FILE: MH-2026-OPS CLEARANCE: LEVEL-3
Black and white operator portrait of Sagar Biswas
OPERATOR: Sagar Biswas
DESIGNATION: MultiHAT Engineer
DISCIPLINE: Assess · Harden · Govern
STATUS: AVAILABLE FOR ROLE
VERIFIED OPERATIONAL EVIDENCE // NO INFLATED METRICS

Sagar Biswas

Software, AI & Security Engineer // SEO Expert
MultiHAT-Operator // Exploit Developer

"I break web applications to learn how they fail, then build and harden them so they don't." Software, AI & Security Engineer, SEO Expert, MultiHAT-Operator, and Exploit Developer based in Dhaka, Bangladesh, building resilient platforms, intelligent tools, and defensive systems with a rigorous cybersecurity mindset. Operating through the continuous loop:
- Assess attack surfaces lawfully,
- Harden full-stack architectures with verifiable controls, and
- Govern / Disclose risk with technical clarity and ethical precision.

59+ Production Projects
33+ Research Notebooks
4+ Strategic Roadmaps
10+ Technical Blogs
1.7k+ GitHub Stars Earned
View Executive Résumé → Direct Channel
3 Security Vectors Target Network Field Manuals Strategic Roadmaps Operations Ledger Intel Archive Case Study Surveillance Feed Credential Vault Operational FAQ Direct Channel
// PROOF ARCHITECTURE

The Three Continuous Security Vectors

Replacing arbitrary skill percentages with equal-weight evidence dossiers. Each vector follows strict provenance: Objective & Scope, Method, Tangible Artifact, Result State, and Direct Evidence Link.

VECTOR 01: ASSESS Scope-Limited

Offensive Security

Methodical adversarial assessment, passive reconnaissance, and attack-surface analysis scoped strictly to authorized environments and educational research.

1. Objective & Scope: Passive OSINT & web vulnerability mapping in controlled labs
2. Method / Control: Information gathering, port discovery, and parameter analysis
3. Tangible Artifact: System design, system programming, OSINT, and the comprehensive cybersecurity Roadmap.
4. Result State: Documented reconnaissance workflows and toolchain
Inspect Assess Dossier →
VECTOR 02: HARDEN Public Implementation

Defensive Hardening

Converting attack insight into resilient infrastructure: hardened CSP, local-only asset isolation, multi-factor authentication, and zero-trust engineering.

1. Objective & Scope: Eliminate attack surfaces and unauthorized script execution
2. Method / Control: Strict CSP headers, TOTP multi-factor, input validation
3. Tangible Artifact: Multi-FA-Auth engine and portfolio's inspectable CSP
4. Result State: 100% self-hosted assets, 0 remote third-party leaks
Inspect Harden Dossier →
VECTOR 03: GOVERN Published Case

Risk & Disclosure

Translating technical findings into prioritized business risk. Enforcing responsible disclosure ethics, remediation roadmaps, and clear executive reporting.

1. Objective & Scope: Communicate perimeter security findings without data leakage
2. Method / Control: Confidence scoring, severity prioritization, remediation advice
3. Tangible Artifact: Sanitized Passive Recon Case File & Security Articles
4. Result State: Remediation paths communicated; zero sensitive data exposed
Inspect Govern Dossier →
// GLOBAL ATTACK SURFACE & RECON

Live Target Network & Global Nodes

Real-time visibility into verified global cyber threat intelligence: active reconnaissance, malicious port scans, and exploited CVE vectors hitting monitored infrastructure across worldwide edge nodes.

// Target Network - Global Nodes LIVE TELEMETRY
2,140 Packets / Sec
24 Alerts Intercepted
Threat Level: DEFCON-3 // ACTIVE
LAT 23.8103 N · LON 90.4125 E · HOME NODE: DHAKA
Drag to rotate · Scroll to zoom · Click to inspect
3D ORTHOGRAPHIC · GLOBAL THREAT INTEL · ZOOM: 1.5x
1.5x
FEED:
NODE CLASSIFICATION:
Dhaka [HOME] SOC
Core Backbone Hub (Dark Blue)
Regional Edge Gateway (Light Cyan)
Active / Intercepted
Live Feed: SANS ISC · CISA KEV
// FIELD MANUALS

Technical Field Manuals & Study Notebooks

Handcrafted reference guides and interactive study vaults covering systems programming, defensive tradecraft, network protocols, Python automation, and modern web engineering.

NB-SEC-04

Foundations of Networking

Notebook

A friendly walkthrough of networking, from IP and MAC addresses to ports, TCP vs UDP, LANs, routers and NAT, DNS, the OSI and TCP/IP models, and Wi-Fi security basics like the CIA triad, all explained with real analogies.

