Malik Dishan
Hettige
Self-taught application security researcher. Working through PortSwigger labs and hunting on HackerOne VDP programs — focused on IDOR, authentication flaws, and business logic bugs.
No degree. No mentor. Just the labs, the reports, and the clock.
I started teaching myself web application security in January 2026, at 17. No formal training, no bootcamp — I skipped A-levels and a degree path entirely to go full-time into this. Just PortSwigger labs, disclosed reports read line by line, and the slow work of learning to think like the app instead of just clicking around it.
Right now the entire plan is narrow on purpose: IDOR and broken access control, authentication flaws, and business logic — three classes, studied deep instead of four studied shallow. I've finished the full Access Control path on PortSwigger and I'm midway through Authentication. The strongest chain I'm building toward is auth bypass → IDOR/broken access control → privilege escalation or business logic abuse. I've analyzed 20+ disclosed reports on HackerOne so far, and everything I ship publicly gets logged here as it happens, not cleaned up after the fact.
The near-term goal is concrete: a fully remote AppSec role paying $2,000+/month, landed shortly after I turn 18 in January 2027. The stretch goal is a single $12,000+ bounty by mid-2027. Longer term, Cloud Security Engineer roles are the direction I'm building toward — that's the multi-year plan, not a claim I'm making early.
What I actually work with
Split between languages I write code in and the tools I run daily for labs and live hunting — Burp Suite sits in both categories, it's open for basically every session.
Three vulnerability classes.
No more, no less.
Loading…
What I'm building toward next
Desync → Golden SAML → ORM → Blind SSTI → RCE
Operational research on a modern multi-stage chain most hunters haven't operationalized: HTTP request desync primitives, Golden SAML via XML canonicalization collisions, ORM type confusion, and blind SSTI side-channel exploitation. Built on the same access-control and authentication foundation as everything else here — this is the escalation, not a departure.
How each target gets worked
Screen the program
Response rate, resolved report count, real bounty table, scope shape — two minutes, no exceptions.
Read before touching anything
Every disclosed report on the program gets read first. What's already been found tells you what hasn't.
Recon the real surface
subfinder → httpx → gau → katana. Finding what other hunters walked past, not testing the same endpoint harder.
Test against the three classes
Access control, auth, business logic — mapped deliberately against every role, tier, and object reference in scope.
Write it so triage doesn't have to ask twice
Clear repro steps, impact stated plainly, no padding. Every report gets analyzed afterward, accepted or not.
Public work
Writeups & updates
Loading…
Where things stand
Access Control is done. Authentication is in progress. Once both plus Business Logic are solid, the plan shifts to live hunting and disclosed-report analysis at scale — roughly 50 reports per class — run in parallel with prepping for a junior remote security role. No live paid submission yet — that's the next milestone, not a claim I'm making early.
Loading…
These are the tools that actually carry the daily work — testing, recon, and note-taking, in no particular order.