Skip to content
View pushjoman21's full-sized avatar
4 followers · 0 following

Block or report pushjoman21

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
pushjoman21/README.md

Joman

Security Researcher · Reverse Engineer · Full-Stack Developer

Based in Germany 🇩🇪

Email Discord

About

I analyze client-side protection systems: obfuscated JavaScript, custom bytecode VMs, browser fingerprinting and payload encryption. My work focuses on understanding how these mechanisms are built, documenting them clearly and using that knowledge to design stronger defenses.

Services

  • Reverse engineering of obfuscated JavaScript and WebAssembly
  • Bot-mitigation and fingerprinting analysis: how signals are collected, structured and protected
  • JavaScript VM analysis: opcode recovery, disassembly, deobfuscation tooling
  • Security assessments of web applications and APIs
  • Full-stack development: backends, APIs and web frontends

Tech Stack

JavaScript Python C Node.js React Express

Burp Suite Wireshark Kali Linux Chrome DevTools Git

Published Research

Project Topic
hCaptcha HSW Blob Encryption AES key recovery from a control-flow-flattened implementation
hCaptcha MotionData VM Bytecode VM disassembler
hCaptcha HSJ Research Notes Fingerprint events and vmdata format documentation
DataDome Client-Side Analysis Deobfuscation, fingerprint structure, payload encryption
discord.id Proof-of-Work JavaScript PoW extraction and Python reimplementation

Note

All published research is archived and outdated. The analyzed systems have changed since publication. It is provided for educational purposes only and must not be used to circumvent protections or violate any platform's terms of service.

In Development

  • JoCaptcha: a captcha system built from scratch, with custom challenge logic and a tamper-resistant backend
  • JoVm: a custom JavaScript VM with its own bytecode and interpreter (private)

Contact

Available for freelance work in security research, reverse engineering and development. Vendors with questions about any published research can contact me at jomandiscord@gmail.com.

Popular repositories Loading

  1. DataDome-Reverse-Engineering DataDome-Reverse-Engineering Public

    Archived research: analysis of the DataDome client script (deobfuscation, fingerprinting, payload encryption). Educational use only.

    JavaScript 9 1

  2. Hcaptcha-Blob-Encryption Hcaptcha-Blob-Encryption Public

    Archived research: AES key recovery from hCaptcha's control-flow-flattened HSW blob encryption. Educational use only.

    JavaScript 6

  3. hCaptcha-HSJ-Research hCaptcha-HSJ-Research Public

    Archived research notes on hCaptcha HSJ fingerprint events and the vmdata format. Educational use only.

    5 2

  4. Discord.id-Reverse Discord.id-Reverse Public

    Archived research: analysis of the discord.id JavaScript proof-of-work. Educational use only.

    JavaScript 3

  5. Hcaptcha-MotionData-VM Hcaptcha-MotionData-VM Public

    Archived research: disassembler for hCaptcha's MotionData bytecode VM. Educational use only.

    Python 1

  6. JoVault JoVault Public

    JavaScript bytecode compiler and register-based virtual machine in TypeScript, with a browser demo and optional WebAssembly engine. Research preview.

    TypeScript 1