Shriyans Sudhi

Portfolio of Shriyanss - Pentester, Bug Bounty Hunter, and Security Researcher. Discover my security tools, projects, and blog posts.

While messing around with code, I created this site to display my work

I'm a pentester, bug bounty hunter, and like to mess with some code in my free time

Divider

Feels good when I break something

Hacker

I also like writing code that would break stuff

Programmer (Security Tools)

And I like to document the above two

Blogger

Value propositions

I've been working on a tool called JS Recon, which is a tool built to extract and analyze JavaScript from a website. After 2 months of development, I gave my first presentation at [RITSEC](https://ritsec.club/), which is the cybersecurity club at [Rochester Institute of Technology](https://rit.edu/).

This is more of a demo of the tool, and just slides about the tool.

While the tool has improved a lot since then, the fundamentals of the tool discussed in the presentation are still valid.

<YouTubeEmbed url="https://youtu.be/jQGeq4TNWDM" title="JS Recon Presentation" />


JS Recon Presentation

This post was published on SecureMyOrg’s website. Please check it out [here](https://securemyorg.com/the-security-puzzle-of-graphql-1/)


The Security Puzzle of GraphQL – 1

Hi there 👋,
I hope you are doing well. On May 17th, 2024, I signed my first internship even before I graduated my high school. This was a way too thrilling experience for me.

So first of all, I’ll share the general story (non-technical) part of this, and then, I’ll move to technical things, like what I knew, my experience, and the kind of résumé thing I sent (it wasn’t a PDF file, but all things written in email)

## Thought of internship

I was doing bug bounties for a while, and I wanted to learn more skills, so what could’ve been better than taking an internship? So here started the journey of finding an internship, but before the rocket was even built, I had some doubts about myself.

The biggest question I had, was “Will someone give an internship to a high school guy?”. I saw a video of Ishan Sharma, in which he said: “They rejected me because of my childish voice”. (over telephonic call; for hiring him for marketing,,, as I remember). Yes, it was his first rejection, but fortunately (or maybe unfortunately) not for me. Even though he was rejected at that time, now (at the time of writing this blog), he has 1.3 Million+ subscribers on YouTube, and he also started a marketing company.

This thought was also fueled by another person, [Ankur Warikoo](https://www.youtube.com/@warikoo). I read his first book [*Do Epic Shit*](https://amzn.in/d/5zNtzbM) and in that, a quote was written: “If you never ask, the answer is always *No!*“. Another topic was there in that book, and it was related to cold emailing. It described the power of cold-emailing, and also from YouTube videos of other people as well, I learned that people landed at jobs with the help of this.

So, it was time to write the email

## Sending out emails

The first thing was, to whom will I reach out for an internship? A thought randomly came to my mind, that I had seen an internship opportunity a few months before, though, at that time, I had my exams, so I didn’t apply for it.

It was the time for writing an email, but what will I mention in it? The first thing that came to my mind was the bug bounty experience. This was the only real-life experience I had and for very obvious reasons. Apart from this, I have done some projects on my GitHub, so that’s a great idea to highlight in my email.

So, I quickly drafted an email, mentioning all my previous work in bug bounty, building hacking tools, blogs, etc. Now, it’s time to create a title. From all the videos and other resources I had consumed related to cold emails, I noticed that they all said that the email must have a catchy title. It was important to note that I wrote most of the things in points, and not in long paragraphs (just like this blog) because people generally don’t want to read a long boring, and too formal paragraph from a heap of emails. I made sure that it was easy for me to know maybe \~50% about me within the first few moments of opening the email. To make the person open the email, I needed a good email subject line. So, I started thinking about it, and instantly, got a title: “Can a high school guy get an internship” (maybe I am quick at thinking such things). Now my email draft was looking kinda good.

Also, to maintain professionalism, I decided not to shoot it with my email with the “@gmail.com” domain, but instead shoot it with my work email “<shriyanss@ss0x00.com>” (yes, you can contact me here) and also to look kinda *‘cool’*.

But I didn’t just shoot the email immediately, instead, scheduled it for Monday morning (I drafted the email on the weekend). The reason for this is very straightforward: most people don’t like to open their work email on weekends (maybe a bug bounty hunter dropped a critical 🤪), and they also to make sure, that when they open their email on Monday, my email will appear fairly on the top of their inbox (as most of the email providers show latest emails first).

I combined all these tricks with perfect timing, my email was sent out to the founder

Also, if you are thinking why I didn’t message him regarding this on LinkedIn or X, the reason is that, on those platforms, it is very easy for a message to get lost in messages from other people. Also, there’s nothing to distinguish (other than the user who sent the email) like the subject in the email. If I sent a message on that platform, he would see “Hi there, I hope you are doing well. I am ….” and it’s not at all interesting.


How did I land my first cybersecurity internship while being a high-school student?

