My Hacker Toolkit

🧠 Why This Toolkit Exists

Every good exploit starts with curiosity—and sometimes a hunch.

Over the last few years, I’ve disclosed vulnerabilities ranging from GraphQL overexposures in social apps like Fizz and YikYak to full API-level data leaks in life safety infrastructure—one of which became CVE-2025-0352 and was documented in a CISA advisory.

What those projects had in common wasn’t a zero-day exploit or a million-dollar toolchain—it was a small, carefully selected set of tools that got the job done cleanly, legally, and ethically.

This is that toolkit.

🔎 Interception & Traffic Analysis

🕵️‍♂️ Fiddler Everywhere

Used for: Mobile app traffic inspection, replay attacks, JSON body manipulation

The go-to for intercepting HTTPS traffic from mobile apps. It’s lightweight, cross-platform, and ideal for reverse-engineering request structures without breaking anything.

I’ve used Fiddler to:

• Dump GraphQL schemas from YikYak
• Intercept and replay POST requests in alarm system apps
• Watch payloads for subtle patterns like user ID, point fields, or rate-limiting quirks

Bonus: its UI makes it easy to filter by method or domain when sifting through noisy app activity.

🧵 Burp Suite (when needed)

Used sparingly, but still helpful for advanced manipulation

I lean on Fiddler more for mobile work, but Burp comes out when I need:

• Fine-tuned intruder fuzzing
• Cookie/session manipulation
• Repeater + Collaborator for XSS or SSRF

Burp is also useful for HTTP2/GraphQL support if Fiddler hits limits.

🧪 Scripting & Enumeration

🐍 Python

Used for: Enumeration, API automation, analyzing scope without touching sensitive data

Python is my utility belt. Whenever I find an IDOR, wide-open API, or unauthenticated endpoint, Python lets me:

• Safely test enumeration ranges (like SiteNum in the panel vuln)
• Map exposed data at scale while stripping PII
• Write controlled proof-of-concepts for reporting

Example from the alarm panel enumeration:

pythonCopyEditdef check_site_number(site_number):
payload["SiteNum"] = str(site_number)
response = requests.post(url, headers=headers, json=payload)
...

I never store raw user data—just anonymized summaries for scope validation.

🧠 GraphQL Introspection + Voyager

Used for: Mapping entire API schemas in seconds

If a GraphQL API forgets to lock down introspection (a lot do), you can uncover everything.

I’ve used this method on:

• YikYak (to find point, userId, and undocumented mutations)
• Smaller apps with insecure admin panels hidden in plain schema

Voyager is my visualizer of choice—it makes API structure readable and fast to navigate.

🔐 Auth & Session Testing

🔑 JWT.io + Header Manipulation

Used for: Analyzing token structure, checking claims, replaying sessions

A lot of mobile apps rely on JWTs with RS256—great if signed properly, dangerous if mishandled.

I inspect tokens to:

• Identify user scoping failures
• Check for leaked or static secrets
• Confirm session durations or misuse potential

In Fizz and YikYak, this helped me understand user linkage and permissions—without needing access to other accounts.

🛠️ Misc Tools I Keep Handy

• Postman – clean for non-malicious API testing
• curl – quick request mocking
• Wireshark – rarely needed, but good for weird lower-level behavior
• VS Code – for writing + executing API requests inline

📜 Toolkit Philosophy

I don’t use fuzzers first. I don’t lead with metasploit. Most of my work starts with observing how the app talks, and following where it shouldn’t go.

This toolkit is light on noise, heavy on signal.

Every tool here was used in at least one public vulnerability, including:

• Unprotected CDN backups in Fizz
• Exact GPS coordinates leaking from YikYak
• Nationwide site data access in a fire alarm app
• Moderator and admin visibility from misconfigured mobile APIs

You don’t need a weaponized lab to find high-impact vulns—just sharp tools, ethical boundaries, and some patience.

🧠 Final Thoughts

My toolkit isn’t a pentester’s dream or a red team vault. It’s a curious hacker’s field kit—designed for clarity, precision, and responsible disclosure.

If you’re getting started in appsec or bug hunting, my advice?

• Start with Fiddler, Python, and jq
• Watch how data flows, then gently nudge it
• Focus on real-world risk, not just bug type
• Always disclose responsibly

The best part of all this? Finding something real—and fixing it for everyone else.