78+Vulnerabilities researched
Research total shared by the researcher VULNEX / SECURITY RESEARCHResearch the weakness.
Research the weakness.
Understand the system.
My security research is focused on how web applications and APIs enforce trust, identity, permissions, and business rules — and what happens when those controls fail.
V
WEB APPLICATIONS
API SECURITY
WEB + APIPrimary focus
Application security researchRESPONSIBLEDisclosure approach
Scope-aware testing and reporting01 / RESEARCH DOMAINSUnderstanding the
Understanding the
ways systems can fail.
Areas I have studied and tested through hands-on labs and authorized bug bounty programs.
Access Control & Authorization
Evaluating whether users can access only the resources and actions permitted by their role and relationship to the data.
Server-Side Security
Investigating server-side request behavior, trust boundaries, and unsafe processing paths with careful validation.
Injection & Client-Side Issues
Studying how untrusted input reaches interpreters, templates, and browser execution contexts.
Authentication & Session Logic
Reviewing identity workflows, account states, session behavior, and edge cases in verification flows.
API Security & Data Exposure
Examining API responses, object access, information exposure, and authorization consistency across endpoints.
Business Logic & Workflow Abuse
Questioning assumptions in multi-step flows, state transitions, and business-critical actions.
02 / METHODOLOGYFrom attack surface
From attack surface
to clear evidence.
A repeatable process helps separate interesting behavior from a reproducible security issue.
Scope & Discover
Understand program scope, identify assets, and map the visible application surface.
Map & Baseline
Collect endpoints, establish normal request/response behavior, and identify relevant inputs.
Test Assumptions
Review identities, permissions, parameters, tenant boundaries, and expected workflow rules.
Validate Impact
Reproduce safely, verify the security boundary, and assess what data or action is affected.
Document & Disclose
Prepare clear evidence, practical impact, and responsible communication through the program process.
03 / RESEARCH TOOLKITTools support the process.
Tools support the process.
Judgment drives the result.
Working with the right tool for the question.
I use common security testing and reconnaissance utilities as part of a broader manual workflow. Tool output is treated as a starting point for verification, not as proof on its own.
View technical expertise ↗Web & API testing
Burp Suite · OWASP · SQLMap · XSStrike · Dalfox · kxss · mantra
Reconnaissance
Amass · Subfinder · httpx · Katana · waymore · waybackurls · uro
Analysis & secrets
Nmap · TruffleHog · Scapy
Programming & systems
Python · Bash · C++ · SQL fundamentals · Git · Linux / Ubuntu · Windows · WSL
V
RESPONSIBLE DISCLOSUREResearch with respect
Contact me ↗Research with respect
for scope and privacy.
Program names, target identities, credentials, private data, and sensitive reproduction details are not published here. Detailed findings are shared only where disclosure is permitted and appropriate.