Offensive security researcher. I recover the logic hidden in compiled web apps, find critical bugs in industrial control software, and build open-source tools like JS Recon.
Peer-reviewed papers at ASE 2026 in Munich, plus CVEs and a CISA advisory from vulnerability research.
Published research papers on offensive security topics
Research paper accepted at ASE 2026 (Research Papers track) on automated semantic recovery of post-compilation abstraction leaks in the web - Shriyans Sudhi
Research paper accepted at ASE 2026 (Research Papers track) on an LLM agent for logic-defined exposures in recovered JavaScript - Shriyans Sudhi
Common Vulnerabilities and Exposures discovered through security research
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API - Discovered by Shriyans Sudhi
OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. - Discovered by Shriyans Sudhi
Security advisories and contributions to government cybersecurity efforts
JS Recon is the flagship: discover and analyze JavaScript to map endpoints, secrets and requests.
A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.
A deterministic hashing scheme for general-tree ASTs in SAST scanners, enabling reliable subtree fingerprinting and constant-time node lookup via Merkle-style signatures.
Virtual Host Fuzzer written in Python
A list of commonly found subdomains
Pentest Tool Development Intern · 2025, 2026
Two summers building pentest tooling. The first became JS Recon.
2nd in Great Lakes · Global finalist
Collegiate Penetration Testing Competition. Also 9th of 93 teams at DoE CyberForce.
Bug bounty · 1000+ reputation
Valid findings for Booking.com, Expedia Group and the US DoD.
RITSEC presentations and notes from the field.
DoE Cyberforce is a competition organized by the US Department of Energy to defend a simulated industrial environment.
Moltbook can be a vector for prompt injection attacks. In this presentation, I tried to prove my hypothesis with findings I had from past week's data collection.
After 2 months of development, I gave my first presentation at RITSEC, which is the cybersecurity club at Rochester Institute of Technology.
GraphQL is getting widely adopted for APIs, but with features, it also brings home vulnerabilities.
Research collaborations, pentests, or questions about my work. Email is fastest: shriyanss@ss0x00.com. I'm also on LinkedIn, X and HackerOne.
