SHIVANSH Shivansh

Daily driver Regular Project-dependent

// tools change, method doesn't.

1. C-01

   OSINT Lookup Tool

   In progress A Node.js web app that aggregates open-source information about a phone number or a vehicle number across multiple sources, and shows where those sources disagree. RoleSolo build CategoryOSINT tooling SurfaceWeb / backend

   Problem

   OSINT enrichment on a single identifier means the same handful of lookups, repeated by hand, across a dozen browser tabs. The gathering eats the time that should go into interpretation — and when two sources disagree, a manual process tends to quietly keep whichever answer it saw last.

   Method

   One input, fanned out across several sources concurrently, then normalised into a single shape so results can be compared field by field. Conflicts are surfaced as conflicts rather than resolved silently — each value carries the source it came from. Built on Node.js, which is also how I'm learning the backend side properly.

   Evidence

   Held back until the tool stops changing shape.
   The conflict view is the artifact worth showing, and its output format is still moving. A screenshot of it now would document a version that no longer exists. Available on request in the meantime: a sanitised sample response with two sources disagreeing on one field.

   Outcome

   In active development — source integrations and result normalisation are the current work. Described here at methodology level only; nothing on this site performs a lookup, and nothing will.

   Stack

   • Node.js
   • JavaScript
   • Async fan-out
   • Source attribution
2. C-02

   Arch Linux Build

   In progress The workstation that replaced a phone — assembled package by package, and made reachable from outside a CGNAT connection that blocks inbound entirely. RoleSolo build CategorySystems / infra SurfaceWorkstation

   Problem

   Termux was never going to host long-running scans or persistent services. Moving to a laptop solved that and introduced a sharper problem: my ISP puts me behind CGNAT, so there is no public address to reach. Plain SSH inbound was never going to work, and port forwarding has nothing to forward.

   Method

   Arch installed from the base up rather than from an installer image, so every package on the machine is one I chose. For access, the direct route was diagnosed before it was replaced: a timeout rather than a refusal is the tell that nothing is listening on a reachable address. The fix is outbound-only — a Cloudflare Tunnel for HTTP and Tailscale for SSH, both of which dial out rather than wait to be dialled.

   Evidence

   Evidence here would map my own attack surface.
   The useful artifacts — the network diagram and the terminal capture of the timeout-versus-refusal diagnosis — describe the exact route into a machine I use for assessments. The method is in full above; the topology stays off a public page.

   Outcome

   The machine is reachable from anywhere without exposing a listening port to the internet — which is a better posture than the port forward I originally wanted. The detour taught me more about NAT traversal than any tutorial had.

   Setup

   • Arch Linux
   • KDE Plasma
   • systemd
   • Cloudflare Tunnel
   • Tailscale SSH
3. C-03

   Recon Automation

   Active Recon pipelines built on recon-ng and ReconFTW — one pass for enumeration, probing, and scanning, with every result hand-verified before it counts. RoleOperator CategoryAutomation SurfacePipeline / CLI

   Problem

   The first pass of an assessment is the same every time — subdomain enumeration, HTTP probing, vulnerability scanning — and doing it by hand is both slow and inconsistent between targets. Worse, scanner output reads as findings if you let it. Most of what comes out is noise wearing a severity label.

   Method

   recon-ng and ReconFTW chained into a single pass that runs the same way on every target, so results are comparable across assessments. Output is treated as leads, not findings: everything is deduplicated, then hand-verified, then graded Confirmed, Probable, or Hypothesis before it can enter a report. Anything that fails reproduction is dropped rather than downgraded.

   Evidence

   The numbers are real; publishing them is not safe yet.
   A before/after count is only meaningful next to the assessment it came from, and that assessment identifies a target. A target-free version — pipeline diagram plus the survival rate across runs — is what belongs here, and it is the next thing I add.

   Outcome

   Verified output becomes the raw material for structured disclosure reports — triaged, deduplicated, and rewritten in plain language before anything reaches an organisation.

   Stack

   • recon-ng
   • ReconFTW
   • Bash
   • Subfinder
   • Httpx
   • Nuclei
4. C-04

   Disclosure Reports

   Active A fixed CERT-In-aligned report format used for every assessment that clears verification — scope, method, reproduction, grade. RoleAuthor CategoryReporting SurfaceCoordinated disclosure

   Problem

   A finding that can't be reproduced by the person receiving it is not a disclosure, it's a rumour. Organisations without a bug bounty programme have no intake process either, so the report has to do the work the programme would normally do: establish scope, prove the issue, and make the fix obvious.

   Method

   One format, every time: scope assessed, reproduction steps written so someone else can follow them, affected system identified, and a grade attached that stays honest even when it's less impressive. No speculation about impact I can't demonstrate. Then I wait on the organisation's timeline rather than mine.

