Bug Bounty
Recon workflows, testing methodology, notes, and lessons from authorized programs.
Explore methodology →CYBERSECURITY
Research. Build. Break. Learn.
Bug bounty research, custom tooling, writeups, and authorized offensive-security experiments.
Bug BountyToolsWeb SecurityResearch
BUG BOUNTY JOURNEY
Profiles & public work
The public profiles and repositories behind the Dreams of Tragedy security work.
Total Reports8
HackerOne Reports2
Bugcrowd Reports6
Public GitHub Repos5
FOCUS AREAS
What lives in this section
Tools
Custom Burp extensions, scanners, automation helpers, and purpose-built research utilities.
View featured tools →Writeups
Technical notes, discoveries, methodology breakdowns, and public research.
Read latest posts →Labs
Experiments, works in progress, test environments, and ideas still being refined.
View active labs →FEATURED TOOLS
Built for the workflow.
A growing set of helpers built around real testing and research needs.
DOM Source / Sink Locator
A Burp Suite extension that scans textual Proxy responses for DOM source indicators and exports findings for review.
JavaBurp SuiteDOM XSS
View on GitHub →
DOT SSRF Framework
A personal SSRF scanning and workflow framework for authorized testing and research.
ShellSSRFAutomation
View on GitHub →
Reflected Parameter Watcher
Checks for reflected parameters and collects them into a list for review and export.
JavaBurp SuiteReflection
View on GitHub →
HuntCraft
An offline SIEM query builder for Splunk, CrowdStrike, Microsoft Sentinel, and IBM QRadar, with IOC searches, visual filters, and customizable result tables.
SIEMThreat HuntingOffline
View on GitHub →
FEATURED PROJECT
DOM Source / Sink Locator
Automatically surface DOM source indicators from Burp Proxy traffic so interesting client-side attack surfaces are easier to review.
Burp ExtensionPassive WorkflowCSV Export
Open GitHub Repo
DOM-source-sink-locator
Sources
location.search
location.hash
document.URL
window.name
Review proxy responses
Collect matches
Export findings → CSVRECON METHODOLOGY
Turn recon into vulnerability hypotheses.
The goal is not to collect the biggest URL list. It is to understand functionality, prioritize attack surface, and use each finding to guide the next round of recon.
Scope & Discovery
Build a clean scope, enumerate subdomains, normalize results, and flag higher-value hosts such as API, admin, staging, auth, upload, webhook, GraphQL, legacy, and backup systems.
Resolve & Fingerprint
Resolve hosts, probe HTTP services, retain interesting status codes, and classify frameworks, CMSs, web servers, CDNs/WAFs, authentication systems, APIs, cloud providers, and JavaScript frameworks.
Crawl & Map
Browse manually through Burp, crawl important applications, compare current and historical endpoints, and inventory parameters, APIs, JavaScript, uploads, redirects, webhooks, GraphQL, and WebSockets.
Analyze JS & APIs
Look for hidden functionality, routes, source maps, internal hosts, storage buckets, OAuth endpoints, file-processing paths, redirects, URL-fetching behavior, and structured API operations.
Parameters & Content
Prioritize dynamic endpoints for hidden-parameter discovery and use technology-specific content discovery instead of blindly fuzzing every host the same way.
Functionality → Bug Class
Classify what an endpoint actually does—fetch, redirect, upload, download, import, webhook, object access, OAuth, GraphQL—and map that behavior to the bug classes that make sense.
Targeted Testing
Branch into focused testing only after recon produces a plausible hypothesis, with special attention to URL processing, client-side behavior, and authorization boundaries.
Score & Loop
Prioritize the highest-value functionality first, then feed every new host, route, parameter, or behavior discovered during testing back into recon.
THE LOOP
Recon → Map Functionality → Form Hypothesis → Test
If testing reveals new information, it goes straight back into recon. The process keeps moving until the target stops producing useful new attack surface.
RECENT POSTS
Research notes
COMING SOON
Bug bounty writeups and technical notes
This area will hold public writeups, methodology notes, and lessons learned.
ACTIVE LABS
Work in progress
IN DEVELOPMENT
Burp tooling & web-security helpers
Experimental helpers, workflow improvements, and research prototypes will appear here as they mature.