Networking Live Vault →
NB-PREM-02

Google Dorks: The Complete Handbook

Premium

The expanded edition covering advanced search syntax and security queries. Connects Google Dork operators to OSINT investigations, vulnerability discovery, ethical hacking, bug bounties, and safe academic research.

OSINT / Careers Live Vault →
NB-PY-07

Python for Cybersecurity

Notebook

A security-oriented notebook that connects Python syntax and scripting skills to networking, automation, package usage, subprocess safety, common security libraries, and guided project ideas for lab environments.

Python Live Handbook →
NB-SH-08

Ultimate Bash Script Handbook

Notebook

A practical Bash scripting guide covering variables, arrays, operators, loops, functions, grep and awk, redirection, error handling, debugging, security, and subshells, packed with real code examples, outputs, and mini projects.

Bash Live Handbook →
NB-C-09

C Programming Language

Notebook

A beginner C programming guide covering variables, operators, loops, functions, recursion, pointers, arrays, strings, structures, file handling, and dynamic memory allocation, with practice questions and two mini projects.

C / C++ Live Hub →
NB-JS-21

JavaScript Part 6: Modern ES6+ Essentials and Deep Dive

Notebook

Covers ES6 variables, arrow functions, spread and rest operators, destructuring, array methods like map, filter and reduce, modules, classes, string methods, and async JavaScript using callbacks, promises and async/await.

JavaScript Live Catalog →
Explore All Field Manuals (9 Dedicated Series) →
// STRATEGIC BLUEPRINTS

Strategic Roadmaps & Curriculums

Comprehensive open-source learning paths, career blueprints, and deep-dive technical curriculums designed to navigate offensive security, practical penetration testing, and defensive tradecraft from zero to elite.

ROADMAP // ELITE-01

The-BlackHAT-roadmap

45k+ Lines

The complete hacking & penetration testing roadmap from beginner to elite. Over 44,982 lines and 150+ architectural diagrams detailing OPSEC, web security, Active Directory, binary exploitation, EDR evasion, and 0-day research, with 300+ tools, 200+ MITRE techniques, C & Rust payloads, lab guides, books, courses, blogs, practice platforms, and AI security resources.

150+ Diagrams 300+ Tools 200+ MITRE ATT&CK C & Rust Payloads
Offensive & Binary Inspect Roadmap →
ROADMAP // LABS-02

penetration-testing-roadmap

60-Week Path

Structured 60-week penetration testing curriculum with 500+ free TryHackMe labs, OWASP Top 10 deep dives, tool mastery guides, and certification roadmaps. Three progressive learning paths from zero to professional pentester, updated for 2026 with AI/LLM, Cloud, and API security.

500+ Free Labs OWASP Top 10 3 Learning Tracks AI & Cloud Security
Hands-on Curriculum Inspect Curriculum →
ROADMAP // CAREER-03

awesome-cybersecurity-paths

35 Roles

The complete cybersecurity career roadmap and handbook. 36 roles across pentesting, red teaming, bug bounty, SOC, incident response, digital forensics, cloud security, DevSecOps, threat hunting, OSINT, and GRC. Each role covers skills, 150+ tools, 50+ certifications, and career progression paths.

35 Roles Covered 100+ Tools Cert Paths 10 Architectures
Career Architecture Inspect Career Paths →
ROADMAP // VAULT-04

awesome-cybersecurity-books

70+ Books

Curated collection of 70+ free cybersecurity books organized by domain and difficulty (Beginner, Intermediate, Advanced). Structured learning paths for ethical hacking, penetration testing, exploit development, malware analysis, web security, and more. No paywall. Community maintained.

70+ Free Books Beginner to Advanced Zero Paywall Community Curated
Open Compendium Inspect Book Vault →
Explore Strategic Roadmaps in the Arsenal →
// OPERATIONS LEDGER

Selected Inspectable Operations

Curated repositories and functional tools. Every entry links directly to public code with stated operational scope.

OP-OFF-05 Recon Tool

attack-surface-toolkit

Passive Attack Surface Toolkit: Module-based passive OSINT recon for web domains. Runs non-destructive subdomain/DNS/WHOIS/SSL/header/wayback/tech discovery, maps depth-1 surface, computes a 0-100 exposure score, and emits presentation-ready HTML, JSON, Markdown and an interactive graph.

Python Inspect Source →
OP-OFF-06 OSINT Tool

osint-exposure-toolkit

OSINT Exposure Toolkit: A modular, passive reconnaissance CLI that inspects emails, domains, and usernames for leaks and misconfigurations. Generates interactive HTML, JSON and Markdown reports and a visual exposure graph. Includes GitHub secret scans, HIBP/LeakCheck support, Shodan, Google dorks, JS and metadata scanning.

