Shriyans Sudhi

Shriyans Sudhi - offensive security researcher. Published at ASE 2026, CVEs in ICS software, pentesting, bug bounties and open-source security tools.

I study what modern web apps leak once they are compiled and shipped, work published at ASE 2026. I've also found CVEs in industrial control software, and I still pentest, hunt bugs, and build open-source security tools.

I do offensive security research.

Divider

Offensive security research on the modern web and industrial control systems: papers, CVEs and advisories.

Research

Where I started, and still something I do: pentesting, bug bounties and collegiate competitions.

Hacking

I build the tools I wish existed, like JS Recon, and publish them for everyone to use and break.

Open Source

What I do

ASE 2026 · Research Papers

Automated semantic recovery of post-compilation abstraction leaks in web apps.

Decompiling the Web

ASE 2026

An LLM agent for logic-defined exposures in recovered JavaScript.

Secrets Without Signatures

CISA ICS Advisory

Vulnerabilities in an open-source PLC runtime, coordinated through CISA.

ICSA-25-345-10 · OpenPLC_V3

Critical · CVSS 9.3

I wrote a command injection into my own tool's CI, found it ten months later, and patched it.

CVE-2026-55378 · JS Recon

Selected research

A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.


JS Recon is a tool for JavaScript reconnaissance. It helps discover, download, and analyze JavaScript files from web apps to uncover endpoints, secrets, and other valuable findings. It can also reconstruct HTTP requests an app makes and export them to OpenAPI.

I started this project in June 2025 during my internship at [Black Hills Information Security](https://blackhillsinfosec.com).

- Repository: [github.com/shriyanss/js-recon](https://github.com/shriyanss/js-recon)
- Docs Site: https://js-recon.io

## Key features

- Download dynamically loaded JS (lazy-loaded bundles) from supported frameworks
- Extract URLs, strings, endpoints, and potential secrets from JS files
- Reconstruct HTTP requests and export to OpenAPI
- Analyze JS code and HTTP request behavior for potential issues
- Orchestrate end-to-end assessments with the `run` module
- Optional AWS API Gateway IP rotation to reduce rate-limit issues
- Generate consolidated reports from analysis results

## More info

Please visit the [JS Recon site](https://js-recon.io) for more information.


A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.

A deterministic hashing scheme for general-tree ASTs in SAST scanners, enabling reliable subtree fingerprinting and constant-time node lookup via Merkle-style signatures.


CS-MAST (Context-Stratified Merkelized Abstract Syntax Tree) is a novel data structure that integrates Merkle-style hashing into general-tree ASTs for use in Static Application Security Testing (SAST) scanners and JavaScript fingerprinting pipelines.

This work was published as a whitepaper while at Rochester Institute of Technology, and the implementation is used in [JS Recon](/projects/js-recon) for AST-level code pattern matching.

- Docs site: [cs-mast.ss0x00.com](https://cs-mast.ss0x00.com)

## Problem

Applying Merkle Tree hashing to ASTs in SAST scanners surfaces two structural problems:

- **Structural incompatibility**: Merkle Trees are defined over binary trees, but ASTs are general trees where nodes may have an arbitrary number of children.
- **Hash collisions**: Prior work (e.g. the Unbundle-Rewrite-Rebundle framework) encountered collisions between AST nodes that were structurally identical but semantically distinct — same tree structure, different source code.

## Solution

CS-MAST introduces **CS-MAST-S** (CS-MAST Signature), a deterministic, parameterized hashing scheme inspired by the PHC String Format. Each node's hash is cryptographically bound to its language, parser, and configurable element categories, eliminating collisions while remaining extensible to new code formats.

