ESTABLISHING UPLINK…
000%
ACCESS GRANTEDROOT SHELL ESTABLISHED // nice find, operator.
ELI CIPHER — WEB & API SECURITY → SATELLITE & SPACE SYSTEMS SECURITY

EVERY SYSTEM
HAS A CIPHER.
ON THE WAY TO FIND IT

19 years old and self-taught. I work on web & API security, and I'm taking it all the way to orbit: satellite & space systems security.

CLICK AN ORBITING SATELLITE TO INSPECT ITS PAYLOAD
ground-station — zsh
SCROLL TO DECRYPT
01

Operator Profile

I'm Eli Cipher — 19, from India, and entirely self-taught. The origin story is almost a cliché: at 14, I taught myself HTML because I thought it would let me "hack everything." By 15 I had mastered frontend development. At 17, a foundational cybersecurity program showed me what the work actually is — and I never looked back.


Today I'm transitioning from web & API offense — where I fund my learning with bug bounty and vulnerability research — into the layer most people forget exists: space. My target orbit is satellite & RF/SATCOM link security, and the attack surfaces that emerge when AI-driven spacecraft autonomy starts making its own decisions.


Top 10% on TryHackMe and climbing daily. Open to security research, red team, and space systems security opportunities.

// GROUND STATION TELEMETRY

CALLSIGNELI CIPHER
LOCATIONINDIA · UTC+5:30
TRAJECTORYWEB/API → ORBIT
THM RANKTOP 10% · CLIMBING
LEARNINGSDR · GNU RADIO · SATCOM
STATUSLISTENING…
ISS POSITIONACQUIRING…
02

Arsenal

OFFENSE — CURRENT

Web / API Testing████████░░
Burp Suite███████░░░
Fuzzing (custom tooling)████████░░
OWASP Top 10████████░░

LANGUAGES / CORE

Python████████░░
JavaScript / HTML / CSS█████████░
Bash███████░░░

MISSION TARGET — IN PROGRESS

RF Fundamentals██████░░░░
SATCOM Link Security█████░░░░░
Space Systems / CCSDS█████░░░░░

DETECTION & OPS

SIEM Pipelines (Docker lab)███████░░░
Wireshark███████░░░
Attack Simulation███████░░░
// RF SPECTRUM MONITOR — 435.000 – 438.000 MHz · UHF SATCOM DOWNLINK · HOVER TO TUNE
// SIMULATED SATELLITE BREACH — SCROLL TO EXECUTE //
03

Attack Chain

T+00
Reconcatalog NORAD IDs · pass predictions · footprinting
T+01
Signal AcquisitionSDR lock · Doppler correction · demodulation
T+02
Protocol Analysisframe dissection · CCSDS parsing · crypto audit
T+03
Exploitationcommand injection · replay · firmware backdoor
T+04
Intercept & Flagdownlink captured · root shell · telemetry pwned
exploit-framework — session 1
04

Operations

PYTHON · OFFENSE

HTTP-FUZZER

Python-based HTTP request fuzzer that hunts for web vulnerabilities — XSS, SQL injection, and directory traversal — built from scratch to understand attacks at the request level, not just point tools.

PythonXSS · SQLi · LFI
DOCKER · BLUE TEAM

SOC-DOCKER-LAB

A full SOC pipeline in containers — attack and defense in one box. Simulates brute-force with Hydra from a Kali container against an Nginx server, then detects and logs it end-to-end.

DockerHydra · Nginx · SIEM
RESEARCH · DAILY

WEB-SECURITY-NOTES

Daily-updated knowledge base from PortSwigger Web Security Academy labs, organized across 10 vulnerability categories. Every solved lab logged as Approach → Why → Tool. 48 commits and counting.

48 commits10 categories
PYTHON · PHISHING

EMAIL-HEADER-ANALYZER

Python tool that dissects email headers to detect phishing, spam, and suspicious activity — extracts key fields and IPs, then scores the risk.

PythonPhishing · OSINT
05

CTF & Research

0
TryHackMe · Global Rank
0
THM World Ranking
0
Labs · Security Notes
0
Tools & Labs Shipped
Field notes, CTF writeups & research logs → relocated to section 06 VIEW ALL →
06

Field Notes & Writeups

ONGOING · DAILYWEB · RESEARCH

PortSwigger Labs, Documented: 10 Vulnerability Categories

Every solved lab logged as Approach → Why → Tool. A public knowledge base at 48 commits and counting — the receipts of a self-taught operator.

living documentread the notes
2026CTF

TryHackMe Hackers Holiday Challenge — Participant Notes

Room-by-room breakdowns: recon shortcuts, the payloads that landed, and the rabbit holes that quietly ate three hours.

multi-part seriesview profile
INCOMING TRANSMISSIONSATCOM

From Web Payloads to RF Payloads: Moving into SATCOM

Why I'm leaving pure web offense for the link layer most hackers never touch — SDR rigs on a $0 budget, GNU Radio first steps, and what "signal" actually means.

in draft
INCOMING TRANSMISSIONSATCOM · CRYPTO

Satellite Telecommand Replay: When Weak Crypto Meets LEO

A simulated look at replay attacks against unencrypted telecommand uplinks — CCSDS frames, forged TCs, and owned telemetry.

in draft
07

Establish Uplink

uplink — secure channel
operator@sat-link:~$ ./contact --initiate
[+] encrypted channel established ....... OK
[+] handshake verified .................. OK
> DROP A TRANSMISSION: contact.elicipher@gmail.com
> FREQUENCY: always monitoring. Response time < 24h.
operator@sat-link:~$