About
Background & Security Practice
I am an offensive security practitioner focused on web application and API security.
My security testing approach prioritizes manual analysis over relying solely on automated scanners. I first try to understand how an application works, how its users interact with it, and where trust and privilege boundaries exist.
From there, I test whether the application's security assumptions can be bypassed through unexpected inputs, modified requests, privilege manipulation, workflow abuse, or other attacker-controlled conditions.
My current focus includes web exploitation, API security, authentication and authorization, access control, business logic vulnerabilities, and other vulnerabilities affecting modern web applications.
I continuously improve my skills through penetration testing, bug bounty research, hands-on experimentation, and documenting what I learn.
Programming basics
Operating systems
Process
Methodology
- 01
Manual Security Testing Methodology
My testing methodology starts with understanding the application before attempting to exploit it. I prioritize manual analysis of application behavior, business logic, authentication, authorization, and access control to identify realistic attack paths and validate their security impact.
- 02
Reconnaissance
Identify the application's attack surface, technologies, domains, endpoints, APIs, parameters, functionality, and important application flows.
- 03
Application Understanding
Understand how the application works from a user's and attacker's perspective. Map important workflows, request flows, roles, objects, and relationships between application components.
- 04
Manual Testing
Manually manipulate requests, parameters, identities, roles, objects, HTTP methods, and application states to identify unexpected behavior and security weaknesses.
- 05
Business Logic Analysis
Analyze business workflows and security assumptions to determine whether functionality can be abused by changing the expected sequence, state, or conditions of an operation.
- 06
Authentication & Authorization
Test authentication mechanisms and authorization boundaries to identify privilege escalation, unauthorized functionality access, broken role separation, and access control weaknesses.
- 07
API Security Testing
Assess API endpoints for object-level and function-level authorization issues, excessive data exposure, authentication weaknesses, input validation problems, and other API security risks.
- 08
Exploitation & Validation
Validate suspected vulnerabilities manually and determine whether the behavior can be reliably reproduced and exploited under realistic conditions.
- 09
Impact & Documentation
Document reproducible proof-of-concept evidence, exploitation steps, technical impact, affected functionality, and practical remediation recommendations.
Track record
Bug bounty experience
Web Application & API Security Assessments
- Identified and manually validated business logic vulnerabilities, broken access controls, authentication and authorization flaws, and vulnerabilities aligned with the OWASP Top 10 and OWASP API Security Top 10.
- Assessed security controls within financial application workflows, including privilege boundaries, role-based access control, transaction logic, and server-side authorization.
- Conducted security assessments of web-based management portals and API administration systems, identifying injection vulnerabilities, information disclosure, improper access controls, and sensitive data exposure.
- Performed reconnaissance and endpoint discovery followed by manual testing and exploitation to validate security impact.
- Prepared reproducible proof-of-concept evidence, exploitation steps, technical impact analysis, and remediation recommendations for confirmed security findings.