# Amr Elsagaei > Bug bounty hunter and security researcher. I break web applications, and sometimes I film it. Canonical Origin: https://amrelsagaei.com/ ## LLM Resources - [Full Content](https://amrelsagaei.com/llms-full.txt): Complete page content in markdown format. - [sitemap.xml](https://amrelsagaei.com/sitemap.xml): XML sitemap for search engines and crawlers. - [robots.txt](https://amrelsagaei.com/robots.txt): Crawler rules and permissions. ## Available Languages on Website - [English (en)](/): 79 pages; content included below. ## Pages - [Amr Elsagaei - Security Researcher & Content Creator](/): Bug bounty hunter and security researcher. I break web applications, and sometimes I film it. - [$1 Bug Bounty](/1-bug-bounty): Why low-hanging fruit is the right place to start in bug bounty, the common easy wins to look for, and how small findings build toward bigger ones. - [3 Bugs I Found One Hour Before Giving Up](/3-bugs-i-found-one-hour-before-giving-up): A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour. - [3 Tricks to Hunt Faster in Bug Bounty](/3-tricks-to-hunt-faster-in-bug-bounty): Three small workflow changes that remove friction from a hunt: proxy match-and-replace rules, repeatable workflows, and a fast note-taking system. - [AI Just Made Bug Bounty Way Easier](/ai-just-made-bug-bounty-way-easier): Feeding an open-source target's own source code to an AI assistant, with a local and VPS setup, so you stop guessing how your input is handled. - [All You Need to Start Bug Bounty. The 3 Essentials](/all-you-need-to-start-bug-bounty-the-3-essentials): You don't need fifty tools to start bug bounty. The three things that actually produce results: a platform, a proxy, and a lean Linux toolkit. - [API Penetration Testing πŸ”](/api-penetration-testing-pt1): Building an API penetration testing environment: Kali Linux, Burp Suite, OWASP ZAP, FoxyProxy and labs built for finding hidden API endpoints. - [API Penetration TestingπŸ” Part 2](/api-penetration-testing-pt2): Reverse engineering APIs with Postman and mitmproxy2swagger, finding excessive data exposure, and scanning for weaknesses. Part two of API testing. - [Auth for Hackers](/auth-for-hackers): Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover. - [πŸš€ Automate Advanced XSS with XSStrike and Dalfox βš™οΈ](/automate-advanced-xss-with-xsstrike-and-dalfox): Automating XSS discovery with XSStrike and Dalfox, from install through real usage against labs, combined with Burp Suite for deeper testing. - [πŸ”₯ Automating Advanced SQL Injection with Ghauri!πŸ’»πŸ›‘οΈ](/automating-advanced-sql-injection-with-ghauri): How to install and use Ghauri to automate advanced SQL injection detection and exploitation, and how it compares to the tools you already know. - [Bug Bounty Hunting Methodology 2025](/bug-bounty-hunting-methodology-2025): A streamlined bug bounty methodology for 2025 covering reconnaissance, enumeration and testing, from subdomain discovery through JavaScript analysis. - [Build Your Private Local AI Server Right Now!](/build-your-private-local-ai-server-right-now): Run large language models on your own hardware: WSL and Ubuntu, Ollama setup, adding models, and monitoring GPU performance on a fully private server. - [Cache Poisoning: The Cache You Can't Purge](/cache-poisoning-the-cache-you-cant-purge): Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing. - [Caido Masterclass – From Setup to Exploits](/caido-masterclass-from-setup-to-exploits): A full Caido walkthrough, from first setup to real exploitation, and why this modern proxy has become a serious alternative to Burp Suite. - [Claude Code For Hackers](/claude-code-for-hackers): Claude Code is everywhere in development, almost nowhere in security. Setting it up for hacking: project context, permissions, skills, real workflows. - [Clear Logs and Bash History for Stealth](/clear-logs-and-bash-history-for-stealth): How attackers wipe bash history and system logs after compromising a Linux target, the last stage of exploitation, and what defenders should watch. - [Client Side 01: postMessage Bugs](/client-side-01-postmessage-bugs): postMessage bugs sit unnoticed in checkout pages, auth flows and chat widgets. Origins, senders, receivers, sinks, and the mistakes that expose them. - [Client Side 02: ServiceWorker Bugs](/client-side-02-serviceworker-bugs): A Service Worker registered through a vulnerability lives in the victim's browser and outlives the patch. The lifecycle, the