The signature encodes:

- Hashing algorithm (`hash`)
- Source language (`lang`) and version (`lver`)
- AST parser (`prsr`)
- Node inclusion settings (`sinc`, `scat`) — controls which node elements contribute to the hash

## Key features

- Extends general-tree ASTs with Merkle-style signatures at every node
- Deterministic: same code + same config always produces the same signature
- Constant-time subtree lookup via a hashmap keyed on CS-MAST-S signatures
- Configurable element categories (`lit`, `id`, `op`, `decl`, `loop`, `cond`, `name`, `val`, `op_name`) for tuning fingerprint granularity
- Cross-file support: independent per-file CS-MASTs can be combined into a single codebase-level signature
- Compatible with standard AST library functions (traversal, extraction) — only mutation operations are restricted

## How it works

CS-MAST traverses the AST in post-order (bottom-up), so child hashes are computed before parents. At each node, the CS-MAST-S hash is calculated from the node type, its semantic properties (name, value, operator), and the hashes of its children — weighted by the active `scat` configuration. The resulting signature string follows the format:

```
$hash=sha256,lang=js,lver=es6,prsr=-babel/parser$<hex-digest>
```

This enables reliable fingerprinting of AST subtrees and constant-time dictionary lookup in SAST pipelines such as JS Recon.

## More info

Please visit the [CS-MAST docs site](https://cs-mast.ss0x00.com) for full specification and usage details.


CS-MAST (Context-Stratified Merkelized Abstract Syntax Tree) is a novel data structure that integrates Merkle-style hashing into general-tree ASTs for use in SAST scanners and JavaScript fingerprinting.

CS-MAST

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery. It is a Python based tool, which takes the user inputs, and is capable of generating several 100 GBs of permutations. Please note that this tool is expected to run several hours and is expected to run on a VPS.

This project has its code hosted on [GitHub/@shriyanss/subdomain-permut](https://github.com/shriyanss/subdomain-permut). Additionally, it is also available on [PyPI/subdomain-permut](https://pypi.org/project/subdomain-permut/). To install this tool, you can use the following command

```
pip install subdomain-permut
```

To upgrade the tool in case a new version is available, use the following command

```
pip install --upgrade subdomain-permut
```


subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery.

Subdomain Permut - Subdomain Permutation tool

JS Recon

VHost Master is a virtual host fuzzer. It is written in Python and utilizes multiple threads to speed up the process. You can find it on GitHub at [GithHub/@shriyanss/vhost-master](http://github.com/shriyanss/vhost-master)


Virtual Host Fuzzer written in Python. A multi-threaded tool to speed up virtual host discovery.

"Subdomains Wordlist" is a repository containing a list of subdomain wordlists that can be used to bruteforce assets for a company. A full blog on how this is generated can be found at [My Website/Blog/SUBDOMAINS WORDLIST. HOW IT IS MADE?](https://ss0x00.com/blog/subdomains-wordlist-how-it-is-made/)

The repository can be found at [GitHub/@shriyanss/subdomains_wordlist](https://github.com/shriyanss/subdomains_wordlist)


A comprehensive wordlist of commonly found subdomains for asset discovery and brute-forcing.

Subdomains wordlist

Javascript payload for exploiting blind XSS. You can simply host `payload.js` file editing the specifications for an ultimate XSS

You can find the repository at [GitHub/@shriyanss/payload-pro](https://github.com/shriyanss/payload-pro)


JavaScript payload configuration for exploiting and managing blind XSS attacks.

Payload Pro

VHost Master

Subdomains wordlist generator helps you generate wordlists from the subdomains found from the subdomain enumeration. It uses a combination of Python and Shell scripts to achieve the task.

You can check this project at [GitHub/@shriyanss/subdomain_wordlist_gen](https://github.com/shriyanss/subdomain_wordlist_gen)


Generate custom subdomain wordlists from enumeration results using Python and Shell scripts.

Subdomains Wordlist Generator

Open-source projects

I've been working on a tool called JS Recon, which is a tool built to extract and analyze JavaScript from a website. After 2 months of development, I gave my first presentation at [RITSEC](https://ritsec.club/), which is the cybersecurity club at [Rochester Institute of Technology](https://rit.edu/).

This is more of a demo of the tool, and just slides about the tool.

While the tool has improved a lot since then, the fundamentals of the tool discussed in the presentation are still valid.

<YouTubeEmbed url="https://youtu.be/jQGeq4TNWDM" title="JS Recon Presentation" />


JS Recon Presentation

[Moltbook](http://moltbook.com) is a social media platform for [OpenClaw](https://openclaw.ai) bots, which are fully-autonomous AI agents. This opens doors for various attacks, most of which could be achieved through prompt injection attacks. In the presentation I gave at RITSEC, I tried to demonstrate the exploit chain for Prompt Injection to [Remote Code Execution](https://owasp.org/www-community/attacks/Code_Injection) through Moltbook.

