Trimphus — Security Researcher

Available for engagements

TRIMPHUS

Security Researcher / Penetration Tester

Offensive security · vulnerability research · bug bounty

I focus on web application security, vulnerability research and offensive testing. Most of my work involves access control flaws, authentication logic issues, API security and exploit chaining. I have also spent several years doing bug bounty and responsible disclosure work alongside personal lab projects.

70+ proof-of-concept and exploit implementations

28 findings with CVE assignment

5+ years of bug bounty and responsible disclosure work

Approach

Manual analysis first. Automated tooling second.

Most impactful findings tend to appear in authorization logic, authentication flows and API boundaries — not in automated scan results. The interesting issues usually require understanding how a system is supposed to work before looking for where it doesn't.

My work focuses on mapping access control surfaces, tracing data flows across service boundaries and building exploit chains from individually low-risk findings.

Research Focus

Web Application Security

Access control flaws, IDOR, broken authentication, session issues, SSRF and injection. Focus on how authorization logic breaks across multi-step flows and API boundaries — the kinds of issues that require manual analysis to find.

IDOR Auth bypass SSRF API abuse SQLi

Offensive Testing

Penetration testing and red team work. Post-exploitation, privilege escalation, lateral movement and evasion in realistic environments. OSCP, OSEP and OSWE certified.

Privilege escalation Exploit chains Evasion Red team

Vulnerability Research

Finding issues in real-world software through code review, black-box testing and manual analysis. Particular interest in logic vulnerabilities, race conditions and authentication edge cases that automated tooling tends to miss.

Logic flaws Race conditions Manual analysis

Methodology

01Surface mapping and reconnaissance

02API boundary exploration and endpoint analysis

03Authorization logic testing across user roles and states

04State machine analysis in multi-step flows

05Exploit chain construction from low-risk primitives

06Responsible disclosure and coordinated reporting

Responsible Disclosure

Several years of bug bounty work across HackerOne and Bugcrowd. The work covers access control problems, authentication flaws, business logic vulnerabilities and general web application issues — mostly the kind that require manual testing rather than running a scanner.

Reports have gone to a range of larger internet-facing services: social media platforms, domain registrars and infrastructure providers, and other web-based services. Findings ranged from lower-severity issues to critical vulnerabilities with real-world impact. Several resulted in CVE assignments.

A significant part of the work involves access control and IDOR-class issues — cases where object references in APIs or web flows can be manipulated to reach resources belonging to other users. The most impactful finding was a critical IDOR in account functionality that allowed direct cross-user data access, resolved through coordinated disclosure.

IDOR — account data accessible via predictable object reference in API endpoint

fixed

Authentication logic flaw — multi-step flow bypassable through out-of-order request manipulation

fixed

Broken object-level authorization — API parameter accepted arbitrary user IDs without ownership check

fixed

Access control issue — privileged actions reachable via undocumented endpoint after session downgrade

fixed

Business logic flaw — rate limiting absent on sensitive operation; exploitable without authentication

fixed

Bug bounty activity

Active researcher on HackerOne and Bugcrowd

Multiple accepted vulnerability reports across programs

Several findings resulting in CVE assignments

All vulnerabilities were reported responsibly and fixed before any public discussion.

Selected Work

Critical IDOR in account management API

Cross-user data exposure through predictable object reference — direct access to account data across user boundaries via unauthenticated parameter manipulation.

Authentication state bypass

Multi-step verification flow could be skipped by replaying requests out of sequence. Verification state was not enforced server-side between steps.

Broken authorization boundary in distributed service

Inconsistent permission checks across internal API endpoints — one service enforced ownership, a downstream endpoint did not.

Privilege escalation via role transition flaw

Improper validation of account ownership during role update allowed escalation to higher-privilege state without administrative approval.

Business logic flaw in rate limiting

Sensitive operation reachable without authentication throttling — no rate limit applied to credential-bearing requests on an undocumented endpoint.

Certifications

OSCP

Offensive Security — PEN-200

OSEP

Offensive Security — PEN-300

OSWE

Offensive Security — WEB-300

HTB CPTS

HackTheBox — Certified Penetration Testing Specialist

Tooling

Nmap / Masscan Burp Metasploit Hashcat Ghidra ffuf sqlmap dirsearch Amass

Selected Research Topics

API authorization flaws — missing or inconsistently enforced ownership checks on object-level operations

Authentication flow bypasses — out-of-order step execution and state manipulation in multi-step processes

Access control in distributed systems — authorization gaps introduced by service-to-service communication and shared session state

Logic bugs in account management flows — privilege changes, ownership transfers and role assignments that bypass intended restrictions

Research Interests

Authorization logic and how it fails under non-standard usage patterns

Authentication flows — state handling, session management, step-order enforcement

API security boundaries — ownership checks, object-level access control, parameter trust

Exploit chaining — combining individually low-severity issues into meaningful impact

Distributed system access control — permission consistency across service boundaries

Logic vulnerabilities in account management and role/permission systems

Contact

For vulnerability disclosure or encrypted communication, use the PGP key below. You can also reach me via Mastodon or GitHub.

PGP Public Key

Fingerprint D736 974D 0614 3ADB 0D10 EC45 4358 B732 F4EC 52E7

Personal Lab

MU-LABS

Non-commercial / Hobby

A personal homelab environment used for research and experimentation. Not a product or company — just a dedicated space to test things properly. Currently running experiments with authentication systems, self-hosted infrastructure and various networking setups. Some of the work involves post-quantum cryptographic primitives and hardware-bound authentication flows, mostly out of curiosity.

Authentication

Experimenting with hardware-bound 2FA, FIDO2 and masked identity flows

Cryptography

Testing ML-KEM and other post-quantum primitives in practice

Infrastructure

BGP, anycast routing, self-hosted services, custom DNS setups

● ROCKY_PRIMARY

Rocky Linux Docker Nginx

● PROX_CLUSTER

Proxmox VE KVM / LXC

◎ ARCH_DEV

Arch Linux Research workstation

Legal

This domain is operated as a private homelab and personal research environment. Non-commercial, no affiliation with any company.

solve this challenge to access the disclosure data.