Hello World!
Topic
This is my first blog post.
Most of my reports are still undisclosed, so I can’t share specific targets, exact payloads, or full timelines yet. Until those disclosures are public (or I’m explicitly allowed to publish details), I’ll focus on the parts that are safe and still useful:
- how I think about the bug class
- the mental models that helped me find it
- tooling + workflows (recon → hypothesis → testing)
- “what to watch for” patterns you can apply to your own targets
I’d rather be a bit vague than accidentally burn a fix or leak something that impacts real users.
How I learned (and what I recommend)
If you want to learn faster, here’s the approach that helped me the most:
- Read lots of writeups and research posts (even if you don’t understand everything on day one).
- Pause and ask questions. I used AI a lot to break down confusing parts, explain terminology, and compare techniques.
- Collect references. I kept a personal “library” of links and notes so I could revisit topics later.
- Recreate concepts in small experiments (local labs, toy apps, or intentionally vulnerable setups).
You don’t need to copy someone’s exact exploit chain. The real value is learning the reasoning and the edge-cases.
Recommended reading
Here are two great PortSwigger resources I recommend:
- Web Cache Entanglement (research): https://portswigger.net/research/web-cache-entanglement
- Web Cache Labs (implementation flaws): https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws
I’m using this space to share short write-ups from bug bounty hunting, web vulnerability research, and notes on tooling and methodology. Expect posts on things like HTTP edge-cases, middleware behavior, cache poisoning, and attack chains that show up in real programs.
What to expect next
- Quick vulnerability research notes
- Practical recon and triage workflows
- Small case studies (with responsible disclosure in mind)
Thanks for reading.