Hi there,

I hope you are well. In this article, I will describe how you can plot all the WiFi networks in your area on map. This article will contain the following:-

*   Backstory

*   Hardware requirements

*   Installing the app on your mobile phone

*   The code

You can read about what wardriving is on [Wikipedia](http://bit.ly/3GXwJAt)

So, let’s get started

## Backstory

I was very fascinated when I heard about hacking WiFi, in fact, I started hacking to get free WiFi 😅, but then after I jumped into it, I started web hacking. So, keeping my wish for WiFi hacking, I somehow wrote a script for NodeMCU (it is a micro-controller with an onboard WiFi chip, which costs about ₹400 — approx $5. Read on Wikipedia here). It just collected the names of WiFi and not the GPS data. You can access the script I used for this at my GitHub page at [https://github.com/shriyanss/NodeMCU\_WiFi\_Logger](http://bit.ly/3wny6DO)

![](/images/blog/gh_repo_wardrive.webp)

Getting on the main point, in this attempt, I collected WiFi information which contains the following things:-

*   SSID

*   ESSID

*   Channel

*   Quality

*   Signal level

*   Encryption info

It also contains a timestamp, but it is not a part of WiFi.

The same thing can also be done with the help of just a mobile phone, but in this case, I wanted raw data, that is according to me, so I continued with this method

## Hardware required

I used the following things for this wardrive:-

*   A Raspberry Pi to collect WiFi information

*   A mobile phone to collect GPS data

*   A power bank for power supply

Installing application on your mobile phone

For tracking GPS, we also need an app installed on our phone, which will output the results to a file.

In my case, I am using an app named *GPS Logger*. This is a quite simple app and is according to our needs. You can download the app from Google Play [here](https://bit.ly/3WwIy6C)

If you are an iOS user, you can use an equivalent app for this task.

After you are done installing, just follow the steps below:-

*   Open the app

*   Go to the settings of the app (from three dots on the top right corner)

*   Switch on the following: \*Keep screen on \*in interface, *Export Tracks in TXT*and \*Export Tracks in GPX \*in the exportation menu.

*   Also, make sure that you export the timestamp in the same timezone, else you may use GMT

*   Set *GPS Update interval* in tracking to *1 second*

<iframe title="Configuring GPS logger for wardrive" width="960" height="540" src="https://www.youtube.com/embed/00bpU2jNhXo?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

## The algorithm

Before diving into the code, let’s discuss the algorithm of the software.

### Mobile Phone

Our mobile phones have an inbuilt GPS sensor. To get the data from that GPS sensor, we are using an app from the Google Play store/App Store. The data we will export will be in CSV format, which means it is easy to read and process

### Raspberry Pi

This will run the script, which will contain the WiFi information described above, as well as a timestamp

### Synchronizing the data

In the output from both devices, we have the timestamp as common. So, we can use timestamps to get the GPS coordinated at a particular time.

## The Code — #1

First, let’s go wardriving and collect some data. The first script we will need is to collect WiFi networks in CSV format. Also we need the timestamp as described above. So, the code is:-

> Check out the script at https://gist.github.com/shriyanss/914cbcd27428c668be03406b38c76de0

Make it executable using `chmod +x scan.sh`. Now, we need another script that will keep running it. For this I can a simple python script:-

```
from os import system
while True:
    system("./scan.sh")
```

So the command we need to run is: `sudo python3 main.py > wifi.csv`

This will pipe the output, i.e. CSV to a file called `wifi.csv` .

No, the only task is to go out, and collect data. Just switch on the GPS Logger app and an SSH app and keep in the split screen view.

## Points to remember

*   Switch on the *GPS Logger* app first, and then SSH scanning so that we won’t get an entry for which we don’t have GPS coordinates. The same goes for switching off.

*   Keep the speed slow (\~20 km/hr) when there is more possibility of getting WiFi, or you may do it according to the length of the wardrive route

*   Try to stay near buildings, e.g. on the left/right side of the road where there are buildings.

*   Prefer a bicycle/motorbike with a backpack to keep accessories.

## Getting GPS data from the phone

To export data from the app, just go to \*GPS Logger app -> Tracklist -> Click on the route (e.g. the on top *😅*) -> Click on the ‘up arrow’ \*and the file will be exported to the specified location

Now, copy the `.txt`, `.gpx` file to your computer, and edit the file extension for `.txt` file to `.csv`

## Plot the route on the map

Now, you can use any map to view your route. But in my case, I used [*Google My Maps*](http://bit.ly/3XHF5n4). Just click on *“CREATE A NEW MAP”*, and you will see a screen like this:-

![](/images/blog/wardrive_maps.webp)

Just click on *“Import”* under *“Untitled layer”*, and upload the `.gpx` file you got from the GPS logger app. It will plot the route on the map.