persistence, the hunt. - [Client Side 03: DOM Clobbering](/client-side-03-dom-clobbering): DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks. - [Amr Elsagaei - Contact](/contact): Reach Amr Elsagaei about security research, sponsorship, or a quick question. Messages reach him directly and he answers them himself. - [Control Network Traffic with Evil Limiter!](/control-network-traffic-with-evil-limiter): Evil Limiter uses ARP spoofing to throttle any device on your network. Installation, device discovery and traffic limiting, plus why it only works on IPv4. - [CORS Like You’ve Never Seen](/cors-like-youve-never-seen): Wildcard origins, reflected origins and the WordPress API trap: the CORS misconfigurations that lead to account takeover, and how to spot them fast. - [Crack WPA2 WiFi Passwords with Aircrack-ng](/crack-wpa2-wifi-passwords-with-aircrack-ng): Cracking WPA/WPA2 Wi-Fi passwords with Aircrack-ng: verifying packet injection, capturing the handshake, and recovering the key, step by step. - [Create Your BlackHatChat RIGHT NOW! πŸš€πŸŒ](/create-your-blackhatchat-right-now): Set up your own private dark web chat room with the LE CHAT repository, Apache, MySQL and Tor, with no JavaScript required. - [CSRF - Automate Vulnerability Testing πŸ›‘οΈπŸ”](/csrf-automate-vulnerability-testing): Automate cross-site request forgery testing with Burp Suite and Project Forgery, a Python tool for generating and validating CSRF proof-of-concepts at scale. - [CVE-2025-32433 (Erlang/OTP SSH RCE vulnerability)](/cve-2025-32433-erlang-otp-ssh-rce-vulnerability): CVE-2025-32433, unauthenticated RCE in the Erlang/OTP SSH implementation: full exploitation walkthrough plus network and host detection techniques. - [Deploy Your Next Hacking Lab in 30 Seconds](/deploy-your-next-hacking-lab-in-30-seconds): Three ways to deploy a vulnerable web app lab: manual Docker commands, Docker Compose, and a visual Compose manager that removes the command line entirely. - [Discover Hidden Parameters for Web App Vulnerabilities πŸ”πŸ•΅οΈβ€β™‚οΈ](/discover-hidden-parameters-for-web-app-vulnerabilities): Find undocumented parameters in web applications using Arjun and Waybackurls, and turn those hidden inputs into real attack surface. - [Don’t Report Bugs. Chain Them.](/dont-report-bugs-chain-them): A weak header, a loose CORS policy and a small injection are low alone. Chaining is how they turn critical, with a demo from HTML injection to RCE. - [Empower Your Command-Line Experience with AI Precision](/empower-your-command-line-experience-with-ai-precision): ShellGPT brings a large language model into your terminal. Installation, chat mode, code generation and running system commands with AI assistance. - [Footprinting and Scanning | eJPT](/footprinting-and-scanning-ejpt): eJPT notes on footprinting and scanning: network mapping with Wireshark, ARP scanning, host discovery with fping, and port scanning essentials. - [Forget Low-Hanging Fruit. Hunt These Instead](/forget-low-hanging-fruit-hunt-these-instead): XSS and SQLi labs don't survive Cloudflare. The bug classes worth your time: account takeover, 2FA bypass, 403 bypass, API auth and privilege escalation. - [Full-Time Bug Hunting - with Rhynorater | SecMeet 0x03](/full-time-bug-hunting-with-rhynorater-secmeet-0x03): SecMeet 0x03 with Justin Gardner (Rhynorater) on going full-time in bug bounty, the Caido versus Burp debate, and making no-fluff hacker content. - [FUZZ Everything! πŸ“‚](/fuzz-everything): How to use ffuf to fuzz everything: hidden directories, file extensions, API endpoints, parameters and backup files that normal recon never surfaces. - [πŸš€ Get Your First Zero-Day RIGHT NOW!](/get-your-first-zero-day-right-now): Get started finding zero-days in binary software and web applications, from setting up VMware to fuzzing real targets with AFL. - [GraphQL for Bug Bounty Hunters](/graphql-for-bug-bounty-hunters): How GraphQL really works and why its flexibility is a goldmine: schemas, queries, mutations, fragments, and testing an endpoint like an attacker. - [Hack. Hustle. Repeat. with NahamSec | SecMeet 0x04](/hack-hustle-repeat-with-nahamsec-secmeet-0x04): SecMeet 0x04 with NahamSec on starting out in bug bounty, breaking through plateaus, going full-time, financial discipline and building a brand that lasts. - [Hacker vs. ChatGPT! Who Wins?](/hacker-vs-chatgpt-who-wins): ChatGPT tested against real bug bounty challenges: analysing requests and responses, suggesting