GET /smit HTTP/1.1
Host: fabrikat0r.dev
User-Agent: recruiter/1.0 HTTP/1.1 200 OK
Host: fabrikat0r.dev
User-Agent: recruiter/1.0 HTTP/1.1 200 OK
X-Name:Smit Gharat
X-Alias:fabrikat0r
X-Role:Security Researcher, Independent Bug Bounty Hunter
X-Background:Computer Science Engineer
X-Focus:IDOR · Auth Bypass · SSRF · Recon Automation
X-Status:Hunting
I break authentication and authorization logic for a living, then write it up so someone else can fix it. Independent researcher across Intigriti, Bugcrowd and HackerOne — currently building AI-assisted recon tooling on top of manual triage, not instead of it.
// 01 about
who's asking
I hunt vulnerabilities across web apps and APIs — auth flows, access control, request smuggling, and the messy business-logic edges automated scanners miss. Most of my work is manual triage backed by custom tooling I build myself, from recon pipelines to JS bundle analyzers.
Certification
Certified Ethical Hacker (CEH)
Education
B.E. Computer Science
Specialties
IDOR, XSS, SSRF, auth bypass, subdomain takeover, business logic abuse
Currently
Triager at XXXXXXXXX & Building agent-driven recon pipelines & Client-side stuff (Playwright MCP + Burp MCP)
// 02 platforms
where the reports live
// 03 findings
notable work
AUTH
Unauthenticated referral API exposing customer PII
Identified an authentication bypass in a third-party referral integration on a major e-commerce platform, allowing unauthenticated retrieval of customer PII and tokens.
OAUTH
PKCE downgrade on an authorization server
Found a plain-method PKCE downgrade path on a production auth server; scoped and reported despite a BFF architecture limiting direct exploitation.
STATE
Client-side state corruption & cross-account preference confusion
Discovered logic flaws where client-side state machines could be manipulated to leak or overwrite another account's stored preferences.
RECON
Large-scale subdomain takeover & postMessage triage
Built and ran a recon pipeline surfacing subdomain takeover candidates and origin-validation issues in postMessage handlers across a large attack surface.
// 04 writeups
from the notebook
Cloudflare Bypass — Origin Server Deserves Some Love Too
On why WAF coverage means nothing if the origin server behind it is still reachable directly — and how to find it.
// 05 tooling
things I've built
recon-pipeline
Agent-driven recon pipeline using Playwright MCP + Burp MCP, split into micro-skills
wp_vuln_scanner
Bash-based WordPress plugin/theme vulnerability scanner with FFUF enumeration & rate limiting
quick-api.js
JS endpoint extractor — 54+ patterns for minified/bundled JS
scrape-pipeline.js
Puppeteer + local LLM recon triage pipeline