Peng
Senior Security Engineer, ClawWorks · Architect of SecurityClaw
Peng is the Senior Security Engineer at ClawWorks and the primary researcher behind the content on this site. Peng built and maintains SecurityClaw — a 54-skill autonomous penetration testing platform that runs structured security campaigns against live bug bounty targets on Intigriti, HackerOne, YesWeHack, and Bugcrowd.
Research approach
Peng's methodology is systematic rather than ad-hoc. Every campaign runs through a structured pipeline: passive reconnaissance first, then active probing of identified attack surfaces, then exploitation attempts on credible findings, then automated submission draft generation for verified issues. The platform's adaptive engine means findings feed each other — a JS bundle analysis revealing an internal API endpoint immediately triggers the API enumeration chain, not a manual note to investigate later.
The 54 SecurityClaw skills cover attack classes Peng finds consistently underserved in bug bounty tooling:
- CORS misconfiguration detection — including the false positive patterns that waste most researchers' time (see the scanner false positive analysis)
- SSRF hypothesis generation — chains from hostname leaks to server-side request forgery
- OAuth scope abuse and client enumeration
- IDOR scanning across API endpoints
- Open redirect hunting with WAF-bypass variants
- Subdomain takeover detection via certificate transparency monitoring
- JS bundle analysis for hardcoded credentials and internal API paths
- CVE intelligence correlation — cross-referencing a target's tech stack with the NVD to identify exploitable CVEs before scanning
Campaign history
SecurityClaw has run 27 campaign-result sets since launch. Targets include publicly disclosed programs on Intigriti (Tomorrowland, Visma, Personio, Telenor Sweden, RIPE NCC, DoctoLib, DigitalOcean, Lansweeper) and research campaigns on specific attack classes (CORS, subdomain takeover, JS bundle analysis, OAuth). Each campaign result is stored, analysed, and used to improve the next campaign's hypothesis generation.
Formal submission track record on Intigriti:
- Tomorrowland clickjacking on CAS authentication endpoint
- Visma AI Assistant subdomain — clickjacking (missing frame protection)
- Visma AutoInterface — X-Frame-Options set to ALLOWALL
Campaign infrastructure runs on ephemeral AWS EC2 instances. Each campaign gets a fresh instance, a clean IP, and no history — the configuration most likely to avoid WAF correlation and rate-limiting before the campaign reaches its interesting findings.
What Peng writes here
Peng produces the research. The campaign outputs — findings, false positive patterns, tool evaluations, methodology decisions — are briefed to Jenn (ClawWorks content lead), who turns them into the articles published on this site. Technical accuracy is Peng's responsibility; clarity for a broader bug bounty audience is Jenn's.
The result is that every article here is grounded in actual campaign work, not reconstructed from documentation or synthetic examples. When an article describes a CORS scanner false positive pattern, it's because that pattern appeared in real campaign output and Peng had to build detection logic to distinguish it from a real finding.
Articles by Peng
All articles on Bug Hunter Tools are sourced from Peng's research. Browse the full archive: