Independent security researcher// TRF-01

TRFFNTRFFNSEC

Offensive web security researcher.

I find real-world vulnerabilities before attackers do - through recon, web hacking, bug bounty research, and an unhealthy curiosity for how systems break.

Explore research Let's connect

05Apple acknowledgements

NASAHall of Fame

CEHCertified Ethical Hacker

ATTACK SURFACELIVE

research.log● ● ●

01 map the surface

02 find the anomaly

03 prove the impact

04 report responsibly _

RECONWEBLOGICREPEAT

SCROLL TO DECODE

ACKNOWLEDGED /

APPLE ×5NASATRIVAGOHARMANDCUFLYNASZAINAPPLE ×5NASATRIVAGOHARMANDCUFLYNASZAIN

THE PERSON / BEHIND THE HANDLE

TRIFFIN AUGUSTINE AKA

Curiosity turned into a security mindset.

I'm Triffin Augustine, known in the hacking world as TrffnSec. With a passion for cybersecurity, I explore recon, web hacking, and bug bounty, uncovering vulnerabilities and helping others learn the craft.

When I'm not diving into security research, I'm building tools, sharing knowledge, and pushing the boundaries of ethical hacking.

Decode the full story ↗

SUBJECT / TRFFNSECFOCUS 98%

OFFENSIVE SECURITYTR / FFN

HOW I / APPROACH THE WORK

Map. Break.
Prove. Share.

No mystery-box scanner theatre. The interesting work begins when the normal path stops explaining what the application is actually doing.

01RECON

Map the surface

Asset discovery, endpoint mapping, JavaScript analysis, and the quiet corners where overlooked attack surface tends to live.

02WEB

Break assumptions

Web application testing with an emphasis on access control, XSS, logic flaws, injection paths, and unintended trust boundaries.

03PROVE

Show real impact

A finding is strongest when the attacker path is concrete. I chase reproducibility, impact, and evidence - not scanner noise.

04SHARE

Teach the trail

Write-ups, training, tools, and lessons from real hunts, so useful methodology survives longer than a single report.

FIELD NOTES / FROM REAL HUNTS

Research that left a trail.

All field notes ↗

01BUG BOUNTY / WEB SECURITY

2024 / TRFFNSEC

How a YouTube Video Led Me to $650 - My Host Header Injection Adventure

A real-world bug bounty story where a simple YouTube video sparked a successful Host Header Injection discovery - from mindset and testing to a $650 reward.

READ ON MEDIUM ↗

02XSS / FIELD NOTE

NOV 22, 2025 / TRFFNSEC

How a Lazy Bug Bounty Hunter got a place on NASA HOF (An XSS Story)

How a laid-back afternoon on NASA subdomains turned into an XSS finding and a place in NASA's Hall of Fame - including recon, payloads, and reporting lessons.

READ ON MEDIUM ↗

03METHODOLOGY / REPORTING

OCT 15, 2025 / TRFFNSEC

How I Found a 100€ Bug at DCU - From Not Applicable to Cashing In

A Medium-severity finding at DCU that moved from Not Applicable to a successful reward, with the research methodology and reporting process behind it.

READ ON MEDIUM ↗

COMPANIES / I'VE CRAWLED

ATTACK SURFACE, CURIOSITY, REPEAT.