Skip to content
View Carrtik's full-sized avatar
😎
Debugging my latest experiment
😎
Debugging my latest experiment
1 follower · 1 following

Block or report Carrtik

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Carrtik/README.md

Hi, I'm Kartik Nair

Offensive security researcher and systems programmer. I find real bugs in production code.

Security Research

Advisory Target Severity Status
GHSA-6457-j4jq-j7x5 Spring AI Alibaba Critical 9.9 Pending CVE
GHSA-h2c7-rx9m-j6rr Spring AI Alibaba High 8.1 Pending CVE
GHSA-q83f-9wj5-xrmc Spring AI Alibaba High 7.5 Pending CVE
DJL JAR bypass deepjavalibrary/djl Critical 9.8 Huntr — pending
Kubeflow CUSTOM RCE kubeflow Critical 9.9 Huntr — pending
smolagents numpy DoS huggingface/smolagents Medium Huntr — pending
GHSA-cxjq-35gw-4m9f MLflow LangChain High Credited in PR #23292

Linux Kernel Contributions

Patch Subsystem Status
net/llc: fix UBSAN array-index-out-of-bounds in llc_conn_state_process Networking ⏳ Under review — David Miller, Eric Dumazet
cfg80211: validate chandef before set_monitor_channel WiFi/Networking ⏳ Under review — Johannes Berg
mm/hugetlb: fix deadlock in __hugetlb_zap_begin() Memory Management ⏳ In discussion
accel/rocket: fix ignored return value Rockchip NPU Driver ⏳ Under review
zsmalloc: zero-initialize zspage memory Memory Management ⚠️ Merged by Andrew Morton → triggered investigation by Herbert Xu into 842 decompressor

Tools

Tool What it does
mlflow-audit Static analyzer detecting unguarded pickle deserialization in MLflow codebases
Valkyrie Linux privilege escalation auditor mapped to MITRE ATT&CK
Cylock Multi-threaded network scanner built from raw TCP/IP primitives
Dynamic-Honeypot-RL Adaptive honeypot using Q-learning to respond to live attacker behaviour
Shield-Cloud Self-healing cloud with CRYSTALS-Kyber + AES-256-GCM, autonomous key rotation

Writing

Stack

Python · C · Bash · Linux Internals · Raw Sockets · Docker · CRYSTALS-Kyber · MITRE ATT&CK

Pinned Loading

  1. Cylock Cylock Public

    Multi-threaded network scanner with MITRE ATT&CK T-code mapping. Built with Python raw sockets for deep packet analysis

    Python

  2. Dynamic-Honeypot-RL Dynamic-Honeypot-RL Public

    Adaptive honeypot using Q-learning to dynamically select responses based on live attacker behaviour. XGBoost detection engine. Dockerized.

    Python

  3. mlflow-audit mlflow-audit Public

    Static analysis tool to detect missing pickle deserialization guards in MLflow codebases

    Python

  4. Shield-Cloud Shield-Cloud Public

    Autonomous self-healing cloud environment secured with CRYSTALS-Kyber (ML-KEM-1024) + AES-256-GCM. XGBoost threat detection with key rotation in under 8 seconds. Final year capstone — MS Ramaiah, 2…

    TypeScript