firstName

lastName

email

message

Let’s talk... 💬

Shriyans Sudhi

A deterministic hashing scheme for general-tree ASTs in SAST scanners, enabling reliable subtree fingerprinting and constant-time node lookup via Merkle-style signatures.


CS-MAST (Context-Stratified Merkelized Abstract Syntax Tree) is a novel data structure that integrates Merkle-style hashing into general-tree ASTs for use in Static Application Security Testing (SAST) scanners and JavaScript fingerprinting pipelines.

This work was published as a whitepaper while at Rochester Institute of Technology, and the implementation is used in [JS Recon](/projects/js-recon) for AST-level code pattern matching.

- Docs site: [cs-mast.ss0x00.com](https://cs-mast.ss0x00.com)

## Problem

Applying Merkle Tree hashing to ASTs in SAST scanners surfaces two structural problems:

- **Structural incompatibility**: Merkle Trees are defined over binary trees, but ASTs are general trees where nodes may have an arbitrary number of children.
- **Hash collisions**: Prior work (e.g. the Unbundle-Rewrite-Rebundle framework) encountered collisions between AST nodes that were structurally identical but semantically distinct — same tree structure, different source code.

## Solution

CS-MAST introduces **CS-MAST-S** (CS-MAST Signature), a deterministic, parameterized hashing scheme inspired by the PHC String Format. Each node's hash is cryptographically bound to its language, parser, and configurable element categories, eliminating collisions while remaining extensible to new code formats.

The signature encodes:

- Hashing algorithm (`hash`)
- Source language (`lang`) and version (`lver`)
- AST parser (`prsr`)
- Node inclusion settings (`sinc`, `scat`) — controls which node elements contribute to the hash

## Key features

- Extends general-tree ASTs with Merkle-style signatures at every node
- Deterministic: same code + same config always produces the same signature
- Constant-time subtree lookup via a hashmap keyed on CS-MAST-S signatures
- Configurable element categories (`lit`, `id`, `op`, `decl`, `loop`, `cond`, `name`, `val`, `op_name`) for tuning fingerprint granularity
- Cross-file support: independent per-file CS-MASTs can be combined into a single codebase-level signature
- Compatible with standard AST library functions (traversal, extraction) — only mutation operations are restricted

## How it works

CS-MAST traverses the AST in post-order (bottom-up), so child hashes are computed before parents. At each node, the CS-MAST-S hash is calculated from the node type, its semantic properties (name, value, operator), and the hashes of its children — weighted by the active `scat` configuration. The resulting signature string follows the format:

```
$hash=sha256,lang=js,lver=es6,prsr=-babel/parser$<hex-digest>
```

This enables reliable fingerprinting of AST subtrees and constant-time dictionary lookup in SAST pipelines such as JS Recon.

## More info

Please visit the [CS-MAST docs site](https://cs-mast.ss0x00.com) for full specification and usage details.


CS-MAST (Context-Stratified Merkelized Abstract Syntax Tree) is a novel data structure that integrates Merkle-style hashing into general-tree ASTs for use in SAST scanners and JavaScript fingerprinting.

CS-MAST

A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.


JS Recon is a tool for JavaScript reconnaissance. It helps discover, download, and analyze JavaScript files from web apps to uncover endpoints, secrets, and other valuable findings. It can also reconstruct HTTP requests an app makes and export them to OpenAPI.

I started this project in June 2025 during my internship at [Black Hills Information Security](https://blackhillsinfosec.com).

- Repository: [github.com/shriyanss/js-recon](https://github.com/shriyanss/js-recon)
- Docs Site: https://js-recon.io

## Key features

- Download dynamically loaded JS (lazy-loaded bundles) from supported frameworks
- Extract URLs, strings, endpoints, and potential secrets from JS files
- Reconstruct HTTP requests and export to OpenAPI
- Analyze JS code and HTTP request behavior for potential issues
- Orchestrate end-to-end assessments with the `run` module
- Optional AWS API Gateway IP rotation to reduce rate-limit issues
- Generate consolidated reports from analysis results

## More info

Please visit the [JS Recon site](https://js-recon.io) for more information.


A powerful tool for JavaScript reconnaissance - discover, download, and analyze JS to uncover endpoints, secrets, and reconstruct HTTP requests to OpenAPI.

JS Recon

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery

subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery. It is a Python based tool, which takes the user inputs, and is capable of generating several 100 GBs of permutations. Please note that this tool is expected to run several hours and is expected to run on a VPS.

This project has its code hosted on [GitHub/@shriyanss/subdomain-permut](https://github.com/shriyanss/subdomain-permut). Additionally, it is also available on [PyPI/subdomain-permut](https://pypi.org/project/subdomain-permut/). To install this tool, you can use the following command

```
pip install subdomain-permut
```

To upgrade the tool in case a new version is available, use the following command

```
pip install --upgrade subdomain-permut
```


subdomain-permut is a tool that simplifies the subdomain permutation process for DNS bruteforcing and target discovery.

Subdomain Permut - Subdomain Permutation tool

Subdomains wordlist generator helps you generate wordlists from the subdomains found from the subdomain enumeration. It uses a combination of Python and Shell scripts to achieve the task.

You can check this project at [GitHub/@shriyanss/subdomain_wordlist_gen](https://github.com/shriyanss/subdomain_wordlist_gen)


Generate custom subdomain wordlists from enumeration results using Python and Shell scripts.

Subdomains Wordlist Generator

"Subdomains Wordlist" is a repository containing a list of subdomain wordlists that can be used to bruteforce assets for a company. A full blog on how this is generated can be found at [My Website/Blog/SUBDOMAINS WORDLIST. HOW IT IS MADE?](https://ss0x00.com/blog/subdomains-wordlist-how-it-is-made/)

The repository can be found at [GitHub/@shriyanss/subdomains_wordlist](https://github.com/shriyanss/subdomains_wordlist)


A comprehensive wordlist of commonly found subdomains for asset discovery and brute-forcing.

Subdomains wordlist

VHost Master is a virtual host fuzzer. It is written in Python and utilizes multiple threads to speed up the process. You can find it on GitHub at [GithHub/@shriyanss/vhost-master](http://github.com/shriyanss/vhost-master)


Virtual Host Fuzzer written in Python. A multi-threaded tool to speed up virtual host discovery.

VHost Master

Javascript payload for exploiting blind XSS. You can simply host `payload.js` file editing the specifications for an ultimate XSS

You can find the repository at [GitHub/@shriyanss/payload-pro](https://github.com/shriyanss/payload-pro)


JavaScript payload configuration for exploiting and managing blind XSS attacks.

Payload Pro

Log Venom is a shell script to send some payloads in the target server's log. This includes XSS payloads. The repository can be found at [GitHub/@shriyanss/Log-Venom](https://github.com/shriyanss/Log-Venom)


Log Venom is a shell script to send payloads like XSS to a target server's log.

Log Venom

Explore open-source security tools and projects developed by Shriyanss for penetration testing and bug bounty hunting.

Projects