SSRF Beyond HTTP: Egress-Path-Incomplete Guards in AI Agent Platforms
A formal egress-path-incomplete SSRF model instantiated on CVE-2026-33234 (AutoGPT). Zenodo, 2026.
// root@pavan ~ whoami
Pavan Nallamothu
Offensive security researcher & penetration tester. 12 published CVEs (MITRE) with credits from Apple, CISA, and NSA. Bug bounty hunter on HackerOne, Bugcrowd, Google VRP, Apple Security Bounty, and Meta. M.S. Cybersecurity.
12
CVEs Published
3
Apple · CISA · NSA
5
Bug Bounty Platforms
4+
Years Cloud/DevOps
CVE Portfolio
Twelve published CVEs, sandbox escapes, SSRF, auth bypass, IDOR, path traversal, and DoS across Apple, NSA, CISA, AutoGPT, yt-dlp, and BlueprintUE.
// hover any card to pause the loop
From the Lab
Reproduction scripts for disclosed vulnerabilities. A random PoC is loaded on each visit. Click a tab to switch.
Publications
Open-access security research preprints with permanent DOIs, indexed by OpenAIRE and Google Scholar.
Trusting the Filename: File-Write Attacks from Untrusted Archive and Download Metadata
File-write attacks from attacker-controlled archive and download metadata across three 2026 CVEs. Zenodo, 2026.
Professional Experience
From operating AWS infrastructure at scale to authoring CTF challenges and providing campus IT support.
Education & Certifications
M.S. Cybersecurity from Pace University with Graduate Merit Scholarship.
Education
M.S. Cybersecurity
Pace University, New York, NY · 2023 – 2025 · Graduate Merit Scholarship
Certifications
Community & Activities
Speaking, mentoring, competing, and organizing in the security and open-source communities.
Projects & Writing
Security tooling plus academic and personal builds, and long-form writing and experiments across the site.
Jobs Web Scraper
Python app that pulls job postings from TimesJobs, applying secure data-handling and network-defense concepts.
Robust Video Data Hiding
Embeds sensitive data inside video files using the Forbidden Zone Data Hiding technique, preserving confidentiality and integrity.
Cyber-Physical Social System
"Follow But No Track", methods to publish social-network user profiles while preserving user privacy.
Double Transposition Cipher
A Python tool demonstrating the double transposition encryption process with a step-by-step educational breakdown.
Local Search Engine
A Python utility for fast text search across local directories on Linux, showcasing filesystem management.
IP Logger
A Bash script that logs public network addresses for simple, continuous network monitoring.
More from the site
Terminal
Type help to see all commands. Try neofetch, cves, experience, or scan github.com.
guest@pavan-blog:~$
Contact
Open to collaboration, responsible-disclosure coordination, and security conversations.
Get in touch
Have a question or want to work together? Reach out directly.