Skip to content
View Doniyor2510's full-sized avatar
1 follower · 1 following

Block or report Doniyor2510

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Doniyor2510/README.md

Doniyor Sotiboldiyev

Penetration Tester · Application Security Researcher — Tashkent, Uzbekistan

I break web applications to help fix them. My focus is manual source-code review and responsible disclosure of real vulnerabilities in open-source software, alongside hands-on offensive security labs.

Security Research & Responsible Disclosure

I actively review open-source projects and report vulnerabilities through coordinated disclosure (GitHub Security Advisories and vendor security channels). Reported findings to date span:

  • Broken Access Control / IDOR — cross-tenant object access, missing authorization checks
  • Server-Side Request Forgery (SSRF) — internal-network and cloud-metadata reach
  • Injection — SQL injection, stored / reflected XSS
  • Authentication & verification flaws — payment-callback forgery, weak token handling

Published advisories are linked here as they become public. All findings are disclosed privately and coordinated with maintainers before publication.

Core Skills

Web Application Security OWASP Top 10 · IDOR / Broken Access Control · SSRF · SQL Injection · XSS · Authentication flaws

Methodology & Tooling Manual source-code review (source→sink) · Burp Suite · SQLMap · Nmap · Gobuster / Dirsearch

Systems & Scripting Linux & Windows enumeration · Python · Bash · PHP code review

Featured Project

Multi-VHost Security Lab — a custom enterprise-style penetration-testing environment with multiple virtual hosts and realistic, exploitable web vulnerabilities. → https://github.com/Doniyor2510/multi-vhost-security-lab

Contact

Pinned Loading

  1. multi-vhost-security-lab multi-vhost-security-lab Public

    Custom penetration testing lab with 8 virtual hosts and realistic web vulnerabilities.