# Nirmal Dahal

> Nirmal Dahal is a cybersecurity consultant and co-founder of CryptoGen Nepal, helping organisations with penetration testing, security operations and GRC.

Nirmal Dahal is a cybersecurity consultant and co-founder of CryptoGen Nepal (https://cryptogennepal.com), founded in 2019. He has worked in security since 2016.

Working arrangements: based in Kathmandu, Nepal (UTC+05:45); available for remote engagements, with on-site work arranged per engagement.

Current roles: Co-founder, CryptoGen Nepal; Part-time lecturer, Softwarica College of IT & E-commerce; Community leader, Pentester Nepal.

Quick facts: 5 services, 18 certifications, 36 talks, trainings and panels delivered. Contact: send a message at https://nirmaldahal.com.np/contact#enquiry or book a call at https://nirmaldahal.com.np/contact#meeting.

## Services
- [Penetration testing and offensive assessment](https://nirmaldahal.com.np/services/offensive-security): Web, API, mobile, network and cloud testing from an attacker's point of view.
- [Security operations and incident response](https://nirmaldahal.com.np/services/security-operations): Detection engineering, SIEM, incident handling and malware analysis.
- [Governance, risk and compliance](https://nirmaldahal.com.np/services/governance-risk-compliance): Information system audits, ISO/IEC 27001 and security strategy.
- [Agentic AI security and security automation](https://nirmaldahal.com.np/services/ai-and-automation): Securing AI agents and LLM features, and automating the security work itself.
- [Training, workshops and speaking](https://nirmaldahal.com.np/services/training-and-speaking): Security awareness, technical workshops and conference talks.

## About
- [About me](https://nirmaldahal.com.np/about): Background and how I got here.
- [Hacktivities](https://nirmaldahal.com.np/about/hacktivities): The moments that stand out.
- [Experience](https://nirmaldahal.com.np/about/experience): Roles, newest first.
- [Expertise](https://nirmaldahal.com.np/about/expertise): Skills by domain, each with its proof.
- [Certifications](https://nirmaldahal.com.np/about/certifications): Credentials across offence, defence and audit.
- [Recognition](https://nirmaldahal.com.np/about/recognition): Awards, rankings and credited research.
- [Recommendations](https://nirmaldahal.com.np/about/recommendations): What people I've worked with say.
- [Community](https://nirmaldahal.com.np/about/community): Leadership, open source and teaching.
- [Travel](https://nirmaldahal.com.np/about/travel): Trips abroad, for work and for the love of it.

## Appearances
- [Appearances](https://nirmaldahal.com.np/appearances): Overview, with trips abroad
- [Events](https://nirmaldahal.com.np/appearances/events): Talks, trainings and panels, with filters.
- [Media](https://nirmaldahal.com.np/appearances/media): Interviews, videos and press coverage.

## Resources
- [Blog](https://nirmaldahal.com.np/resources/blog): Articles and notes from the field.
- [Series](https://nirmaldahal.com.np/resources/series): Multi-part write-ups, read in order.
- [Case studies](https://nirmaldahal.com.np/work): Work with a public trail, written up.
- [Slides](https://nirmaldahal.com.np/resources/slides): Decks from talks and trainings.
- [Analysing the “Nepali Girl” Android trojan](https://nirmaldahal.com.np/work/nepali-girl-trojan): Malware analysis, 2022 to 2023
- [CVE-2021-3258: stored XSS in a Question2Answer plugin](https://nirmaldahal.com.np/work/cve-2021-3258): Vulnerability research, 2017 to 2021
- [GHDB-ID 4997: finding exposed application secrets](https://nirmaldahal.com.np/work/ghdb-4997): Security research, 2018
- [National Cyber Drill, March 2025](https://nirmaldahal.com.np/work/national-cyber-drill-2025): Training and exercise, 2025

## Series
- Hardware Security: [Hardware hacking: bridging the cybersecurity gap](https://nirmaldahal.com.np/resources/blog/hardware-hacking-bridging-the-cybersecurity-gap), [Getting started with hardware hacking: tools](https://nirmaldahal.com.np/resources/blog/getting-started-with-hardware-hacking-tools)

