Interview With Rajesh Majumdar - Security Researcher From India

Hello Readers, Here we interview another Security Researcher Rajesh Majumdar, Some People when it comes to Pentesting they decided to Pentest either Client Side Or Server Side, Or Both, But he's more interested in Server Side Application Vulnerability. He got $5,000 from Facebook for finding a Server Misconfiguration Bug. Take your time enjoy the interview with Rajesh.


Hello, Rajesh Majumdar Introduce YourSelf To Our Readers

Hi, My name is Rajesh Majumdar(@freaky_monk). I am 17 yrs old from Noida( a city in India). I do spent a lot of time in learning and practicing new attacks and vulnerabilities

How You Started The Journey As A Security Researcher?

I always love to learn new things. And I become fascinated towards hacking, when I was in class 9th. And when I was a noob, I always wanna be a black hat hacker. But as I grew up, both in age and in my hacking career. I got to know, both black hat and white hat are same, it's just a fine line of difference between them. There I chose to be an Ethical Hacker (Security Researcher).

When Did You Start Hacking And Tell Us About Your Experience?

I started hacking when I was in class 11th, I started fascinating towards hacking, and gradually I learned, researched & practiced about new attacks and vulnerabilities. There was a time, when I almost learned about most of the vulnerabilities like SQLi, XSS, RCE and all, but I can't use them to hack into a big website. I was pity disappointed at that point. But then I thought "If he can do then I also can do". And after approx. 1 month of regular practicing, I got my first HOF, and then I thought its time to pentest bounty rewarding sites like Google, facebook and all. Their I got to know sites rewarding HOF were easy to pentest, but bounty rewarding sites were tough. I regualr practiced and learned and then I got my first and biggest bounty ever for me i.e.$5000 (approx 3.36 lacs INR ). It was a great experience for me, learning, researching and all.

How Did You Start Learning Hacking And Who Taught You?

Practically I started learning hacking from a coaching center in Delhi, Lucideus. But to be honest, I just wasted my 30,000 INR. But yes I got a direction and a point from there to start my hacking career. For me "Google", "OWASP", my friends and my PC all are my teachers, they guided me and taught me.

Which Website/System Did You First Break Into?, What's The Vulnerability?

As a noob I also want to be a black hat hacker. So first of all, I hacked into my school's computer network, and it was too easy as all the pc were running Windows XP. I was able to control every single PC's command prompt. I know it's simple, but at that time, it was a great achievement for me. As RCE was already discovered into Windows XP, I was using RCE vulnerability to hack into them. That's why I love RCE and server side bug more than any other bug.

What Advise Will You Give To Beginners Coming Into This Field?

For beginners I'd say one thing, Never give up just keep one thing in mind, "If he can, than I also can". And with this thing never stop learning new things and about new attacks.

Is Programming Language Really Important, Why? And Which Language To Learn

If you're just want to be a hacker, for some fame and money, than programming language doesn't matter. Just open Automated Web Scanner and Boom!!!. But If you're really wanna be a great hacker then yes, programming language is important.

Last year Joshua Drake (A security Researcher in Zimperium) discovered Stagefright in Android phone's. He released the exploit on the web. But there were too many errors in the exploit. If you directly run that python file, you will too many errors. But if you have knowledge about Python language than you can eliminate those errors and run that exploits. That's why programming language is important. To create your own exploits, understanding how the website is working and all.

Languages to be learnt:





These are the must known languages to be a good hacker.

What Methodology Do You Use When Participating In A Bug Bounty

During participating in bug bounty program, I know about thousands of hackers had pentested this website. But there are some hackers, who pentest a website on the server side. Most of the hacker pentest the website on the client side, so I go and directly pentest the server side of the website, and If I didn't find something juicy there than I pentest on the client side.

Do You Have A Specific Focus Or Specility In Penetration Testing That You Tend To Spend Your Time On?

Ya, As I told earlier I focus on the server side i.e. RCE and Traffic bugs. I spend a lot of time in learning about new exploits and about new server side attacks and vulnerabilities, and I do spend lot of time in reading PoCs of server side vulnerabilities.

How Do You Keep Your Skills Fresh?

I keep practicing the attacks on my own private server and thinking some new ways to exploit them. Just read PoCs, and news related to security and all such things.

What Do You Think Of The Future Of Bug Bounties Programs?

I think the future is bright, for those who are all involved in these bug bounties programs, As it gives you all you need fame, money and a good platform for perform in which you're are perfect. And as the Internet is growing, and every user is worried for their privacy. It is just a starting of a great future.

What Are The References/Best Resources To Get Started?

To get started, acc. to me the best resources and references is OWASP, Google and most important your colleagues or friends. And then their are many books out their in the market. Some of the best books acc. to me is "Hacking:The Art of Exploitation"(not for starter) "Python" and many more.

You can ping me

Facebook: /officialrajeshmjmdr

Twitter: @freaky_monk

No comments

Powered by Blogger.