Lead Penetration Tester | Bug Hunter · Sri Lanka

Lakshitha Prabhath.Offensive security engineer leading VAPT and red team engagements across web, API, cloud and Active Directory.

View work Get in touch

Achievements

4 / 6 unlocked

Years hacking
7
Years consulting
3
HTB machines
220+Verify HTB machines on my public profile (opens in a new tab)
TryHackMe rooms
100+Verify TryHackMe rooms on my public profile (opens in a new tab)

01 / About

Who I am

I lead the VAPT team at Connex Information Technologies and own engagements end to end: scoping and proposals, testing, reporting, remediation planning and retests. The work spans the full attack surface, from the external perimeter and web/API layer to internal networks, Active Directory and cloud, for banking, telecom, government and enterprise clients.

Where commodity tooling gets detected, I write my own in C++ and Python. Outside client work I hunt bugs on HackerOne, Bugcrowd and Intigriti, build CTF boxes and AD labs, and hold the record for most Hack The Box machines pwned in Sri Lanka (ranked #1 nationally in 2022).

Assessments

  • Web application
  • API
  • Internal & external network
  • Mobile
  • Desktop application
  • Cloud
  • Secure code review
  • Access review
  • Configuration review
  • Social engineering

Red Team

  • Adversary simulation
  • Active Directory attack paths
  • Kerberoasting & AS-REP Roasting
  • Delegation & trust abuse
  • Lateral movement
  • Persistence
  • Privilege escalation
  • Defensive bypass

Development

  • Python
  • Bash
  • C++
  • Exploit development
  • Implant engineering
  • Offensive tooling automation

Tooling

  • Burp Suite
  • Sliver C2
  • impacket
  • netexec
  • BloodHound
  • Metasploit
  • Nmap
  • GoPhish
  • SniperPhish
  • EC-Council Aware

Scanning & Compliance

  • Nessus
  • OpenVAS
  • CIS-CAT Pro
  • SecHard
  • FireCompass

Defensive

  • Cortex XSIAM/XDR
  • Splunk
  • LogRhythm
  • Sekoia
  • Trend Micro
  • Threat hunting
  • Detection tuning

02 / Projects

Selected work

Client engagements are confidential, so these are the things I can talk about publicly.

01 / Practice

Hack The Box: most boxes pwned in Sri Lanka

220+ machines owned. The most boxes pwned by anyone in Sri Lanka.

Details
What I did
Rooted 220+ Windows, Linux and Active Directory machines since 2019, holding the Pro Hacker rank.
What was hard
Staying consistent across years of new releases, from web exploitation and binary bugs to multi-host AD chains, without relying on write-ups.
Result
Ranked #1 in Sri Lanka in 2022. I still hold the national record for most boxes pwned and rank consistently in the Sri Lanka top 10.
  • Active Directory
  • Linux
  • Windows
  • Web
  • Exploit dev
HTB profile (opens in a new tab)

02 / CTF

SLIIT Codefest 2024 challenge set

Lead technical contributor to the cybersecurity challenges for an inter-university CTF.

Details
What I did
Designed the vulnerabilities for the challenge set and validated every exploit path before the event.
What was hard
Making challenges that were fair yet hard to shortcut, with each intended path tested end-to-end so nothing broke on game day.
Result
Challenges ran for competing university teams. I was also invited as a special guest and judge.
  • Web
  • Linux
  • Windows
  • Challenge design

03 / Authoring

CTF boxes & AD labs

Vulnerable Windows and Linux boxes, Active Directory labs, and web and mobile challenges.

Details
What I did
Author vulnerable machines and labs as an ongoing hobby, including boxes for private CTF competitions hosted on TryHackMe.
What was hard
Building realistic misconfigurations and attack chains that teach a technique without being guessable.
Result
Boxes used in private CTF events. 100+ TryHackMe rooms completed and Guru rank on the platform.
  • Active Directory
  • Windows Server
  • Linux
  • Mobile
TryHackMe (opens in a new tab)

04 / Tooling

Custom offensive tooling

Implants, loaders and exploit code for when commodity tooling is signatured.

Details
What I did
Build custom implants, loaders and exploit code in C++ and Python, with Sliver as the primary C2 for long-haul access.
What was hard
Keeping tooling quiet against modern EDR/XDR while staying stable enough for multi-week engagements.
Result
Sustained stealthier lateral movement in adversary simulations where off-the-shelf payloads were detected.
  • C++
  • Python
  • Sliver C2
  • Windows internals

05 / Red Team

Social engineering campaigns

Corporate-scale phishing and awareness campaigns for enterprise clients.

Details
What I did
Designed and delivered social engineering campaigns using EC-Council Aware, SniperPhish and GoPhish.
What was hard
Running believable campaigns at scale while keeping them safe, scoped and measurable for the client.
Result
Turned campaign results into awareness and control priorities for client leadership.
  • GoPhish
  • SniperPhish
  • EC-Council Aware

03 / Experience

Where I've worked

Jul 2023 - Present (current role)

Penetration Testing Team Lead (Information Security Analyst)

Connex Information Technologies

  • Lead the VAPT team. I allocate work, set technical direction and quality-gate deliverables across concurrent engagements.
  • Run projects end-to-end: proposals, scoping, execution, reporting, remediation plans and reassessments.
  • Deliver web, API, network, mobile, desktop and cloud VAPT, plus configuration, access and secure code reviews.
  • Found critical RCE, LFI and SSRF on high-value targets and chained them through to demonstrated business impact.
  • Lead adversary simulations through AD compromise, lateral movement and persistence, mapped with BloodHound.
  • Feed red-team TTPs back to SOC/IR teams for threat hunts and XDR/SIEM detection tuning, and mentor junior analysts.
  • Represented Connex IT as a special guest and judge at SLTC ZeroDay CTF 2026 and SLIIT Codefest 2024.

Recognition

Certifications

04 / Contact

Let's talk. VAPT scoping, red team engagements or a vulnerability report.

Resume available on request.