Personal blog / Security research
Remmy9
Full-time bug bounty hunter · Web applications
I hunt vulnerabilities in web applications and write about what I learn along the way.
From my notebook
LatestWriteups
JavaScript Dissected: P3 - Parsers, Grammars and Differentials
How a value crosses URL, HTML, JavaScript, CSS and JSON grammars before it reaches a sink, and where those boundaries break. Covers the HTML tokenizer and tree builder, script-data escaping, ASI and code-concatenation hazards, script vs. module semantics, mutation XSS and sanitizer differentials, WHATWG URL parsing pitfalls, query-string disagreements, DOM XSS source-to-sink modeling, why WAF signatures fail, AST-plus-scope static analysis, and a parser-map hunting method with a bug bounty checklist. Third in the JavaScript Internals series.
100+ Hours of Agentic Bug Bounty Hunting with Non-Frontier Models
A practical field report on using MiMo V2.5 Pro and DeepSeek V4 Flash for agentic bug bounty hunting — what worked, what failed, and the real human cost of supervising an AI hunter.
JavaScript Dissected: P2 - Engine Fundamentals
Deep-dive into how V8, SpiderMonkey, and JavaScriptCore parse, compile, and optimize JavaScript. Covers bytecode disassembly, DFS tree traversal and the visitor pattern, sea-of-nodes IR, Smi tagging and pointer compression, inline cache data structures, hidden class transition trees, deoptimization frame reconstruction, and where every pipeline stage is exploitable. Second in the JavaScript Internals series.
JavaScript Dissected: P1 - Trees!
Learn how JavaScript engines turn source code into Abstract Syntax Trees, why ASTs are the foundation of security tooling like Semgrep and CodeQL, and how parser differentials enable WAF bypasses. First in the JavaScript Internals series.
Bypassing WAF, 403, and OTP to Exploit SQL Injection
Bypassing WAF, 403 Forbidden, and OTP restrictions to exploit a blind SQL injection on a VDP program.
My Therapist Said Tiny Problems Don’t Matter. These Vulnerability Chains Proved Me Wrong.
Chaining multiple low-severity IDORs, broken access control, and token exhaustion into a data exfiltration chain.
From alert(origin) to ATO, an XSS Story
How a simple XSS discovery escalated to full account takeover through response manipulation and creative payload crafting.
403 Forbidden? No Problem, Here’s a POST XSS
Bypassing 403 forbidden restrictions to deliver a POST-based XSS payload that led to a Bugcrowd bounty.
I'm Remmy9, a full-time bug bounty hunter focused on web applications. I break logic, chain small bugs into real impact, and report them before the bad actors find them.