Self-taught Application Security Researcher — Sri Lanka
Hunting on HackerOne VDP programs. No degree, no bootcamp — PortSwigger labs, disclosed reports, and reps.
I started teaching myself web application security at 17. No formal training, no bootcamp — just PortSwigger labs at dawn, disclosed reports read line by line, and the slow, unglamorous work of learning to think like the application instead of just clicking around it.
The plan is narrow on purpose: three vulnerability classes, studied deep instead of four studied shallow. Everything I ship publicly — lab writeups, disclosed-report breakdowns, live findings — gets logged as it happens, not cleaned up after the fact.
I'm early — every senior researcher was early once. What I can promise is that the reps are real, methodology gets updated monthly, and there's a hard rule against staying in "preparation mode" forever. This is the long game.
|
Horizontal & vertical privilege escalation. Accessing other users' data by manipulating IDs and parameters. |
Password reset bugs, session fixation, MFA bypass, and token predictability. |
Workflow abuse, price manipulation, and trust boundary violations that scanners can't find. |
| 38 | 20+ | 3 | Active |
|---|---|---|---|
| Hacker101 CTF points | Disclosed reports analyzed | Focus classes locked | HackerOne VDP hunting |
Languages
Tools I'm using for testing & recon
Infra
| Repo | Description | Stack |
|---|---|---|
| Bug-bounty-writeups | Structured practice — mostly PortSwigger lab writeups across the three focus classes | Markdown |
| Bug-bounty-reports | Real track record — live HackerOne VDP findings, disclosed report analysis, lessons from rejections | Markdown |
| Research-notes | Distilled knowledge — cheat sheets, concepts, and techniques organized by vulnerability class | Markdown |
| CTF | Capture The Flag challenges across several platforms, mostly Hacker101 | Markdown |
| python-programming | Python tooling for security automation and bug bounty workflows | Python |
| web-fundamentals | Core web fundamentals for security researchers and developers | Markdown |
| MalikHettige.github.io | Source for the live portfolio site | HTML |
| desync-saml-orm-ssti-chain | Multi-stage security research — HTTP Desync → Golden SAML → ORM → Blind SSTI | Security Research |
Working through every lab across the three focus classes above, and hunting as many HackerOne VDP programs as time allows. No live paid submission yet — that's the next milestone, not a claim made early. Plan is to start Bug bounty programs Jan-14 onwards.