root@anand_

what i do

cybersecurity engineer at ust

independent bug bounty hunter

write-ups

• cloudflare workers and d1 as a stealthy command & control framework for data exfiltration
  march 2025
• remote code execution via dependency confusion
  march 2024
• abusing graphql idor to delete another user's profile picture
  july 2022
• blind ssrf via dns rebinding
  april 2022

tools

• knockknock: bash script that automates ip/host filtering using http status codes. used for efficient scope reachability testing. [github]
• chromeshot: a headless chrome-powered tool that captures full-page screenshots from a list of urls or ips. ideal for visual recon. [github]

miscellaneous

first prize winners of c0c0n 2024 ctf competition [news link]

delivered a talk at defcon dc0471 meetup 0x02 in september 2018, focused on bug bounty hunting [event photos]

mail

mail@anandsreekumar.com