Zishan Ahamed Thandar

Stuck on a Web, API, or Active Directory issue? Need clear career or method guidance without a live call?

I’m Zishan Ahamed Thandar — Offensive Security Researcher, Bug Bounty Hunter (HackerOne + private programs), and creator of practical resources used by thousands of learners.

Recognized in Halls of Fame by Google, Oracle, AOL, Zoho, NCIIPC and more. HTB Top 10 (Legacy) | TryHackMe Top 5%. I focus on real-world Web Application, API, and Active Directory security — the same skills used in assessments and that power popular checklists, Pentester Guide, and CRTA/OSCP-style notes.

This is a high-priority asynchronous DM so you get focused, actionable answers without scheduling a call.

What you can ask about

• Web & API Security: OWASP Top 10, IDOR, auth/access-control flaws, business logic, Burp Suite workflows, API testing method, common pitfalls
• Active Directory: Attack paths, privilege escalation, BloodHound/Impacket/CrackMapExec concepts, common lab scenarios, CRTA-style questions
• Labs & Method: How to approach HTB/THM boxes, structured recon, reporting tips, building a practical pentest workflow
• Career & Roadmap: Realistic learning paths, certification prioritization (e.g., CRTA, OSCP prep mindset), transitioning from student/developer to pentester, portfolio & bug bounty advice
• Quick technical clarity or “Am I thinking about this correctly?” feedback on a specific technique or concept

What’s included

• One clear, thoughtful written response (or short series of replies if needed for clarity)
• Practical, practice-based guidance grounded in real assessments and teaching
• Priority handling — your question jumps the queue

What’s excluded

• Full live pentest engagement, code review of production systems, or hands-on attack of live targets
• Guaranteed “solve my entire lab/box” solutions or complete custom learning plans
• Legal/compliance advice or anything outside ethical/offensive security scope
• Multiple unrelated questions in one booking (book again for additional topics)

How to get the best answer

Please format your message like this:

1. Setting (1–2 sentences): Your background / current goal (student, developer, junior pentester, preparing for cert, etc.)
2. Specific question: Be as precise as possible
3. What you’ve already tried (optional but helpful)
4. Desired outcome: e.g., “method tip”, “career clarity”, “tool/technique details”

Vague questions get solid general advice. Specific ones get high-signal, actionable replies.

Ready when you are — drop your question and I’ll get back to you with clear, practical insight.