Offensive Security Engineer | Bug Bounty Hunter
"I break systems before attackers do."
Offensive Security Engineer specializing in Web, API, and Mobile Application security testing.
I started my journey building software — but quickly realized I was more fascinated by breaking things than building them. What began as curiosity turned into a career hunting vulnerabilities across real-world applications.
From discovering critical authentication bypasses and chained exploits at HackersEra, to building a Web3 antivirus bot that got acquired by an antivirus firm, I've always been at the intersection of offense and innovation.
Today, I combine manual testing expertise with automated recon pipelines to find what scanners miss. Whether it's a business logic flaw hiding in plain sight or a smart contract vulnerability waiting to be exploited — I find it.
50+ valid vulnerabilities reported across real-world apps — privilege escalation, auth bypass, chained exploits
Deep manual testing aligned with OWASP Top 10, custom payload crafting & attack chaining
Smart contract development, honeypot detection bot, Chrome extension acquired by AV firm
Comprehensive vulnerability assessment and penetration testing for web applications, APIs, and mobile apps. Manual testing aligned with OWASP methodology, combined with automated scanning.
For: Startups, SaaS companies, enterprises seeking compliance
Get Started →Launch or optimize your bug bounty program. Get expert guidance on scope definition, triage workflows, and vulnerability management — from someone who's been on both sides.
For: Companies launching or scaling bug bounty programs
Contact Me →Smart contract security auditing, honeypot token detection, and Web3 security development. Built tools that were acquired — I know the attack surface intimately.
For: Web3 projects, token launches, DeFi protocols
Get Started →Complete automated reconnaissance framework. Subdomain enumeration, live host detection, attack surface mapping, and vulnerability scanning — all in one pipeline. Built from real-world bug bounty experience.
The exact methodology I use for bug bounty hunting. Covers recon, testing, reporting — organized by vulnerability class with payloads, tips, and real-world examples from my experience.
Automated Bug Bounty Recon Framework
Manual recon is time-consuming and error-prone. Bug bounty hunters need fast, comprehensive attack surface mapping.
Built automated pipeline for subdomain enumeration, live host detection, and vulnerability scanning with AI-assisted analysis.
Enumerated 100+ subdomains per engagement. Identified IDOR & privilege escalation vectors during recon phase.
Detection Engineering with Wazuh
Organizations need real-time threat detection and alerting for SSH brute-force, privilege escalation, and intrusions.
Integrated Wazuh SIEM with Suricata IDS rules and VirusTotal API. Built custom detection logic and Telegram alerting.
Automated detection of brute-force attacks, privilege escalation, and malicious files with real-time alerting.
Honeypot & Scam Token Detection
Crypto users lose millions to honeypot tokens and scam contracts. No easy way to verify token safety before buying.
Built a Telegram bot + Chrome extension for automated smart contract analysis and honeypot detection.
Chrome extension acquired by an antivirus firm. Bot actively screening tokens and monitoring wallet activity.
Discovered a critical privilege escalation vulnerability where an attacker could manipulate user roles to gain unauthorized administrative access, leading to full system compromise.
Read on Medium →Found a high-impact CSRF vulnerability, earned a $700 bounty, and then recreated the entire vulnerability as a hands-on security lab for educational purposes.
Read on Medium →Discovered a critical authentication bypass vulnerability allowing unauthorized access to admin endpoints through JWT token manipulation and flawed session validation.
Read Writeup →Identified an IDOR vulnerability in user profile endpoints that, when chained with an information disclosure flaw, led to exposure of sensitive personal data of all platform users.
Read Writeup →Available for freelance projects & full-time roles. Let's build something secure together.