<YouTubeEmbed url="https://youtu.be/3tXPbAVA_Fg?si=eALoGeukHLHIQBRg" title="Moltbook Research Presentation" />

This presentation was recorded at [ESL Global Cybersecurity Institute](https://www.rit.edu/cybersecurity/) at [Rochester Institute of Technology](https://www.rit.edu/) during [RITSEC](https://ritsec.com/)'s general meeting session.

Upon completion of this research, I plan to work with Moltbook's developers to improve the security of the platform.


Upon conducting a research, I found that it is possible to achieve Arbitrary Remote Code Execution on openclaw bots on Moltbook through indirect prompt injection attacks. This research was demonstrated in a presentation at RITSEC.

Asking AI agents to do (not so) malicious stuff - Presentation

This post was published on SecureMyOrg’s website. Please check it out [here](https://securemyorg.com/the-security-puzzle-of-graphql-1/)


GraphQL is getting widely adopted for APIs, but with features, it also brings home vulnerabilities.

The Security Puzzle of GraphQL – 1

Hi there 👋,
I hope you are doing well. On May 17th, 2024, I signed my first internship even before I graduated my high school. This was a way too thrilling experience for me.

So first of all, I’ll share the general story (non-technical) part of this, and then, I’ll move to technical things, like what I knew, my experience, and the kind of résumé thing I sent (it wasn’t a PDF file, but all things written in email)

## Thought of internship

I was doing bug bounties for a while, and I wanted to learn more skills, so what could’ve been better than taking an internship? So here started the journey of finding an internship, but before the rocket was even built, I had some doubts about myself.

The biggest question I had, was “Will someone give an internship to a high school guy?”. I saw a video of Ishan Sharma, in which he said: “They rejected me because of my childish voice”. (over telephonic call; for hiring him for marketing,,, as I remember). Yes, it was his first rejection, but fortunately (or maybe unfortunately) not for me. Even though he was rejected at that time, now (at the time of writing this blog), he has 1.3 Million+ subscribers on YouTube, and he also started a marketing company.

This thought was also fueled by another person, [Ankur Warikoo](https://www.youtube.com/@warikoo). I read his first book [_Do Epic Shit_](https://amzn.in/d/5zNtzbM) and in that, a quote was written: “If you never ask, the answer is always *No!*“. Another topic was there in that book, and it was related to cold emailing. It described the power of cold-emailing, and also from YouTube videos of other people as well, I learned that people landed at jobs with the help of this.

So, it was time to write the email

## Sending out emails

The first thing was, to whom will I reach out for an internship? A thought randomly came to my mind, that I had seen an internship opportunity a few months before, though, at that time, I had my exams, so I didn’t apply for it.

It was the time for writing an email, but what will I mention in it? The first thing that came to my mind was the bug bounty experience. This was the only real-life experience I had and for very obvious reasons. Apart from this, I have done some projects on my GitHub, so that’s a great idea to highlight in my email.

So, I quickly drafted an email, mentioning all my previous work in bug bounty, building hacking tools, blogs, etc. Now, it’s time to create a title. From all the videos and other resources I had consumed related to cold emails, I noticed that they all said that the email must have a catchy title. It was important to note that I wrote most of the things in points, and not in long paragraphs (just like this blog) because people generally don’t want to read a long boring, and too formal paragraph from a heap of emails. I made sure that it was easy for me to know maybe \~50% about me within the first few moments of opening the email. To make the person open the email, I needed a good email subject line. So, I started thinking about it, and instantly, got a title: “Can a high school guy get an internship” (maybe I am quick at thinking such things). Now my email draft was looking kinda good.

Also, to maintain professionalism, I decided not to shoot it with my email with the “@gmail.com” domain, but instead shoot it with my work email “<shriyanss@ss0x00.com>” (yes, you can contact me here) and also to look kinda *‘cool’*.