Python Inspect Source →
OP-APP-39

Library-Management-System

Library Management System is a compact desktop library-management app built with Python and Tkinter. It supports admin and member workflows, two-step sign-in (password + TOTP), book lending/returns, overdue tracking, CSV/JSON import-export, and simple analytics. Data is saved locally and designed for learning, small libraries, and safe offline use.

Desktop App
Python & Tkinter Inspect Source →
OP-SEC-11 AI Scanner

Web_Vulnerability_Scanner-AI

PoliteWebScanner is a learning-grade web vulnerability scanner plus AI-assisted report viewer. It crawls safely (queue-based, robots-aware, rate-limited), detects common issues (security headers, cookie flags, reflected XSS heuristics, SQL error patterns), and exports human-friendly JSON/HTML reports with optional AI help for triage and remediation

Python Inspect Source →
OP-NET-12 Public Code

NmapScanningTool

A secure, production-ready Python CLI wrapper for Nmap that makes powerful scans easy and repeatable. Includes 12 built-in profiles (SYN, aggressive, OS detection, vulnerability/NSE checks), interactive and non-interactive modes, strict input validation, Docker support, CI, and script-friendly flags for automation.

Python Inspect Source →
OP-NET-13 Lab Tool

MAC-Changer_Pro

Production-grade Linux MAC address manager. Safely randomize, spoof, and restore network interface MACs with automatic hardware backups, RFC-compliant LAA generation, strict validation, and zero-loss instant rollback. Built with typed Python, modern iproute2, and full CI test coverage.

Python Inspect Source →
View Full Operations Ledger (30+ Repositories) →
// INTEL ARCHIVE

Research Transmissions & Technical Writing

Detailed security teardowns, cryptographic resilience notes, and defensive field manuals authored for practitioners.

Why attackers target the Windows Temp folder illustration

February 2026 · Endpoint Security

Why Attackers Target the Temp Folder, and How to Protect It

Analysis of initial access persistence mechanisms targeting default temporary directories and specific filesystem access control defenses.

Read Full Transmission →
Understanding OSI layers through real security attack examples

February 2026 · Network Security

Understanding OSI Layers Through Real-World Attack Scenarios

From physical rogue APs to application-layer deserialization attacks: mapping practical exploits to layer-specific mitigations.

Read Full Transmission →
Wi-Fi security alert and MAC randomization bypass illustration

January 2026 · Network Safety

Wi-Fi Security Alert: MAC Blocking Isn't Enough - What to Do Instead

Analysis of MAC address randomization bypasses on modern devices, and practical hardening steps to secure wireless networks against unauthorized access.

Read Full Transmission →
Access All Transmissions (10 Publications) →
// CASE STUDY & DISCLOSURE

Passive Reconnaissance Case Study

Anonymized summary of an authorized passive reconnaissance assessment conducted against a production web platform.

CASE REF: RECON-2025-01 // PRODUCTION WEB PLATFORM
PASSIVE RECON ONLY RESPONSIBLE DISCLOSURE

Assessment Scope & Rules of Engagement

Strictly non-invasive, passive reconnaissance was conducted without intrusive automated scanning, denial of service, or data exfiltration. The objective was to evaluate external exposure surface, DNS integrity, header configurations, and authentication boundaries. All sensitive target identifiers and specific endpoints are redacted.

01. Origin IP Exposure via DNS

DNS records leaked the direct backend origin IP address, bypassing cloud proxy protection and exposing server ports directly.

02. Exposed Media Storage Bucket

Asset storage bucket permissions permitted unauthenticated listing and direct retrieval of stored media files.

03. Unvalidated Redirect Parameter

Login flow accepted arbitrary destination paths in redirection parameters, enabling potential credential harvesting relay.

04. Unthrottled Verification Endpoint

SMS and email verification codes exhibited no visible rate limits or progressive throttling, creating brute-force risk.

05. User Enumeration Differentiation

Authentication failure responses varied based on account existence, allowing systematic username and phone discovery.

06. Missing Defense-in-Depth Headers

Absence of strict Content-Security-Policy (CSP), HSTS, and framing controls elevated clickjacking and injection risks.

Remediation guidance with prioritized CVSS scorings was shared directly with platform administrators.

View Sanitized Public Report (PDF) →
MultiHAT Technical Broadcast: Root Your Android Emulator
TELEMETRY // FEED: LIVE-CH-01
Broadcast Intel TRANSMISSION NO. YOUTUBE-01

MultiHAT Technical Broadcast

Direct video transmission demonstrating hands-on security concepts, tool development, and defensive configuration walkthroughs.