## The Code — #2

Now, we need a code to plot all WiFi APs on the map. For this, you can use the following script:-


> Check out the script at https://gist.github.com/shriyanss/1c0007c1822bec471e1d1c5c771f9bc9

Before you run the script, make sure to use the right files on lines 4 and 5.

Now, just run the script, and it will give the `kml` file to be plotted on Google My Maps

**IMPORTANT: Don’t forget edit the file names in line 4 and 5, otherwise the script will end up with an error**

Just run the following command to write data to a file:

```
python3 data_sorter.py > wifi-ap.kml
```

Now, go to Google my maps, click on *“New Layer”*, and it will plot all WiFi AP on the map

***Please note that it is being sorted on the basis of AP name. To sort on the basis of SSID, please refer lines 143 to 146***

![](/images/blog/wardrive_map_plotted.webp)

In the above image, you can see all WiFi APs plotted on the map. Please note that I’ve changed the view to \*“Dark landmass” \*through the base map and redacted all WiFi AP names for privacy.

## Final notes

This is a demonstration of how one can do wardrive with given equipment. In the next article, we will discuss how we can \*\*crack these WiFi networks, without the help of a WiFi adapter that supports monitor mode. \*\*Also, there are more chances of errors if the device is not configured properly. Feel free to drop your query in the responses.

I hope that you liked this article 😄. Feel free to follow me for more. Also, **if you want the next part, feel free to subscribe to my mailings list**.


Wardrive without a GPS module and WiFi adapter that supports monitor mode, but a Raspberry Pi

Featured Posts

A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.


JS Recon is a tool for JavaScript reconnaissance. It helps discover, download, and analyze JavaScript files from web apps to uncover endpoints, secrets, and other valuable findings. It can also reconstruct HTTP requests an app makes and export them to OpenAPI.

I started this project in June 2025 during my internship at [Black Hills Information Security](https://blackhillsinfosec.com).

- Repository: [github.com/shriyanss/js-recon](https://github.com/shriyanss/js-recon)
- Docs Site: https://js-recon.io

## Key features

- Download dynamically loaded JS (lazy-loaded bundles) from supported frameworks
- Extract URLs, strings, endpoints, and potential secrets from JS files
- Reconstruct HTTP requests and export to OpenAPI
- Analyze JS code and HTTP request behavior for potential issues
- Orchestrate end-to-end assessments with the `run` module
- Optional AWS API Gateway IP rotation to reduce rate-limit issues
- Generate consolidated reports from analysis results

## More info

Please visit the [JS Recon site](https://js-recon.io) for more information.


A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery. It is a Python based tool, which takes the user inputs, and is capable of generating several 100 GBs of permutations. Please note that this tool is expected to run several hours and is expected to run on a VPS.

This project has its code hosted on [GitHub/@shriyanss/subdomain-permut](https://github.com/shriyanss/subdomain-permut). Additionally, it is also available on [PyPI/subdomain-permut](https://pypi.org/project/subdomain-permut/). To install this tool, you can use the following command

```
pip install subdomain-permut
```

To upgrade the tool in case a new version is available, use the following command

```
pip install --upgrade subdomain-permut
```


subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery.

Subdomain Permut - Subdomain Permutation tool

JS Recon

VHost Master is a virtual host fuzzer. It is written in Python and utilizes multiple threads to speed up the process. You can find it on GitHub at [GithHub/@shriyanss/vhost-master](http://github.com/shriyanss/vhost-master)


Virtual Host Fuzzer written in Python. A multi-threaded tool to speed up virtual host discovery.

"Subdomains Wordlist" is a repository containing a list of subdomain wordlists that can be used to bruteforce assets for a company. A full blog on how this is generated can be found at [My Website/Blog/SUBDOMAINS WORDLIST. HOW IT IS MADE?](https://ss0x00.com/blog/subdomains-wordlist-how-it-is-made/)

The repository can be found at [GitHub/@shriyanss/subdomains_wordlist](https://github.com/shriyanss/subdomains_wordlist)


A comprehensive wordlist of commonly found subdomains for asset discovery and brute-forcing.

Subdomains wordlist

Javascript payload for exploiting blind XSS. You can simply host `payload.js` file editing the specifications for an ultimate XSS

You can find the repository at [GitHub/@shriyanss/payload-pro](https://github.com/shriyanss/payload-pro)


JavaScript payload configuration for exploiting and managing blind XSS attacks.

Payload Pro

VHost Master

Subdomains wordlist generator helps you generate wordlists from the subdomains found from the subdomain enumeration. It uses a combination of Python and Shell scripts to achieve the task.

You can check this project at [GitHub/@shriyanss/subdomain_wordlist_gen](https://github.com/shriyanss/subdomain_wordlist_gen)


Generate custom subdomain wordlists from enumeration results using Python and Shell scripts.

Home