But I didn’t just shoot the email immediately, instead, scheduled it for Monday morning (I drafted the email on the weekend). The reason for this is very straightforward: most people don’t like to open their work email on weekends (maybe a bug bounty hunter dropped a critical 🤪), and they also to make sure, that when they open their email on Monday, my email will appear fairly on the top of their inbox (as most of the email providers show latest emails first).

I combined all these tricks with perfect timing, my email was sent out to the founder

Also, if you are thinking why I didn’t message him regarding this on LinkedIn or X, the reason is that, on those platforms, it is very easy for a message to get lost in messages from other people. Also, there’s nothing to distinguish (other than the user who sent the email) like the subject in the email. If I sent a message on that platform, he would see “Hi there, I hope you are doing well. I am ….” and it’s not at all interesting.


I got my first cybersecurity internship at a high-school, without a degree. Here is how!

How did I land my first cybersecurity internship while being a high-school student?

Hi there,

I hope you are well. In this article, I will describe how you can plot all the WiFi networks in your area on map. This article will contain the following:-

- Backstory

- Hardware requirements

- Installing the app on your mobile phone

- The code

You can read about what wardriving is on [Wikipedia](http://bit.ly/3GXwJAt)

So, let’s get started

## Backstory

I was very fascinated when I heard about hacking WiFi, in fact, I started hacking to get free WiFi 😅, but then after I jumped into it, I started web hacking. So, keeping my wish for WiFi hacking, I somehow wrote a script for NodeMCU (it is a micro-controller with an onboard WiFi chip, which costs about ₹400 — approx $5. Read on Wikipedia here). It just collected the names of WiFi and not the GPS data. You can access the script I used for this at my GitHub page at [https://github.com/shriyanss/NodeMCU_WiFi_Logger](http://bit.ly/3wny6DO)

![](/images/blog/gh_repo_wardrive.webp)

Getting on the main point, in this attempt, I collected WiFi information which contains the following things:-

- SSID

- ESSID

- Channel

- Quality

- Signal level

- Encryption info

It also contains a timestamp, but it is not a part of WiFi.

The same thing can also be done with the help of just a mobile phone, but in this case, I wanted raw data, that is according to me, so I continued with this method

## Hardware required

I used the following things for this wardrive:-

- A Raspberry Pi to collect WiFi information

- A mobile phone to collect GPS data

- A power bank for power supply

Installing application on your mobile phone

For tracking GPS, we also need an app installed on our phone, which will output the results to a file.

In my case, I am using an app named *GPS Logger*. This is a quite simple app and is according to our needs. You can download the app from Google Play [here](https://bit.ly/3WwIy6C)

If you are an iOS user, you can use an equivalent app for this task.

After you are done installing, just follow the steps below:-

- Open the app

- Go to the settings of the app (from three dots on the top right corner)

- Switch on the following: \*Keep screen on \*in interface, *Export Tracks in TXT*and \*Export Tracks in GPX \*in the exportation menu.

- Also, make sure that you export the timestamp in the same timezone, else you may use GMT

- Set *GPS Update interval* in tracking to *1 second*

<iframe title="Configuring GPS logger for wardrive" width="960" height="540" src="https://www.youtube.com/embed/00bpU2jNhXo?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

## The algorithm

Before diving into the code, let’s discuss the algorithm of the software.

### Mobile Phone

Our mobile phones have an inbuilt GPS sensor. To get the data from that GPS sensor, we are using an app from the Google Play store/App Store. The data we will export will be in CSV format, which means it is easy to read and process

### Raspberry Pi

This will run the script, which will contain the WiFi information described above, as well as a timestamp

### Synchronizing the data

In the output from both devices, we have the timestamp as common. So, we can use timestamps to get the GPS coordinated at a particular time.

## The Code — #1

First, let’s go wardriving and collect some data. The first script we will need is to collect WiFi networks in CSV format. Also we need the timestamp as described above. So, the code is:-

> Check out the script at https://gist.github.com/shriyanss/914cbcd27428c668be03406b38c76de0

Make it executable using `chmod +x scan.sh`. Now, we need another script that will keep running it. For this I can a simple python script:-

```
from os import system
while True:
    system("./scan.sh")
```

So the command we need to run is: `sudo python3 main.py > wifi.csv`

This will pipe the output, i.e. CSV to a file called `wifi.csv` .