## Blog posts
- [From PyCon JP 2024 speaker to PyCon JP 2026 organiser](https://nirmaldahal.com.np/resources/blog/from-pycon-jp-2024-speaker-to-pycon-jp-2026-organizer): 2026-04-18. How Python shaped my offensive security work, what I presented at PyCon JP 2024 in Tokyo, and how it led to joining the PyCon JP 2026 organising team.
- [Getting started with hardware hacking: tools](https://nirmaldahal.com.np/resources/blog/getting-started-with-hardware-hacking-tools): 2023-09-11. The basics and tools to start hardware hacking: electronics fundamentals, soldering irons, multimeters, SPI flash programmers, USB-UART and Flipper Zero.
- [Hardware hacking: bridging the cybersecurity gap](https://nirmaldahal.com.np/resources/blog/hardware-hacking-bridging-the-cybersecurity-gap): 2023-09-09. How a childhood spent repairing electronics led me to hardware hacking, and why hardware skills matter for closing gaps in cybersecurity.
- [Navigating the regex maze with ease: ReGen](https://nirmaldahal.com.np/resources/blog/navigating-the-regex-maze-with-ease-regen): 2023-08-02. ReGen is a small open source tool that builds regex patterns from values you select in logs or text, for forensics, attack, defence and validation work.
- [Nepali Girl: trojan analysis](https://nirmaldahal.com.np/resources/blog/nepali-girl-trojan-analysis): 2023-02-04. Analysis of Nepali Girl, an Android trojan that spread in Nepal through WhatsApp for over a month, stealing sensitive data from victims' phones.
- [MEGA's unlimited cloud storage vulnerability](https://nirmaldahal.com.np/resources/blog/megas-unlimited-cloud-storage-vulnerability): 2022-11-17. How a flaw in MEGA's cloud storage let a free account store about 1,300 GB of data despite the 20 GB limit, found in June 2022 without any tools.
- [Leveraging SQL injection to execute XSS by evading CSP](https://nirmaldahal.com.np/resources/blog/leveraging-the-sql-injection-to-execute-the-xss-by-evading-csp): 2022-07-12. How a SQL injection was used to get past a content security policy (CSP) and execute XSS, starting with a short introduction to how CSP works.
- [Reflected XSS leading to CSRF bypass and account takeover](https://nirmaldahal.com.np/resources/blog/r-xss-leading-csrf-bypass-to-account-takeover): 2019-11-26. How a reflected XSS was chained to steal a CSRF token and change a victim's password, bypassing CSRF protection to take over the account.
- [XSS on samy.pl](https://nirmaldahal.com.np/resources/blog/xss-on-samy-pl): 2019-06-19. How a javascript: URL got past the source-viewing blocks on samy.pl, the site of security researcher Samy Kamkar, and the XSS issue behind it.
- [CVE-2021-3258: stored XSS and account takeover in Q2A](https://nirmaldahal.com.np/resources/blog/cve-2021-3258-s-xss-to-defacement-account-takeover-q2a-themes): 2017-08-21. A proof of concept for CVE-2021-3258, a stored XSS in a Question2Answer (Q2A) theme that led to site defacement and account takeover.
- [Facebook SVG Locky ransomware analysis](https://nirmaldahal.com.np/resources/blog/facebook-svg-locky-ransomware-analysis): 2016-11-22. How a malicious SVG file spreading on Facebook redirected victims to a fake YouTube page that pushed a browser extension tied to Locky ransomware.
- [Bypassing eBay's XSS protection](https://nirmaldahal.com.np/resources/blog/bypassing-ebay-xss-protection): 2016-09-11. A proof of concept for a POST-based reflected XSS I found in eBay's customer service search in 2016, and how its XSS protection was bypassed.

## Contact
- [Contact](https://nirmaldahal.com.np/contact): Send a message or book a 30-minute call
- [LinkedIn](https://www.linkedin.com/in/thenittam)
- [GitHub](https://github.com/TheNittam)
- [X](https://x.com/TheNittam)

## Optional
- [llms-full.txt](https://nirmaldahal.com.np/llms-full.txt): Every fact on the site in one file
- [Sitemap](https://nirmaldahal.com.np/sitemap.xml)