   Evidence

   Targets are not named here, by design.
   What is shareable is the format itself — the blank template, and one fully redacted sample showing structure and grading without identifying the organisation. Both go out on request to anyone assessing the work.

   Outcome

   Reported to an Indian government body and a private firm — named nowhere on this site, and not in conversation either.

   Focus

   • CERT-In format
   • Reproduction steps
   • Honest grading
   • Plain language
5. C-05

   Vulnerability & Network Fundamentals

   Active Mapping every vulnerability class back to the networking concept underneath it, so a finding can be explained without citing a scanner. RoleSelf-directed CategoryFundamentals SurfaceWeb / network

   Problem

   Tools tell you something is wrong; they don't tell you why, and a report that can only cite tool output falls apart the moment an engineer pushes back on it. The gap shows up under questioning, which is exactly the wrong time to find it.

   Method

   Going back through the base layer deliberately — subnetting, the OSI and TCP/IP models, request/response mechanics — and connecting each vulnerability class I meet in the field to the mechanism underneath it. Manual tests against a target, auth flows, IDOR checks, injection points, get verified against that layer before they're written up.

   Evidence

   C-02 is the worked example.
   The CGNAT diagnosis in that file traces a symptom to the protocol behaviour underneath it: a timeout instead of a refusal means nothing is listening on a reachable address. Reasoning from the base layer, on a case where the reasoning is mine to publish.

   Outcome

   The CGNAT problem in C-02 is the argument for this: the fix only became obvious once the networking underneath it made sense. Every finding I send can be explained from first principles, not from a screenshot of a scan.

   Toolset

   • Burp Suite
   • OWASP ZAP
   • sqlmap
   • Nikto
   • OWASP Top 10
6. C-06

   Agentic Coding Setup

   Live A model-routing layer in front of my editor and terminal, so an agentic coding session survives one provider rate-limiting, erroring, or going down mid-task. RoleSolo build CategoryAutomation SurfaceLocal tooling

   Problem

   Agentic coding tools point at one provider. When that provider throttles you, errors, or is simply down, the session stops — usually halfway through a refactor, with the working tree in a state nobody wants to inherit. Swapping providers manually means editing config and restarting, which loses the context that made the session worth having.

   Method

   An OmniRouter gateway sits between the tools and the providers: one local endpoint, many models behind it, quota-aware failover between them. The coding CLI is pointed at that endpoint instead of at a vendor, so switching models is a routing decision rather than a reconfiguration. Cheap models handle mechanical edits; the expensive ones are reserved for the work that actually needs them.

   The rule I hold it to is the same one I use for scanner output: generated is not verified. Anything it writes gets read, run, and diffed before it lands. The speed is in the first draft, not in the decision to ship.

   Evidence

   This site is the artifact.
   Every page here was built through the routing layer described above, review step included. A redacted routing config and a capture of a mid-session failover are shareable on request; keys never appear in either.

   Outcome

   In daily use — this site was built through it. What it changed most is scope: a two-day scaffolding job becomes an afternoon, which leaves the time for the reading and testing that the scaffolding used to eat.

   Stack

   • OmniRouter
   • Agentic CLIs
   • Fallback routing
   • Bash
   • Git

1. Ongoing

   Coordinated disclosure — government infrastructure

   Found and reported vulnerabilities across Indian government infrastructure through coordinated disclosure. Reconnaissance first, verification before write-up, a CERT-In-aligned report at the end. Targets aren't named here and won't be.

   • Coordinated disclosure
   • CERT-In format
   • Black-box

2. Ongoing

   Coordinated disclosure — private firms

   The same process applied to private organisations: assess within scope, reproduce cleanly, report in plain language, wait on their timeline rather than mine. A finding that can't be reproduced twice doesn't get sent.

   • Responsible disclosure
   • Web app testing
   • Reporting

3. Learned the hard way

   Networking in hostile conditions

   CGNAT quietly breaks anything that expects a reachable public address — SSH into my own machine included. Working through it meant understanding NAT traversal, IPv6 availability, and why a connection times out instead of refusing. That distinction was the whole diagnosis.

   • CGNAT
   • NAT traversal
   • Tailscale
   • Cloudflare Tunnel

4. In progress

   Linux from the base up

   Migrated off Android/Termux onto a Linux laptop, learning Arch by building it rather than installing it — packages, configuration, and customisation done deliberately so I know what every piece is doing and why it's there.

   • Arch Linux
   • KDE Plasma
   • systemd

5. Ongoing

   Building with agents, not instead of thinking

   Moved my build workflow onto agentic coding, routed through OmniRouter so one endpoint fronts many models and a rate limit becomes a failover rather than a dead session. It changed the economics of scaffolding — but not the review step. Generated code gets the same treatment as scanner output: assume nothing until it has been read and run.

   • OmniRouter
   • Agentic CLIs
   • Model routing
   • Vibe coding

Tools change.
Method doesn't.