Janith Godage — Offensive Security & Tooling

Available for internships · Sri Lanka

$ Hell00

    ___  ________  ________   ___  _________  ___  ___   |\  \|\   __  \|\   ___  \|\  \|\___   ___\\  \|\  \   \ \  \ \  \|\  \ \  \\ \  \ \  \|___ \  \_\ \  \\\  \ __ \ \  \ \   __  \ \  \\ \  \ \  \   \ \  \ \ \   __  \|\  \\_\  \ \  \ \  \ \  \\ \  \ \  \   \ \  \ \ \  \ \  \\ \________\ \__\ \__\ \__\\ \__\ \__\   \ \__\ \ \__\ \__\ \|________|\|__|\|__|\|__| \|__|\|__|    \|__|  \|__|\|__|

 ________  ________  ________  ________  ________  _______|\   ____\|\   __  \|\   ___ \|\   __  \|\   ____\|\  ___ \\ \  \___|\ \  \|\  \ \  \_|\ \ \  \|\  \ \  \___|\ \   __/| \ \  \  __\ \  \\\  \ \  \ \\ \ \   __  \ \  \  __\ \  \_|/__  \ \  \|\  \ \  \\\  \ \  \_\\ \ \  \ \  \ \  \|\  \ \  \_|\ \   \ \_______\ \_______\ \_______\ \__\ \__\ \_______\ \_______\    \|_______|\|_______|\|_______|\|__|\|__|\|_______|\|_______|

role:= [penetration_tester]

Cybersecurity undergraduate building offensive security tooling — breaking things ethically, then engineering the defenses. I care about clean exploit code, honest writeups, and detection logic that actually fires.

view projects download cv

uptime

3y · learning

focus

offsec · detection

region

lk · remote-ok

featured projects

Things I've built, broken, and shipped.

A small, opinionated selection — offensive tooling, blue-team infrastructure, and one piece of hardware research.

PLATFORM

ASPE — Attack Surface Prioritization Engine

Ingests raw recon, scores every host on a weighted 'interestingness' formula, clusters them semantically, and uses an LLM to rank the top 50 targets with attack-chain reasoning.

PythonFastAPICeleryPostgreSQLpgvector

TOOL

Security Misconfiguration Finder

FastAPI web scanner that fingerprints common web misconfigurations and scores them into a consultant-grade report.

PythonFastAPIUvicornBeautifulSoupPydantic

TOOL

PortScan

Browser-based recon console — TCP port scanning plus subdomain and virtual-host discovery, running entirely on localhost.

Node.jsExpressVanilla JSServer-Sent Events

see all projects

skills · by domain

Tooling I reach for.

Grouped by what I'd actually use them for in a kill chain — recon, exploit, detect, reverse.

Web Exploitation

Burp SuitesqlmapffufOWASP Top 10JWT abuse

Network & Recon

NmapWiresharkMetasploitResponderBloodhound

Detection / Blue Team

WazuhSuricataSigmaELKMITRE ATT&CK

Crypto & Reversing

Ghidraradare2pwntoolsGDBFrida

Environments

KaliDockerLinuxVSCodetmux

credentials

Certifications & badges.

Verified credentials I've earned, with more course badges on the way as I work through them.

OPSWAT Academy

Introduction to CIP

Complete

view credential

progress100%

AWS Educate

AWS Educate Introduction to Cloud 101

Complete

view credential

progress100%

Cisco

Python Essentials 1

Complete

view credential

progress100%

latest writeups

Notes from the lab.

2026-06-25·4 min read

TCP SYN Flooding: Exhausting the Handshake

A SYN flood weaponises the half-open connection: send the first packet of the handshake, never the third, and let the target's backlog fill with connections that never complete. A lab walkthrough with Metasploit and hping3.

NetworkRed TeamDoS

2026-06-25·5 min read

From Dummy to SYSTEM: UAC Bypass and Privilege Escalation

A Meterpreter foothold as a standard user is only the start. Walking a low-priv shell up to NT AUTHORITY\SYSTEM by bypassing UAC — and why the SAM stays locked until you do.

WindowsRed TeamPost-Exploitation

2026-06-24·4 min read

LLMNR/NBT-NS Spoofing: Free Hashes on the LAN

Two legacy name-resolution fallbacks, enabled by default in Windows, will broadcast a credential-bearing authentication to whoever answers first. A step-by-step lab walkthrough — and how to switch it off.

NetworkWindowsRed Team

open channel

Let's talk shop.

Internship, collab, or CTF team — drop a line. PGP available on request.

initiate handshake