This repository contains a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) project covering advanced exploitation techniques, API security testing, privilege escalation, network protocol attacks, mobile application testing, and a full capstone penetration testing engagement.
This task was completed as a part of my Vulnerability Assessment and Penetration Testing (VAPT) Internship at Cyart Technologies in April 2026.
- Understand advanced exploitation and exploit chaining
- Perform API security testing based on OWASP API Top 10
- Execute privilege escalation and persistence techniques
- Simulate network protocol attacks (MitM, SMB Relay)
- Analyze mobile applications for vulnerabilities
- Conduct a full VAPT engagement using PTES methodology
- Deliver structured security reports with remediation
- Advanced Exploitation Techniques
- API Security Testing
- Privilege Escalation & Persistence
- Network Protocol Attacks
- Mobile Application Penetration Testing
- Comprehensive Reporting & Remediation
- Kali Linux
- Metasploit Framework
- Burp Suite
- Postman
- sqlmap
- LinPEAS
- Responder
- Ettercap
- Wireshark
- MobSF
- Frida
- Drozer
- OpenVAS
The project follows the PTES (Penetration Testing Execution Standard):
- Reconnaissance
- Scanning & Enumeration
- Exploitation
- Privilege Escalation
- Persistence
- Post-Exploitation
- Reporting
A full VAPT engagement was simulated on a vulnerable environment:
- Identified VSFTPD vulnerability
- Exploited using Metasploit
- Gained remote access
- Conducted API and network testing
- Applied privilege escalation techniques
- Established persistence
- Proposed remediation strategies
- Validated fixes using OpenVAS
Due to the nature of exploitation techniques and security vulnerabilities, certain screenshots and proof-of-concept details have been intentionally excluded to prevent misuse.
All activities were conducted in a controlled lab environment for educational purposes only.
Detailed report, notes, and supporting materials are available in the Week 4 folder.
This project is intended for educational purposes only. All testing was performed in a controlled environment. Unauthorized use of these techniques is strictly prohibited.
Aditya Mehta
Cybersecurity Enthusiast