Breaking Assumptions. Securing Systems.
I'm MASKNODS, an independent security researcher dedicated to uncovering systemic vulnerabilities in modern cloud APIs, distributed microservices, and web applications.
Research Philosophy
Vulnerabilities rarely exist because developers write careless code; they emerge because complex systems force developers to make assumptions. When an API gateway assumes downstream microservices will enforce object authorization, or when a payment handler assumes sequential state transitions, security gaps open.
My objective as a researcher is to systematically test those implicit assumptions. By combining passive reconnaissance, architectural threat modeling, and precision Proof-of-Concepts (PoCs), I assist engineering organizations in discovering critical logic and authorization defects before malicious adversaries can exploit them.
Technical Specializations
01. REST & GraphQL API Security
Broken Object Level Authorization (BOLA/IDOR), broken function level authorization, parameter tampering, and excessive data exposure in distributed backends.
02. Identity & Access Management
OAuth2 flow hijacking, JSON Web Token (JWT) signature verification pitfalls, session fixation, and multi-tenant permission isolation auditing.
03. Business Logic Testing
Concurrency conditions, workflow state skips, price and quantity tampering, and race conditions exploiting HTTP/2 multiplexing.
04. Server-Side Vulnerabilities
Server-Side Request Forgery (SSRF) against cloud metadata services, cross-site scripting (XSS), and insecure direct deserialization.
Tools & Environment
A breakdown of everyday testing utilities and environments. Tools are instruments of analysis, not substitutes for systematic critical thinking.
Interception & Proxying
API & Protocol Analysis
Reconnaissance & Automation
Runtime & Client Debugging
Responsible Disclosure Principles
Only test assets explicitly covered within approved bug bounty program scopes or authorized disclosure programs.
Cease testing immediately upon confirming a vulnerability. Never alter, exfiltrate, or delete user or production data.
Adhere to standard Coordinated Vulnerability Disclosure windows, keeping research private until vendor patches are deployed.
Every report submitted includes a clear reproduction script (cURL), CVSS 3.1 rating justification, architectural root-cause diagnosis, and actionable engineering remediation guidance.