HackerOne · nmsr

bash — nmsr@root: ~

nmsr@root:~$ whoami

Samidu Nimsara // nmsr

nmsr@root:~$ cat /etc/identity

Role: Application Security Researcher & Bug Bounty Hunter

Origin: Sri Lanka

Handle: hackerone.com/nmsr

Focus: API Security · IDOR · Broken Access Control · Web Pentesting

nmsr@root:~$ █

cd ~/about cd ~/blog

nmsr@root:~$ cat about/README.md

  .-------.
 /  .-.   \
|  |   |   |
 \  `-'  /
  `-----'
  / nmsr  \
 ( hunter  )
  \_______/

Hunting bugs actively

H1 · nmsr GitHub

Samidu Nimsara

// @nmsr on HackerOne · @samidunimsara on GitHub

Application Security Researcher & Bug Bounty Hunter from Sri Lanka.

[+]

Broken Access Control

IDOR, privilege escalation, object-level auth bypass

[+]

API Security

REST/GraphQL endpoint testing, mass assignment, rate limiting

[+]

Web Application Pentesting

OWASP Top 10, authentication flaws, business logic

[+]

Reconnaissance

Subdomain enum, JS analysis, attack surface mapping

# Timeline

2024

Application Security Researcher — HackerOne

nmsr@root:~$ cat blog/posts.json | jq .

broken-access Jan 28, 2024

Exploiting Unprotected Functionality to Access User Profiles

How searching for legacy applications and leveraging URL history archives led to unauthorized access and modification of sensitive user profiles, earning a $500 bounty.

nmsr@root:~$ ./read.sh --post=1

auth-bypass Feb 2024

Bypassing authentication on a private HackerOne target

Analyzing JWT verification flaws and signature validation vulnerabilities to elevate privileges from guest to administrator.

nmsr@root:~$ ./read.sh --post=2

recon Nov 2023

The power of JS analysis in API security assessment

My workflow for harvesting hidden endpoints and API credentials from minified Webpack chunks using custom regex pipelines.

nmsr@root:~$ ./read.sh --post=3

nmsr@root:~$ ./contact.sh --interactive

hackerone @nmsr github @samidunimsara x / twitter @samidunimsara

// send me a secure message