FEKOJEWAN — Independent Bug Bounty Hunter & Security Researcher

RESEARCH STACK

Tools & Technical Workflow

Real-world security research relies on purposeful instrumentation. Here is a transparent breakdown of the primary tools utilized in FEKOJEWAN research and what each contributes to uncovering complex vulnerabilities.

HTTP Proxy & Traffic Analysis

Burp Suite Professional

Deep HTTP/S inspection, repeater-based parameter tampering, automated sequence analysis, and custom extension authoring (BApp/Java/Python).

PRACTICAL ROLE IN WORKFLOW:Intercepts traffic between browser/API clients and backend microservices, allowing micro-second request repeats, header alterations, and session diffing.

API Client & Schema Exploration

Postman & Bruno

REST, GraphQL, and WebSocket request orchestration with environment variable chaining and automated token rotation.

PRACTICAL ROLE IN WORKFLOW:Used to model multi-stage user journeys, simulate concurrent client actions, and test nested GraphQL sub-queries.

DOM & Client-Side Execution

Browser Developer Tools

Analyzing single-page app (SPA) JavaScript bundles, IndexedDB session storage, Web Workers, and Content Security Policy (CSP) evaluations.

PRACTICAL ROLE IN WORKFLOW:Setting client-side breakpoints on state management mutations to reveal hidden administrative endpoints, unpublished API paths, and deserialization routines.

Custom Automation & Fuzzing

Python (AsyncIO / Requests / Scapy)

Authoring custom, deterministic proof-of-concept scripts, concurrency race condition demonstrators, and specialized payload generators.

PRACTICAL ROLE IN WORKFLOW:When off-the-shelf tools are too noisy or inflexible, custom asynchronous Python scripts fire sub-millisecond concurrent requests to validate timing races.

Fullstack Research & Mocking

TypeScript & Node.js

Re-implementing minimal reproducible mock servers to safely simulate and explain complex microservice authorization defects.

PRACTICAL ROLE IN WORKFLOW:Enables quick creation of local replica environments where vulnerable application flows can be demonstrated safely to development teams.

Non-Standard Protocol Debugging

mitmproxy & Network Sniffers

Inspecting gRPC, HTTP/2, WebSocket, and custom TCP traffic that standard web proxies struggle to parse natively.

PRACTICAL ROLE IN WORKFLOW:Command-line scripting of traffic transformation pipelines, allowing transparent traffic manipulation on mobile and embedded apps.