Skip to content
Omkar Pandhare

Bug bounty hunter finding IDOR, Broken Access Control, and Information Disclosure vulnerabilities.

I have 1.5+ years of hands-on experience in vulnerability research, penetration testing, and responsible disclosure, with findings recognized by NASA, U.S. DHS, Nokia, Fiserv, and Red Bull.

View ExperienceView Projects

Overview

I research and disclose vulnerabilities in web applications, focused on IDOR, Broken Access Control, and Information Disclosure. Day to day, I run reconnaissance and testing with Burp Suite, Nmap, ZAP, and ffuf, and build Bash and Python tooling to scale that work across bug bounty programs.

Domains

  • Bug Bounty
  • Penetration Testing
  • Vulnerability Research

Experience

Vulnerability research and penetration testing work, from independent bug bounty hunting through a hands-on security internship.

  1. 2024 - Present

    Remote

    Bug Bounty Hunter & Security Researcher

    HackerOne, Bugcrowd & Intigriti

    Independent security research and responsible disclosure across major bug bounty platforms.

    • Hunt vulnerabilities across HackerOne, Bugcrowd, and Intigriti, focused on IDOR, Broken Access Control, and Information Disclosure.
    • Submitted and disclosed findings across multiple programs, including NASA's Vulnerability Disclosure Program (VDP).
    • Recognized for responsible research by NASA, U.S. DHS, Nokia, Fiserv, and Red Bull.
    • Burp Suite
    • Nmap
    • ZAP
    • ffuf
    • OWASP Top 10

  2. Dec 2024 - Jan 2025

    Remote, India

    Cybersecurity Internship Trainee

    The Red Users

    Penetration testing and vulnerability assessment work on web applications and network infrastructure.

    • Performed penetration testing and vulnerability assessments using Nmap and OpenVAS.
    • Identified SQL Injection and XSS issues through web application security analysis; analyzed traffic with Wireshark.
    • Assisted firewall configuration and produced security reports with risk-mitigation recommendations.
    • Nmap
    • OpenVAS
    • Wireshark

Projects

Tooling built to scale reconnaissance and vulnerability detection across bug bounty programs.

  • Bug Bounty

    Recon Automation Pipeline

    A Bash subdomain enumeration pipeline organized per bug bounty program, with automated Discord reporting.

    Challenge

    Tracking subdomain scope and new assets across many concurrent bug bounty programs by hand didn't scale.

    Approach

    Built a Bash pipeline chaining cero, dnsx, subfinder, puredns, and crt.sh, organized per program, with results pushed automatically to Discord.

    Outcome

    Faster, repeatable recon coverage per program with new findings surfaced automatically instead of manual re-checking.

    • Bash
    • subfinder
    • dnsx
    • puredns
    • crt.sh

  • Vulnerability Research

    JS-Analyzer

    A reconnaissance tool that collects URLs and JavaScript from live subdomains and surfaces high-confidence exposures.

    Challenge

    Manually reviewing JavaScript bundles across large attack surfaces for exposed secrets and endpoints was slow and inconsistent.

    Approach

    Built a Python tool that crawls live subdomains for URLs and JS files, then runs them through a 10-stage analysis pipeline to flag likely exposures.

    Outcome

    Surfaced high-confidence exposures faster, cutting down manual triage time during recon.

    • Python

Stack

Tools and platforms I use for bug bounty hunting, penetration testing, and reconnaissance tooling.

  • Bug Bounty Focus

    • IDOR
    • Broken Access Control
    • Information Disclosure
    • OWASP Top 10
    • Security Misconfiguration

  • Tools

    • Burp Suite
    • Nmap
    • ZAP
    • ffuf
    • Wireshark
    • OpenVAS

  • Systems & Programming

    • Windows
    • Kali Linux
    • Ubuntu
    • Bash
    • Git
    • GitHub

Contact

Open to bug bounty collaborations, security research opportunities, and conversations about responsible disclosure.