// about

Hi, I'm Anas.

available for remote pentest roles

I'm a web & API penetration tester and bug bounty hunter based in Karachi, Pakistan. I find vulnerabilities in real applications and then write down exactly how I found them — that's what this blog is. I'm credited with CVE-2018-8383 and have disclosed 20+ writeups across bug bounty programs.

get in touch → read the writeups

CVE CREDIT
CVE-2018-8383
WRITEUPS
20+ disclosed
FOCUS
Web · API · Mobile
BASED IN
Karachi, PK

What I work on

Web application testing

Access control, injection, authentication and business-logic flaws — the bugs that actually matter, not just scanner noise.

API security

REST and GraphQL: broken object-level authorization, excessive data exposure, and the schema details that leak more than intended.

Mobile / APK auditing

Static analysis of Android apps — hardcoded secrets, exported components, and insecure storage pulled out of production builds.

Selected findings

CVE-2018-8383 disclosed · credited A publicly credited vulnerability — my first CVE, and the one that got me deeper into offensive security.

Stored XSS in Zoho Mail via the image proxy $200 · fixed The mail image proxy served attacker-hosted SVGs unsanitised, executing script in the Zoho origin. Triaged within minutes.

20+ bug bounty writeups web · api · mobile IDOR chains, SSRF, access-control bugs and more — each one documented end to end on this blog.

How I work

Recon-driven and methodical. I map an application's real attack surface before touching a single payload, chase the odd behaviour most people scroll past, and then write everything up — because a bug you can't explain clearly is a bug you only half understand. The writeups here double as my own reference.

Burp Suite nuclei ffuf subfinder httpx jadx Python Linux