About Me
I'm an independent cybersecurity researcher, penetration tester, and bug bounty hunter from Bangladesh. My work sits at the intersection of offensive security and software development — I hunt vulnerabilities, disclose them responsibly, and build tools that help others do the same.
Specializing in web application security, I've discovered and disclosed critical vulnerabilities including IDOR chains, broken access controls, WAF bypasses, and PII leaks across multiple public and private bug bounty programs.
When I'm not hunting bugs, I'm writing technical write-ups on Medium, developing security tooling, or contributing to the broader security research community.
Credentials & Clearances
Verified expertise in offensive security — click any badge to inspect credentials and verify authenticity.
Expertise
Projects
Write-ups
From Directory Fuzzing to Full Administrator Account Takeover
A step-by-step walkthrough of chaining directory fuzzing with broken access control vulnerabilities to achieve full administrative account takeover.
WAF Bypass Techniques for Modern Web Applications
Exploring advanced WAF bypass techniques including encoding tricks, HTTP request smuggling, and JSON/XML injection to circumvent modern web application firewalls.
Hardcoded Credentials & PII Leak — Bug Bounty Disclosure
How I discovered exposed API keys and sensitive PII in a public JavaScript bundle leading to a critical vulnerability disclosure on Yogosha.
Apache APISIX Gateway Misconfiguration — Analysis & PoC
Deep dive into Apache APISIX gateway misconfiguration vulnerabilities, including a proof-of-concept exploit and mitigation strategies.
Experience
Independent Security Researcher
Active CVE research, proof-of-concept development, and responsible disclosure of vulnerabilities across multiple software systems.
Penetration Tester & Bug Bounty Hunter
Web application and network penetration testing engagements. Active bug bounty hunter on HackerOne and Yogosha with multiple critical findings disclosed.
Undergraduate — Computer Science & Engineering
BSc in Computer Science & Engineering. Concurrent with security research, certification pursuit, and open-source tool development.
Security Tool Developer
Built ProjectDisclosed, BountyTrack, and RadonF — open-source tools to assist the security research community in managing bug bounty workflows.