No, the only task is to go out, and collect data. Just switch on the GPS Logger app and an SSH app and keep in the split screen view.

## Points to remember

- Switch on the *GPS Logger* app first, and then SSH scanning so that we won’t get an entry for which we don’t have GPS coordinates. The same goes for switching off.

- Keep the speed slow (\~20 km/hr) when there is more possibility of getting WiFi, or you may do it according to the length of the wardrive route

- Try to stay near buildings, e.g. on the left/right side of the road where there are buildings.

- Prefer a bicycle/motorbike with a backpack to keep accessories.

## Getting GPS data from the phone

To export data from the app, just go to \*GPS Logger app -> Tracklist -> Click on the route (e.g. the on top *😅*) -> Click on the ‘up arrow’ \*and the file will be exported to the specified location

Now, copy the `.txt`, `.gpx` file to your computer, and edit the file extension for `.txt` file to `.csv`

## Plot the route on the map

Now, you can use any map to view your route. But in my case, I used [_Google My Maps_](http://bit.ly/3XHF5n4). Just click on *“CREATE A NEW MAP”*, and you will see a screen like this:-

![](/images/blog/wardrive_maps.webp)

Just click on *“Import”* under *“Untitled layer”*, and upload the `.gpx` file you got from the GPS logger app. It will plot the route on the map.

## The Code — #2

Now, we need a code to plot all WiFi APs on the map. For this, you can use the following script:-

> Check out the script at https://gist.github.com/shriyanss/1c0007c1822bec471e1d1c5c771f9bc9

Before you run the script, make sure to use the right files on lines 4 and 5.

Now, just run the script, and it will give the `kml` file to be plotted on Google My Maps

**IMPORTANT: Don’t forget edit the file names in line 4 and 5, otherwise the script will end up with an error**

Just run the following command to write data to a file:

```
python3 data_sorter.py > wifi-ap.kml
```

Now, go to Google my maps, click on *“New Layer”*, and it will plot all WiFi AP on the map

**_Please note that it is being sorted on the basis of AP name. To sort on the basis of SSID, please refer lines 143 to 146_**

![](/images/blog/wardrive_map_plotted.webp)

In the above image, you can see all WiFi APs plotted on the map. Please note that I’ve changed the view to \*“Dark landmass” \*through the base map and redacted all WiFi AP names for privacy.

## Final notes

This is a demonstration of how one can do wardrive with given equipment. In the next article, we will discuss how we can \*\*crack these WiFi networks, without the help of a WiFi adapter that supports monitor mode. \*\*Also, there are more chances of errors if the device is not configured properly. Feel free to drop your query in the responses.

I hope that you liked this article 😄. Feel free to follow me for more. Also, **if you want the next part, feel free to subscribe to my mailings list**.


I did wardrive, without a proper wardrive gear, but with a raspberry pi, and my centuries old mobile phone.

Research

Hacking

Open Source

Decompiling the Web

Secrets Without Signatures

ICSA-25-345-10 · OpenPLC_V3

CVE-2026-55378 · JS Recon

JS Recon

CS-MAST

VHost Master

Subdomains wordlist

JS Recon Presentation

Asking AI agents to do (not so) malicious stuff - Presentation

The Security Puzzle of GraphQL – 1

How did I land my first cybersecurity internship while being a high-school student?

Wardrive without a GPS module and WiFi adapter that supports monitor mode, but a Raspberry Pi

Want to collaborate on research, or need something tested?

Home

Research

Hacking

Open Source

Decompiling the Web

Secrets Without Signatures

ICSA-25-345-10 · OpenPLC_V3

CVE-2026-55378 · JS Recon

JS Recon

CS-MAST

VHost Master

Subdomains wordlist

JS Recon Presentation

Asking AI agents to do (not so) malicious stuff - Presentation

The Security Puzzle of GraphQL – 1

How did I land my first cybersecurity internship while being a high-school student?

Wardrive without a GPS module and WiFi adapter that supports monitor mode, but a Raspberry Pi

Want to collaborate on research, or need something tested?