firmware decryption keys, and performed static analysis of the firmware partitions in Ghidra and binwalk, uncovering 14 vulnerabilities that compose into a full remote unauthenticated root-compromise chain. Findings are in responsible disclosure with the advisor.

A published VS Code extension: a live function and class hierarchy docked beside your code, with fuzzy subsequence search. It follows the cursor, rebuilds as you type, and falls back to a built-in pattern parser when no language server is available. No sidebar, no clicking around.

A catalogued reference of Windows AMSI evasion techniques and the detection gaps they expose. Each entry is annotated with how modern AV/EDR detects or blocks it and mapped to MITRE ATT&CK. Written so blue teams can build detections for the evasion vectors rather than chase individual payloads.