Breaking things to make them secure. Specializing in web & mobile application security, API vulnerability research, and exploit chaining across bug bounty programs.
dhira@kali:~$ nmap -sV -sC target.com
dhira@kali:~$ nuclei -t cves/ -u https://target.com
dhira@kali:~$ sqlmap -r request.txt --dbs --batch
[ ✓ ] Vulnerabilities identified. Generating report...
Tools and techniques in my offensive security toolkit
Professional certifications, training credentials, and academic achievements
Awarded for responsibly disclosing a Reflected XSS vulnerability on the Bali Satu Data government platform through the official bug bounty program.
Served as a practicum assistant for the Computer Network course, guiding students through networking fundamentals, configuration labs, and troubleshooting exercises.
Completed a professional data analyst training program covering data collection, analysis methodologies, visualization techniques, and reporting.
Selected findings from bug bounty programs and security assessments
Bypassed blacklist-based XSS filter using String.fromCharCode obfuscation to achieve JavaScript execution in application origin context.
Exploited GraphQL introspection + IDOR + alias batching to access cross-tenant customer data and admin-only resolvers.
Details will be published after responsible disclosure review.
Details will be published after responsible disclosure review.
Detailed technical case studies of vulnerability discoveries and exploitation techniques
A reflected XSS vulnerability was found in the search parameter of a government data portal. Common XSS payloads were blocked by a blacklist filter, but the filtering was bypassed using obfuscated JavaScript construction and character-code based string generation, allowing JavaScript execution in the application origin context.
Exploited enabled GraphQL introspection to enumerate hidden resolvers, then leveraged alias batching to bypass per-query rate limiting and authorization checks, gaining unauthorized access to cross-tenant customer data.
A stored Cross-Site Scripting vulnerability was discovered in the Master Kategori Produk Hukum functionality. Injected JavaScript payloads were stored by the application and executed when the affected page was rendered, demonstrating insufficient input sanitization and unsafe output handling.
Weak rate limiting and insufficient CAPTCHA enforcement on a government authentication endpoint allowed repeated login attempts without effective throttling, significantly increasing brute force attack feasibility.
Broken object-level authorization in a support ticket workflow allowed authenticated users to create tickets on behalf of other accounts via manipulation of a user-controlled customer parameter.
Stored XSS vulnerability in a support/helpdesk workflow allowed attacker-controlled JavaScript execution when support tickets were viewed by users or internal staff, enabling session hijacking and privileged workflow abuse.
Full technical writeup will be published after the responsible disclosure review process is completed.
Open-source tools and research projects for the security community
A cinematic cybersecurity portfolio built with Astro, Tailwind CSS, Three.js, and GSAP. Features immersive scroll-linked animations, 3D cyber environments, and interactive case study pages.
Security tooling project currently in development. Details will be published upon release.
Offensive security automation project currently in development. Details will be published upon release.
Peer-reviewed cybersecurity research and penetration testing analysis
Security Analysis of University Websites in West Nusa Tenggara Against SQL Injection, XSS, and IDOR Attacks Through Penetration Testing
This research analyzes the security posture of university websites in West Nusa Tenggara against SQL Injection, Cross Site Scripting (XSS), and Insecure Direct Object Reference (IDOR) attacks through penetration testing methodologies. The study combines automated and manual penetration testing approaches using tools such as Burp Suite, SQLMap, Xray, Nmap, and Wappalyzer, evaluating vulnerability severity using CVSS v3.1 and providing mitigation recommendations for higher education institutions.
Interested in collaboration, security engagements, or just want to connect?
Whether you need a security assessment, want to discuss vulnerability research, or have an interesting project — I'm always open to new opportunities.
dhiraxioo@gmail.com