Cybersecurity undergraduate
Penetration testing · SOC · Security analysis
What I use most days
Burp Suite
osqueryInternship · Sep 2026 – present
Airport & Aviation Services (Sri Lanka)
Cybersecurity Intern
I'm interning on the security side at the company that runs Sri Lanka's airports. Most of my time goes into monitoring, vulnerability assessments and network work.
Sri LankaIngests raw recon, scores every host on a weighted 'interestingness' formula, clusters them semantically, and uses an LLM to rank the top 50 targets with attack-chain reasoning.
FastAPI web scanner that fingerprints common web misconfigurations and scores them into a consultant-grade report.
Browser-based recon console — TCP port scanning plus subdomain and virtual-host discovery, running entirely on localhost.
A SYN flood weaponises the half-open connection: send the first packet of the handshake, never the third, and let the target's backlog fill with connections that never complete. A lab walkthrough with Metasploit and hping3.
A Meterpreter foothold as a standard user is only the start. Walking a low-priv shell up to NT AUTHORITY\SYSTEM by bypassing UAC — and why the SAM stays locked until you do.
Two legacy name-resolution fallbacks, enabled by default in Windows, will broadcast a credential-bearing authentication to whoever answers first. A step-by-step lab walkthrough — and how to switch it off.
Modern Wi-Fi hands attackers a high-resolution view of the channel for free. A look at what compressed beamforming feedback actually exposes — and where the real risk sits versus the hype.
Hackviser
Amazon Web Services (AWS)
AWS Educate
Cisco
OPSWAT Academy
The rest is on GitHub. Every project above links to its repo, so you can read the code yourself.
I got into security by breaking something I probably shouldn't have. I stuck around because working out how you'd catch it turned out to be just as fun.
Red team or blue team, I'm not fussy. I care more about who I'm working with and what we're working on.
Finding what's exposed and seeing how far it goes. Mostly Burp, sqlmap, ffuf, Nmap and Metasploit.
Watching logs and triaging alerts at AASL. Running the attack myself first makes it a lot easier to know what I'm looking for.
Attacking things makes me better at defending them, and the other way round. That's why I haven't picked a side yet.
If I learn something in a lab, I write it up. 5 writeups so far, plus a few cheat sheets I keep going back to.
Happy to talk security, internships, projects, or a CTF team.
Email is the quickest way to reach me. I usually reply within a day or two.
Or email me at janithzgodage@gmail.com