Harsh Raj
Experience
Independent Security Researcher
Self · 2023 – Present
Selected Security Research & Investigations
- Bewakoof: Identified and helped patch three vulnerabilities spanning web and mobile:
- An IDOR on the web platform that exposed other customers' wallet data.
- A broken authentication flow in the app's number-verification step: by intercepting and modifying the verification request (via Burp Suite), the OTP could be redirected to an attacker-controlled number, allowing the attacker to pass verification on a victim's account.
- API-level abuse of a legacy email-login endpoint still active after the app moved to OTP-only login, allowing that endpoint to bypass the upgraded authentication and access victim accounts.
Combined, these flaws could let an attacker take over an account and place orders using the victim's wallet balance. - Vulnerability reporting: Investigated and reported security issues affecting Clovia, Marks & Spencer (London), and Cadbury.
- RedBus: Investigated attacker misuse of wallet balances, including activity involving agent accounts, and reported the findings.
- Card-fraud investigation (Stripe): Contributed to an investigation into card fraud that drove losses through chargebacks and associated fees.
- Threat intelligence: Investigated Telegram-based groups abusing Flipkart PayLater; identified and exposed key exploiters and RAT operators.
Projects
Education
JECRC University · B.Tech in Computer Science & Engineering, Jaipur• Current
PresentSarala Birla University · Diploma in Computer Science Engineering, Ranchi• 7.69 CGPA (Completed)
CompletedCertifications
CompTIA Security+ (SY0-701) · CompTIA
May 2025Credential ID: RWWJDZ1SWMVE2HMJ
Skills Acquired: Cybersecurity fundamentals, threat management, risk mitigation, network security, and incident response
Skills
Cyber Threat Intelligence: Conducted open-source intelligence (OSINT) and threat research across dark web forums and Telegram channels containing malicious tools such as Remote Access Trojans (RATs) and viruses.
Security Domains: API Security, Web Application Security, Threat Detection, Incident Response, Cyber Threat Intelligence.
Frameworks and Standards: OWASP.
Practice: Hands-on labs, vulnerability analysis, attacker behavior and indicator analysis.
Interests
Threat Intelligence · Cloud Security