About me
I’m 0xNullEcho
I’m a web developer focused on application security. I study how web applications fail, document what I learn, and build small tools that help me understand the systems beneath modern websites.
From development to security
My background includes two years of web development experience. Learning how applications are designed and assembled naturally led me to questions about how their assumptions break: where trust boundaries fail, how different components interpret the same request, and how small implementation decisions become security issues.
I’m developing my application-security skills through hands-on labs, technical research, and deliberately small projects. My write-ups cover vulnerabilities such as broken workflows, HTTP parameter pollution, CRLF injection, session fixation, cross-site scripting, and request confusion.
How I learn
I learn best by reducing a system to its fundamentals, building a smaller version, and documenting where my assumptions were wrong. That approach shapes both my security research and the way I communicate findings.
Break it down
Trace requests, data flows, trust boundaries, and component behavior before reaching for an exploit.
Verify it
Reproduce behavior carefully and distinguish confirmed observations from assumptions or scanner output.
Explain it
Document the cause, impact, reproduction steps, and practical remediation in clear language.
What I’m working on
My current Python projects explore several parts of the security workflow and the underlying programming concepts:
- TCP port scanner →
Sockets, TCP connections, and concurrent I/O.
- Subdomain enumerator →
DNS resolution, HTTP probing, and fingerprinting.
- Hash cracker →
Hashing, generators, salts, and multiprocessing.
- OSINT utility →
Web retrieval, parsing, pattern matching, and data handling.
Work with me
I’m currently offering a limited number of focused manual web-security reviews for small teams. Every engagement starts with an agreed scope and explicit authorization, and every reported finding is manually verified.