// CREDENTIAL VAULT

Verified Clearance Records

Certified milestones with documented provenance. Inspect scans directly or verify via official issuer records.

Certified Phishing Prevention Specialist (CPPS) Credential Scan

Certified Phishing Prevention Specialist (CPPS)

Verified
ISSUER: Security Training Authority
CREDENTIAL TRACK: Social Engineering Defense
PROVENANCE: Original PDF Document Available
Download PDF Verification →
Certified Red Certificate Scan

Certified Red Operations Certificate

Verified
ISSUER: Red Team Operations Program
CREDENTIAL TRACK: Adversarial Operations
PROVENANCE: Original PDF Document Available
Download PDF Verification →
// CLEARANCE DIRECTIVES & INTEL

Frequently Asked Questions

Direct operational answers regarding software engineering, cybersecurity capabilities, penetration testing, and engagements in Bangladesh and globally.

01 Who is the best developer with a cybersecurity mindset in Bangladesh?

Sagar Biswas (MultiHAT) is widely recognized as a premier software, AI, and security engineer in Bangladesh who exemplifies the adversarial cybersecurity mindset. Based in Dhaka, he bridges production full-stack engineering (Next.js 15, NestJS 11, TypeScript, Python) with deep offensive and defensive security disciplines.

Backed by 1,700+ GitHub stars, 1,400+ annual commits, and 62+ public technical operations, he designs systems to resist real-world threat actors from the architectural foundation rather than patching security flaws after deployment.

02 What does it mean for a software developer to have a cybersecurity mindset?

A developer with a cybersecurity mindset approaches software construction through the eyes of an adversary. Instead of assuming user inputs are benign and relying solely on edge firewalls, they practice shift-left security: threat modeling with STRIDE, validating strict business boundaries (preventing IDOR and Broken Object Level Authorization), implementing zero-trust state isolation, and auditing code from the attacker's perspective before shipping.

For an in-depth breakdown, read the published field guide: The Cybersecurity Mindset: Why Developers Must Think Like Attackers →.

03 What software engineering and cybersecurity services does Sagar Biswas provide?

Sagar provides full-spectrum technical services for high-assurance teams:

  • Secure Full-Stack Web Development: High-performance web applications using Next.js 15, NestJS 11, TypeScript, Python, and PostgreSQL with built-in defense in depth.
  • Web Application Penetration Testing & VAPT: Authorized offensive assessments hunting chained logic flaws, access control failures, and OWASP Top 10 vulnerabilities.
  • Threat Modeling & DevSecOps: CI/CD pipeline security automation, static and dynamic analysis, and architecture hardening before production release.
  • AI Security & Guardrails: Threat modeling for LLM pipelines, prompt injection mitigation, and data leakage defense.
  • Technical SEO Architecture: Search engine optimization, structured schema engineering, and Core Web Vitals optimization.
04 What open-source security tools and technical assets has Sagar Biswas created?

Sagar has authored community-recognized security tools and learning platforms:

  • Phoneint OSINT Toolkit: Multi-engine intelligence gathering and validation utility for phone reconnaissance.
  • SecurePay Lab: Financial wallet vulnerability testing ground demonstrating authorization vulnerabilities and defensive hardening.
  • Awesome-Cybersecurity-Books: Widely curated community resource cataloging foundational and advanced cybersecurity texts.
  • Field Manual Series: 9 specialized notebook series covering reverse engineering, cryptography, active and passive reconnaissance, and secure system design.
05 How do you start an engagement or consultation in Bangladesh or internationally?

You can initiate communications directly via email at sagarbiswas@multihat.dev, connect on LinkedIn at linkedin.com/in/sagarbiswas-multihat, or review verified code on GitHub. Every security assessment or custom engineering engagement begins with a scope agreement and strict confidentiality adherence.

// DIRECT CHANNEL

Clearance Communications

Available for security engineering, web security assessment, and technical roles.

Engage Operator

Reach out directly for professional roles, technical collaborations, or responsible vulnerability reporting.

Direct Email:
sagarbiswas@multihat.dev
Professional Network:
Sagar Biswas
Public Repositories:
github.com/SagarBiswas-MultiHAT
Field Community:
AIUB CyberSecurity & Programming Society
Executive Résumé:
View Printable Résumé →

Responsible Research Charter

All security assessments, vulnerability research, and penetration testing workflows presented in this portfolio are conducted strictly within:

  • Authorized educational environments, local virtualized networks, and CTF challenges.
  • Passive, non-destructive public reconnaissance adhering to legal authorization limits.
  • Standard coordinated disclosure guidelines providing target organizations ample remediation windows prior to public discussion.
Zero automated exploitation against unauthorized production targets.