--- title: "Amr Elsagaei - Security Researcher & Content Creator" description: "Bug bounty hunter and security researcher. I break web applications, and sometimes I film it." canonical_url: "https://amrelsagaei.com/" meta: "og:description": "Bug bounty hunter and security researcher. I break web applications, and sometimes I film it." "og:title": "Amr Elsagaei - Security Researcher & Content Creator" --- Hey! I'm # Amr Elsagaei HackerContent CreatorDeveloper [Discover latest articles](https://amrelsagaei.com/blog) [Watch the videos](https://amrelsagaei.com/videos) Scroll ## About I'm Amr Elsagaei, also known as **AmrSec**. I'm a security researcher, bug bounty hunter and developer. I report vulnerabilities to some of the world's largest companies and work with their security teams to get them fixed. On YouTube and here I break down what I find: the bugs, the tools and the process, so other hunters can use it. ![Amr Elsagaei](https://amrelsagaei.com/images/home/amr-about-384.webp) ## Companies I Have Hacked Security vulnerabilities found and reported to the teams who own the systems, across companies of every size. - Amazon - Asana - Contentsquare - Google - HackerOne - Hostinger - Meta - Monash University - Netflix - Notion - OpenAI - Stripe and 100+ more ## Latest Articles [All articles](https://amrelsagaei.com/blog) - ### [Cache Poisoning: The Cache You Can't Purge](https://amrelsagaei.com/cache-poisoning-the-cache-you-cant-purge) Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing. - ### [Client Side 03: DOM Clobbering](https://amrelsagaei.com/client-side-03-dom-clobbering) DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks. - ### [Hunting WebSockets: Bugs Behind 101 Switching Protocols](https://amrelsagaei.com/hunting-websockets-bugs-behind-101-switching-protocols) Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking. - ### [Auth for Hackers](https://amrelsagaei.com/auth-for-hackers) Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover. - ### [3 Bugs I Found One Hour Before Giving Up](https://amrelsagaei.com/3-bugs-i-found-one-hour-before-giving-up) A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour. - ### [How I Do Recon in 2026?](https://amrelsagaei.com/how-i-do-recon-in-2026) The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does. ## Watch on YouTube Walkthroughs, tooling and live hunting from the channel. [All videos](https://amrelsagaei.com/videos) - ### Cache Poisoning | The Cache You Can't Purge Views5.7KDuration32:20Published2026-09-15 - ### Client Side 03: DOM Clobbering Views1.1KDuration34:06Published2026-08-25 - ### Hunting Websockets Views3.6KDuration36:36Published2026-07-15 - ### Auth For Hackers Views8.6KDuration1:37:55Published2026-06-13 - ### 3 Bugs I Found One Hour Before Giving Up Views4.6KDuration31:10Published2026-05-20 - ### How i do recon in 2026? Views12.8KDuration23:00Published2026-05-05 - ### Client Side 02: ServiceWorker Bugs Views1.1KDuration27:56Published2026-04-20 - ### I Let AI Run My Recon Here's What It Found. Views6.1KDuration19:30Published2026-04-10 - ### Claude Code For Hackers Views35KDuration40:00Published2026-04-01 Partners ## Trusted by industry teams I work with companies around the world on security research, bug bounty and technical consulting. - [Penligent (opens in a new tab)](https://www.penligent.ai/) - [OctoBrowser (opens in a new tab)](https://octobrowser.net/) - [TryHackMe (opens in a new tab)](https://tryhackme.com/) - [Deeper Network (opens in a new tab)](https://www.deeper.network/) - [Hostinger (opens in a new tab)](https://www.hostinger.com/) - [YesWeHack (opens in a new tab)](https://www.yeswehack.com/) - [Bugcrowd (opens in a new tab)](https://www.bugcrowd.com/) - [HackingHub (opens in a new tab)](https://www.hackinghub.io/) - [Penligent (opens in a new tab)](https://www.penligent.ai/) - [OctoBrowser (opens in a new tab)](https://octobrowser.net/) - [TryHackMe (opens in a new tab)](https://tryhackme.com/) - [Deeper Network (opens in a new tab)](https://www.deeper.network/) - [Hostinger (opens in a new tab)](https://www.hostinger.com/) - [YesWeHack (opens in a new tab)](https://www.yeswehack.com/) - [Bugcrowd (opens in a new tab)](https://www.bugcrowd.com/) - [HackingHub (opens in a new tab)](https://www.hackinghub.io/) - [Hostinger (opens in a new tab)](https://www.hostinger.com/) - [YesWeHack (opens in a new tab)](https://www.yeswehack.com/) - [Bugcrowd (opens in a new tab)](https://www.bugcrowd.com/) - [HackingHub (opens in a new tab)](https://www.hackinghub.io/) - [Penligent (opens in a new tab)](https://www.penligent.ai/) - [OctoBrowser (opens in a new tab)](https://octobrowser.net/) - [TryHackMe (opens in a new tab)](https://tryhackme.com/) - [Deeper Network (opens in a new tab)](https://www.deeper.network/) - [Hostinger (opens in a new tab)](https://www.hostinger.com/) - [YesWeHack (opens in a new tab)](https://www.yeswehack.com/) - [Bugcrowd (opens in a new tab)](https://www.bugcrowd.com/) - [HackingHub (opens in a new tab)](https://www.hackinghub.io/) - [Penligent (opens in a new tab)](https://www.penligent.ai/) - [OctoBrowser (opens in a new tab)](https://octobrowser.net/) - [TryHackMe (opens in a new tab)](https://tryhackme.com/) - [Deeper Network (opens in a new tab)](https://www.deeper.network/) ## Sitemap See the full [sitemap](/sitemap.md) for all pages.