Bug hunter. Most of the work is in a proxy: replay a request, change one assumption, see what the server still allows.
I look at how web apps and APIs fail in production — mostly through bug bounty programs and CTFs.
The useful bugs sit between what the UI claims and what the HTTP actually does. Between reports I write small tools, because recon eats the night if I let it. If I’ve done a step twice by hand, it tends to become a script.
Access control first: IDOR, BOLA, hidden admin routes, CORS that reflects
origin and still sends cookies. Then identity — session reuse after logout,
reset-link poisoning, MFA that only lives in the UI, JWT alg / kid / none,
OAuth redirect_uri treated as decoration.
Injection sits next to that. SQLi, NoSQLi, XSS (reflected, stored, DOM), SSTI,
command injection, XXE, header/CRLF. CSRF on state-changing requests that never
got a token. Uploads that trust Content-Type. Path traversal and LFI. Open
redirects that become XSS or token theft two steps later. Request smuggling and
cache deception when the proxies disagree. Prototype pollution and DOM
clobbering on heavy frontends. Business logic is slower — you have to understand
how the product makes money before you can make it spend money wrong.
REST and GraphQL (introspection left on, batching, depth, a nested field that
skipped the check the REST route had). JWTs trusted too hard. OAuth as
“redirect and hope.” A field that wasn’t in the docs until I sent it anyway.
Mass assignment, parameter pollution, SSRF, races. Deserialization — pickle,
Java, PHP unserialize — and webhooks that were never verified.
Private buckets that aren’t. Default creds, debug, directory listing, stack traces. Forgotten subdomains. CI printing a token into a log. Outdated deps with a CVE that already has a name. Exception handlers that leak or fail open.
OWASP Top 10 (2025) is the starting map. Named version is in the index.
index
access control (A01) — IDOR, BOLA, privilege escalation, forced browsing, missing function-level checks, CORS with credentials, CSRF, cached pages that belong to someone else
authn / session (A07) — session fixation, reuse after logout, credential stuffing, weak reset, Host-header reset poisoning, MFA bypass, JWT none / alg confusion / kid, OAuth redirect_uri / missing state, cookie flags (Secure, HttpOnly, SameSite)
injection (A05) — SQLi, NoSQLi, XSS (reflected / stored / DOM), SSTI, OS command injection, XXE, LDAP, header injection, CRLF
files, fetch, proxy — path traversal, LFI / RFI, unrestricted & polyglot uploads, SSRF, open redirect, request smuggling / desync, Host header, web cache poisoning & cache deception
crypto (A04) — secrets in transit or in the page, weak hashing, JWT that isn’t signed like it claims, home-rolled crypto
misconfig (A02) — default creds, debug / stack traces, directory listing, fat CORS, exposed .git / backups / admin, cloud bucket & IAM, subdomain takeover
supply chain & integrity (A03, A08) — outdated components, known CVEs, CI/CD secrets in logs, unsigned webhooks, insecure deserialization, prototype pollution, dependency confusion
design & logic (A06) — race / TOCTOU, missing rate limit, mass assignment, parameter pollution, business rules that trust the client, GraphQL depth/batching
logging & exceptions (A09, A10) — alerts that never fire, logs that store secrets, handlers that leak internals, fail-open on timeout, 4xx/5xx that skip authz
client-side — DOM clobbering, postMessage origin skips, clickjacking, tabnabbing, CSS injection, WebSocket with no auth
Burp Suite for the request work. Nmap and Yakit for ports and assets. ZAP when I want a second proxy.
Python when the tool needs to exist today. Go when it has to stay fast. PHP when the target is PHP and matching the language makes the bug easier to see.
The recon steps that kept repeating turned into these.
- GitSD ·
Go— exposed.gitacross domains and subdomains, then the contents: credentials, keys, source - KODOK ·
Go— hidden API endpoints in JavaScript, dependency chains, secrets with entropy - PathKit ·
Python— path classifier: human slugs vs UUID / hash / timestamp / base64
Bug bounty on web and API. PathKit is the one still moving. GitSD and KODOK when a recon pass needs them. Notes from testing, when they’re worth keeping.