Uday Dogra
I find real-world vulnerabilities in modern web applications — before attackers do.
Breaking
Applications
Before Hackers Do
Focused on finding real-world vulnerabilities in modern web applications. Bug bounty hunter. Security researcher. Thinking like an attacker, documenting like a pro.
Security Researcher.
Not a generic dev.
I'm Uday Dogra, a B.Tech Computer Science graduate with a sharp focus on Application Security and offensive web security. I don't just learn security — I apply it: digging into real applications, finding real vulnerabilities, and documenting them with clarity.
My approach is attacker-first. I study how web applications break — through SSRF, IDOR, XSS, injection attacks — and build methodologies to find them systematically. Every engagement ends with a clean, professional report that a security team can actually action.
Currently active on HackTheBox and PortSwigger Web Security Academy, building recon pipelines on cloud infrastructure, and pursuing bug bounty programs on HackerOne.
Technical Arsenal
A comprehensive set of tools and skills for application security, SOC monitoring, and full-stack development.
Application Security
8 skillsHelps me identify and mitigate real-world vulnerabilities like XSS, CSRF, and IDOR by understanding backend logic.
Security Tools
9 skillsAllows me to automate reconnaissance and perform deep vulnerability testing across web and network layers.
SOC & Automation
6 skillsEnables me to monitor network traffic, analyze logs, and build automation scripts to improve incident detection.
Development Stack
8 skillsProvides the foundation to build secure full-stack applications and understand the developer's perspective.
What I've Built
Security-focused projects with real-world applicability. Each one solves an actual problem in the offensive security workflow.
Designed and implemented a simulated SOC environment using Splunk, Wireshark, and Proxmox. Simulated attacks such as brute-force and DNS tunneling to practice detection workflows and incident response mapping.
Developed a GUI-based automation tool for Linux security operations using Python and Tkinter. Features include automated log parsing, scanning, and service management to improve operational efficiency.
Building an interactive platform to demonstrate web vulnerabilities like XSS, IDOR, and Auth flaws. Includes hands-on labs explaining backend behavior to help learners understand both exploitation and mitigation.
Bug Bounty & Labs
Active on bug bounty platforms and security labs. Building a track record of real vulnerability finds.
Actively hunting on public programs. Current focus: SSRF, IDOR in modern SaaS targets.
Reflected XSS via Parameter Pollution
Identified URL parameter reflected in response without encoding
Injected <script>alert(1)</script> — filtered by WAF
Used event handler payload: "><img src=x onerror=alert(1)>
Confirmed execution — extracted session cookie via document.cookie
PoC documented with impact: session hijacking / account takeover
Session hijacking possible → Full account takeover. Affected all users with modern browsers. No user interaction required beyond visiting a crafted URL.
My Attack Methodology
Systematic, repeatable, documented. This is how I approach every target — not random, always structured.
Recon
Passive + active target discovery. Map attack surface before touching a single endpoint.
Enumeration
Subdomain probing, port scanning, JS file mining, endpoint discovery.
Fuzzing
Directory, parameter, and header fuzzing. Find what devs forgot to hide.
Exploitation
Confirm and chain vulnerabilities. SSRF, IDOR, XSS, SQLi — test all identified vectors.
Reporting
Clear, reproducible reports. Severity scoring, impact analysis, remediation steps.
Recon
Passive + active target discovery. Map attack surface before touching a single endpoint.
Enumeration
Subdomain probing, port scanning, JS file mining, endpoint discovery.
Fuzzing
Directory, parameter, and header fuzzing. Find what devs forgot to hide.
Exploitation
Confirm and chain vulnerabilities. SSRF, IDOR, XSS, SQLi — test all identified vectors.
Reporting
Clear, reproducible reports. Severity scoring, impact analysis, remediation steps.
> "A vulnerability found is a vulnerability fixed. Systematic methodology beats random poking every time."
Tools in Action
Real commands from a real security workflow. This is what day-to-day reconnaissance looks like.
Let's Connect
Recruiting for AppSec? Collaborating on security research? Open to serious opportunities.