I'm Abdullah. I've been hunting bugs since 2022, self-taught, mostly recon — subdomain enumeration, Google dorking, and Shodan.

I write two kinds of posts here: walkthroughs of recon techniques with real output, and honest accounts of what didn't work. If a technique wasted my time, I'll say so.

Everything I publish is for authorized testing only.