Bug hunter. Most of the work is in a proxy: replay a request, change one assumption, see what the server still allows.
about · work · desk · built · github
|
I look at how web apps and APIs fail in production — mostly through bug bounty programs and CTFs.
Between reports I write small tools, because recon eats the night if I let it. If I’ve done a step twice by hand, it tends to become a script. |
field notes
|
|
Access control first: IDOR, BOLA, hidden admin routes, CORS that reflects
origin and still sends cookies. Then identity — session reuse after logout,
reset-link poisoning, MFA that only lives in the UI, JWT Injection sits next to that. SQLi, NoSQLi, XSS (reflected, stored, DOM), SSTI,
command injection, XXE, header/CRLF. CSRF on state-changing requests that never
got a token. Uploads that trust Business logic is slower — you have to understand how the product makes money before you can make it spend money wrong. |
usual suspects
|
|
usual suspects
|
REST and GraphQL (introspection left on, batching, depth, a nested field that
skipped the check the REST route had). JWTs trusted too hard. OAuth as
“redirect and hope.” A field that wasn’t in the docs until I sent it anyway.
Mass assignment, parameter pollution, SSRF, races. Deserialization — pickle,
Java, PHP |
|
Private buckets that aren’t. Default creds, debug, directory listing, stack traces. Forgotten subdomains. CI printing a token into a log. Outdated deps with a CVE that already has a name. Exception handlers that leak or fail open. |
usual suspects
|
OWASP Top 10 (2025) is the starting map. Named version is in the index.
index
| OWASP | area | what I poke at |
|---|---|---|
| A01 | access control | IDOR, BOLA, privilege escalation, forced browsing, missing function-level checks, CORS with credentials, CSRF, cached pages that belong to someone else |
| A07 | authn / session | session fixation, reuse after logout, credential stuffing, weak reset, Host-header reset poisoning, MFA bypass, JWT none / alg confusion / kid, OAuth redirect_uri / missing state, cookie flags (Secure, HttpOnly, SameSite) |
| A05 | injection | SQLi, NoSQLi, XSS (reflected / stored / DOM), SSTI, OS command injection, XXE, LDAP, header injection, CRLF |
| — | files, fetch, proxy | path traversal, LFI / RFI, unrestricted & polyglot uploads, SSRF, open redirect, request smuggling / desync, Host header, web cache poisoning & cache deception |
| A04 | crypto | secrets in transit or in the page, weak hashing, JWT that isn’t signed like it claims, home-rolled crypto |
| A02 | misconfig | default creds, debug / stack traces, directory listing, fat CORS, exposed .git / backups / admin, cloud bucket & IAM, subdomain takeover |
| A03 · A08 | supply chain & integrity | outdated components, known CVEs, CI/CD secrets in logs, unsigned webhooks, insecure deserialization, prototype pollution, dependency confusion |
| A06 | design & logic | race / TOCTOU, missing rate limit, mass assignment, parameter pollution, business rules that trust the client, GraphQL depth/batching |
| A09 · A10 | logging & exceptions | alerts that never fire, logs that store secrets, handlers that leak internals, fail-open on timeout, 4xx/5xx that skip authz |
| — | client-side | DOM clobbering, postMessage origin skips, clickjacking, tabnabbing, CSS injection, WebSocket with no auth |
|
Burp Suite for the request work. Nmap and Yakit for ports and assets. ZAP when I want a second proxy.
|
Python when the tool needs to exist today. Go when it has to stay fast. PHP when the target is PHP and matching the language makes the bug easier to see.
|
The recon steps that kept repeating turned into these.
GitSD |
KODOK |
PathKit |
Bug bounty on web and API. PathKit is the one still moving. GitSD and KODOK when a recon pass needs them. Notes from testing, when they’re worth keeping. |
Website · GitHub · HackerOne · YesWeHack