Security Researcher & Bug Bounty Hunter

Ranveer aka bugatsec

I hunt for account takeover vulnerabilities and authentication logic flaws in real-world applications. My approach centers on understanding how systems fail under edge cases rather than relying on payload-driven testing.

Core Focus

Where I Hunt

Areas where I've developed deep expertise and consistently find critical vulnerabilities

Account Takeover (ATO)

Finding and exploiting vulnerabilities that allow unauthorized account access through OTP bypasses, session hijacking, and authentication logic flaws. This is where I spend most of my research time.

Authentication Logic

Analyzing login flows, token validation, permission checks, and finding privilege escalation vectors. Understanding how authentication systems break at their edges.

Business Logic Flaws

Abusing application workflows, feature interactions, and system assumptions to bypass restrictions and controls. Thinking beyond traditional vulnerability classes.

JavaScript Analysis

Reviewing client-side code for sensitive data exposure, API key leaks, and frontend security controls. Understanding how frontend logic can enable backdoor access.

Secret Discovery

Developing custom search patterns and reconnaissance techniques to identify exposed credentials, configuration files, and sensitive information across platforms.

API Security

Testing GraphQL/REST endpoints for injection, broken object level authorization, excessive data exposure, and learning new technologies on-demand for specific targets.

Notable Research

Selected Findings

Real-world vulnerabilities discovered across bug bounty programs

Account Takeover via Race Condition & OTP Bypass

CRITICAL
Major Hospitality Platform CVSS 9.8 Duplicate

Discovered a race condition in the registration flow that allowed account creation using any email address without verification. By chaining this with OTP handling flaws, complete account takeover was achievable.

  • Account takeover of any user
  • Unauthorized account verification
  • Complete loss of account integrity
Why This Matters

Demonstrates how timing issues combined with trust assumptions can break otherwise "secure" authentication systems. This finding represents my focus on exploit chains rather than single vulnerabilities.

Business Logic Abuse via Message Editing

P2
AI Platform Business Logic Fixed

Abused the message editing feature to bypass free-tier message limits. The flaw existed due to missing enforcement when modifying existing messages after limits were reached.

  • Circumvention of usage restrictions
  • Resource abuse and quota bypass
  • Feature interaction exploitation
Why This Matters

Shows how non-obvious feature interactions can invalidate core product controls without traditional vulnerabilities. This required understanding how the system tracked and enforced limits.

Production Config Leak: 25+ Secrets Exposed

CRITICAL
Gaming Platform CVSS 9.1 Duplicate

Built custom search patterns to identify exposed configuration files, leading to the discovery of 25+ production secrets including API keys, database credentials, and third-party service tokens.

  • Potential account compromise
  • Third-party service abuse
  • Infrastructure takeover risk
Why This Matters

Highlights a recon-driven methodology rather than opportunistic discovery. This finding demonstrates the importance of systematic information gathering and understanding what to look for.

Stored XSS via User Identity Fields

CRITICAL
Sports Social Platform VDP Session Theft

Injected persistent XSS payloads via username, name, and address fields. Payload executed across user views, allowing cookie exfiltration to an attacker-controlled server and complete account takeover.

  • Session compromise via cookie theft
  • Complete account takeover
  • Full site trust breakdown
Why This Matters

Demonstrates understanding of stored XSS impact chains, not just payload injection. This was my first valid XSS finding and showed how client-side vulnerabilities can lead to server-side consequences.

GraphQL Exposure & API Analysis

INFORMATIONAL
Automotive Platform GraphQL Learning Case

Learned GraphQL specifically for this target. Identified exposed introspection on a development endpoint, mapped internal API routes, and assessed DoS vectors via query complexity.

  • Unauthenticated mutations exposed
  • Introspection enabled on dev endpoint
  • Potential DoS via complex queries
Why This Matters

Shows ability to learn new technologies on-demand and apply them during live hunting. This research demonstrates my approach to expanding skills based on target requirements.

Technical Arsenal

Skills & Methodology

Tools, languages, and approaches I use in security research

Core Languages

JavaScript
Python
HTML/CSS
Bash
SQL
C
PHP
Java

Security Domains

Authentication Flows
Account Takeover
Business Logic
Session Management
Race Conditions
API Security
Client-Side Analysis
Secret Discovery

Methodology

Exploit Chains
Root Cause Analysis
Read Before Hunt
Reproduce Logic
Document Everything
Learn On-Demand
Impact Focus
System Thinking
Security Tools

Projects & Tools

Open-source security tools and awareness projects I've developed

Dorking Duck

Google Dorks Generator for Security Research

A curated collection of 150+ Google dorks for finding APIs, cloud exposures, directory listings, login/admin panels, and sensitive filetypes. Generates domain- or wildcard-scoped queries for systematic reconnaissance.

  • 150+ curated security dorks
  • Generate domain-specific queries
  • Export query lists for automation
  • Focus on APIs and sensitive files
View on GitHub

Ghostmark

Command-Line Image Forensics Toolkit

Comprehensive image forensics tool for metadata extraction, steganography detection, hash generation, and text embedding/extraction. All processing happens locally with no data collection.

  • Extract and scrub metadata
  • Detect steganography techniques
  • Generate and compare image hashes
  • Password protection detection
View on GitHub

Raina

Cybersecurity Awareness Platform

Student-led initiative to promote cybersecurity awareness through interactive educational tools. Demonstrates security concepts in a non-exploitative manner with all processing happening locally in the browser.

  • Email breach check simulation
  • Hash generator & IP analysis
  • Link analyzer & phishing awareness
  • 100% local browser processing
View on GitHub
Get In Touch

Let's Connect

Open to discussing security research, bug bounty methodologies, and collaboration

Contact Information

I'm actively researching web security vulnerabilities and always interested in discussing new approaches, methodologies, and potential collaborations.