Security researcher from Tiruvannamalai, India. I find vulnerabilities in web applications, APIs, and cloud infrastructure. Specialized in IDOR, authentication bypass, and broken access control. Creator of 31 open-source security tools. Active on HackerOne, Bugcrowd, and Intigriti.
Security tools and utilities I've built for the bug bounty community. 31 repositories on GitHub.
All-in-one bug bounty command center: targets, findings, payload lab, CVSS calculator, report generator.
View on GitHub →Zero-dependency bug bounty payload generator & mutator — 7 vuln types, 6 encodings, WAF-bypass variants.
View on GitHub →Bug bounty submission report generator — CVSS 3.1 calculator, 27 vuln templates, 5 platform formats.
View on GitHub →Terminal mission control for bug bounty hunters — curses TUI with radar, targets, findings, loot tracker.
View on GitHub →Discovers and maps API endpoints from OpenAPI/Postman/Swagger specs and JS/GraphQL.
View on GitHub →Zero-dependency subdomain takeover detector — DNS + HTTP fingerprinting against ~45 services.
View on GitHub →Fast, multi-threaded recon toolkit — DNS, ports, subdomains, TLS, security headers. Pure C, single binary.
View on GitHub →Fast recon & fingerprinting toolkit — favicon hash, crt.sh, SSL fingerprint, security header audit.
View on GitHub →Probes API endpoints for Insecure Direct Object Reference vulnerabilities.
View on GitHub →Enumerates and checks S3 buckets for public access and misconfigurations.
View on GitHub →Shell pipeline that chains recon tools together into one end-to-end bug bounty workflow.
View on GitHub →Scans JavaScript files for exposed API endpoints, secrets, and GraphQL schemas during recon.
View on GitHub →All-in-one bug bounty recon toolkit — zero dependencies, pure Python.
View on GitHub →Parses and probes JSON responses/APIs for exposed data and misconfigurations during recon.
View on GitHub →Tools and methodologies I use for security research and development.
Manual testing for OWASP Top 10, business logic flaws, access control issues, and authentication bypasses.
REST & GraphQL API testing for IDOR, BFLA, mass assignment, injection, and excessive data exposure.
Subdomain enumeration, endpoint discovery, attack surface mapping, and OSINT. Built 5+ custom recon tools.
OTP bypass, session management, JWT analysis, OAuth/SSO flows, MFA bypass techniques.
Android/iOS app testing — insecure storage, deep links, API abuse, and reverse engineering.
AWS S3 misconfigurations, IAM issues, and cloud infrastructure testing.
Python, C, Shell scripting, and JavaScript for tool development and automation.
Clear, structured vulnerability reports with reproduction steps, impact analysis, and remediation advice.
Active on major platforms with proven track record.
If you find my work helpful, consider buying me a coffee to keep the research going!
☕ Buy Me a CoffeeOpen to collaboration, teaming, and security discussions.