👋 Hi, I'm savi0r

Security researcher with hands-on experience in web security, bug bounty and offensive security fundamentals.
Focused on understanding systems, attack surfaces and real-world exploitation paths.

---

🔍 Areas of Focus

• Web Security & Business Logic Flaws
• Server-Side Vulnerabilities (SSRF, IDOR, Auth issues)
• Client-Side Attacks (DOM-based XSS, postMessage, race conditions)
• Network & Infrastructure Exposure
• Red Team fundamentals & attack chains

---

🧠 Technical Skills

Web & Backend

• XSS (reflected, DOM-based, postMessage)
• SSRF (internal recon, metadata exposure)
• Authentication & Authorization bypasses
• JWT weaknesses
• Logic flaws in payments & workflows

Infrastructure & Networking

• HTTP / DNS / TCP-IP fundamentals
• SMB enumeration & misconfigurations
• Cloud storage exposure (S3, backups, archives)
• Internal service discovery

---

🧰 Tooling

• Burp Suite
• Nmap
• ffuf / gobuster
• curl / httpx
• smbclient / enum4linux
• Wireshark
• Git & GitHub

---

📂 Portfolio Highlights

• Medium-severity SSRF (network segmentation bypass)
• Internal service exposure via mod_status reconnaissance
• JWT confusion → SSTI → RCE (CTF case study)
• Internal service exposure & data leaks
• CTF challenges focused on realistic exploitation
• Recon → exploitation → reporting workflow

> Detailed writeups and tooling are organized inside this repository.

---

📜 Certifications & Programs

• Bug Bounty Research (Intigriti / HackerOne)
• CTF challenges (web & infra focused)

---

Collapse