Welcome to ScorpionYug — my new home on the internet. This is where I’ll be sharing my journey in cybersecurity, bug bounty hunting, and ethical hacking.

What you’ll find here

🔍 Bug bounty writeups

Detailed case studies of vulnerabilities I’ve found — how I found them, what worked, and lessons learned. Every writeup follows responsible disclosure principles.

🛠️ Security tutorials

Step-by-step guides on:

• Recon methodology
• Exploitation techniques
• Tool usage
• Defense strategies

💭 Thoughts & reflections

My take on industry news, security research, and the broader cybersecurity community.

📚 Resources

Curated lists of tools, books, courses, and platforms I recommend.

Why this blog?

The cybersecurity community is incredibly generous with knowledge. I’m here to pay it forward — share what I learn, help beginners, and document my journey publicly.

“The best way to learn is to teach.”

What’s next?

Expect regular content starting this month. Topics I’m working on:

1. A multi-part bug bounty series on a recent finding
2. Tool reviews — Burp Suite extensions, recon tools
3. Recon methodology — my full pipeline
4. Interview prep — for cybersecurity roles

If you want to follow along:

• 📧 Subscribe via RSS
• 🐦 Follow on Twitter
• 💼 HackerOne profile

Got a topic you want me to cover? Drop me a line.

Until next time — stay curious, stay ethical 🛡️

— ScorpionYug

Here’s the complete pipeline I use for every target.

Phase 1: Subdomain enumeration

Goal: Find ALL attack surface.

# Passive (no direct contact with target)
subfinder -d target.com -o subfinder.txt
assetfinder --subs-only target.com > assetfinder.txt
amass enum -passive -d target.com -o amass.txt

# Active (sends DNS queries)
amass enum -active -d target.com

# Certificate transparency
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value'

# Merge & dedupe
cat *.txt | sort -u > all_subs.txt

Tools: subfinder, amass, assetfinder, crt.sh

Phase 2: Live host probing

# Check which subdomains are alive
cat all_subs.txt | httpx -tech-detect -status-code -title \
  -o live_hosts.txt

# Extract just URLs
cat live_hosts.txt | awk '{print $1}' > live_urls.txt

Phase 3: URL enumeration

Wayback Machine, Common Crawl, and crawling:

# Historical URLs
cat live_urls.txt | waybackurls > wayback.txt
cat live_urls.txt | gau > gau.txt

# Crawl current site
katana -list live_urls.txt -depth 3 -o crawled.txt

# Merge
cat wayback.txt gau.txt crawled.txt | sort -u > all_urls.txt

Phase 4: Hidden parameters

# Arjun — parameter discovery
arjun -u https://target.com -o params.json

# Manual testing
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/params.txt \
  -mc 200,301,302 -X POST -d "FUZZ=test"

Phase 5: Vulnerability scanning

# Nuclei — template-based
nuclei -l live_urls.txt -t cves/ -severity critical,high -o vulns.txt
nuclei -l live_urls.txt -t vulnerabilities/ -o vuln2.txt
nuclei -l live_urls.txt -t misconfiguration/ -o misconfig.txt
nuclei -l live_urls.txt -t exposures/ -o exposures.txt

# SQLi — manual + sqlmap
sqlmap -u "https://target.com/page?id=1" --batch --dbs

# XSS — dalfox
cat all_urls.txt | grep "=" | dalfox pipe

Phase 6: Reporting

After finding something, document EVERYTHING:

1. Steps to reproduce (clear, copy-pasteable)
2. Impact (what can attacker do?)
3. Remediation (how to fix?)
4. Screenshots / video (proof)
5. CVSS score (severity rating)

My time distribution

Tools cheatsheet

Pro tips

1. Save everything — screenshots, commands, output
2. Automate repetitive tasks — write a script
3. Try variations — parameter, path, header-based
4. Look for logic flaws — not just known patterns
5. Read source code — JS files leak API endpoints

Happy hunting! 🎯 Found something cool? Tag me on Twitter — I love seeing creative finds.

— ScorpionYug

1. Logger++

What: Better logging than Burp’s built-in Why: Filter, search, and tag requests/responses Must-have: Find that one specific request you made 30 minutes ago

Install: BApp Store → Logger++

2. Autorize

What: Automatic authorization testing Why: Test if endpoints properly check user permissions

Use it for IDOR hunting on every authenticated session.

3. Logger++ Enhanced

What: Granular control over logging Why: Only log what you need (saves disk)

4. Param Miner

What: Discover hidden parameters Why: Finds parameters that don’t show in normal crawling

Configure: Min requests = 100, max params = 1000

5. JWT Editor

What: Decode, edit, attack JWT tokens Why: Test JWT implementations for:

• alg=none bypass
• Weak secrets
• Token confusion

6. Hackvertor

What: Smart encoding/decoding Why: Auto-detect encoding for XSS payloads

7. Turbo Intruder

What: Fast custom attacks Why: Race conditions, brute force, custom fuzzing

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False)
    for i in range(5):
        engine.queue(target.req, i)
        engine.openGate(i)

8. Collaborator Everywhere

What: Out-of-band detection Why: Find blind XSS, SSRF, XXE that callback to your server

9. InQL Scanner

What: GraphQL testing Why: Modern apps use GraphQL — find introspection, batching attacks

10. DOM Invader

What: DOM XSS testing Why: Built into Burp, catches DOM-based vulns others miss

Bonus: Auto-highlight

What: Color-code interesting stuff Why: Spot API keys, tokens, error messages instantly

My Burp workflow

1. Set scope to target.*
2. Browse the app normally (Burp logs)
3. Run Logger++ analysis
4. Autorize for IDORs
5. Param Miner for hidden params
6. Turbo Intruder for rate-limited testing
7. Hackvertor + DOM Invader for XSS
8. JWT Editor for token attacks

Setup time: ~10 minutes for fresh engagements.

Where to find extensions

• BApp Store (built-in) — most reliable
• GitHub — some community gems
• Burp App Store (new) — better discovery

What’s your favorite extension? Let me know on Twitter — always looking for new tools to add to my arsenal.

— ScorpionYug