payloads, and whether AI can out-hunt a human. - [Hacking HubSpot | Live Bug Bounty Hunting](/hacking-hubspot-live-bug-bounty-hunting): A live bug bounty session against HubSpot with no scripted recon, going straight into the app to show how a target breaks down from the inside. - [Host Your Own Secure Website on the Dark Web with a Custom Onion Domain](/host-your-own-secure-website-on-the-dark-web-with-a-custom-onion-domain): Hosting a dark web site end to end: configuring Nginx, setting up Tor as a hidden service, and generating your own custom vanity onion address. - [How I Do Recon in 2026?](/how-i-do-recon-in-2026): The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does. - [How I Found IDORs That Shouldn’t Exist](/how-i-found-idors-that-shouldnt-exist): IDORs that survive modern access control: trailing slashes, path normalisation, double slashes and obfuscated paths, with testable examples. - [How to anonymize all network traffic with TorGhost](/how-to-anonymize-all-network-traffic-with-torghost): TorGhost routes all of your Linux network traffic through Tor without the Tor Browser. Installation, usage and how it prevents DNS leaks. - [How to Automate Wi-Fi Hacking with Wifite2](/how-to-automate-wi-fi-hacking-with-wifite2): Wifite2 automates Wi-Fi attacks and picks the best strategy per network. Installing it, setting flags, reading the site survey and choosing targets. - [How to Become a Successful Security Researcher | SecMeet 0x02](/how-to-become-a-successful-security-researcher-secmeet-0x02): SecMeet 0x02 with James Kettle (albinowax) of PortSwigger on HTTP request smuggling, web cache poisoning, and finding techniques nobody has yet. - [How to install Tor Browser in Kali Linux in 2024](/how-to-install-tor-browser-in-kali-linux-in-2024): What Tor is, how onion routing protects your anonymity, and a step-by-step guide to installing and running the Tor Browser on Kali Linux in 2024. - [Hunting WebSockets: Bugs Behind 101 Switching Protocols](/hunting-websockets-bugs-behind-101-switching-protocols): Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking. - [I Let AI Run My Recon Here's What It Found.](/i-let-ai-run-my-recon-heres-what-it-found): Recon eats time. What happened when Penligent was pointed at a target and left to map the attack surface, validate findings and produce a report unattended. - [Information Gathering | eJPT](/information-gathering-ejpt): eJPT notes on passive and active information gathering: WHOIS, DNS reconnaissance, WAF detection and subdomain enumeration. - [Inside the Mind of a $Million Bug Bounty Hunter | SecMeet 0x01](/inside-the-mind-of-a-million-bug-bounty-hunter-secmeet-0x01): SecMeet 0x01 with Nikhil Shrivastava (niks), B-Sides Ahmedabad founder and Synack red teamer, on earning over a million dollars in bounties. - [πŸ€– iRobot | Live Bug Bounty Hunting πŸ•΅οΈβ€β™‚οΈ](/irobot-live-bug-bounty-hunting): A live walkthrough of iRobot's public Bugcrowd program with Burp Suite, showing practical techniques for finding and reporting real vulnerabilities. - [JavaScript Analysis Masterclass - Part 1](/javascript-analysis-masterclass-pt-1): Collecting a target's JavaScript with Burp, the Wayback Machine and the Archive.org CDX API, then analysing it statically for endpoints and secrets. - [JavaScript Analysis Masterclass - Part 2](/javascript-analysis-masterclass-pt2): Static analysis finds endpoints and secrets; runtime analysis finds the bugs. Live debugging with DevTools, local overrides, logic flaws and DOM-based XSS. - [JWT Analyzer in Caido - Built for Hackers](/jwt-analyzer-in-caido-built-for-hackers): A Caido plugin for JWT work: decoding and inspecting tokens, breaking down their claims, and running built-in attack simulations without leaving the proxy. - [Launch Advanced Man in the Middle Attacks with Xerosploit](/launch-advanced-man-in-the-middle-attacks-with-xerosploit): Xerosploit automates man-in-the-middle attacks that normally need manual Bettercap setup. Install, scan, replace images, capture network traffic. - [Live Bug Bounty Hunting πŸ›πŸ’΅](/live-bug-bounty-hunting): A full live hunting walkthrough: Google dorking, subdomain discovery, URL collection and analysis, Nuclei scanning, XSS automation and LFI detection. - [Master Code Injection Attacks, Ethically! πŸ”](/master-code-injection-attacks-ethically-1): Two hands-on code injection labs: injecting OS commands in a PortSwigger lab, then escalating to a PHP reverse shell in bWAPP automated with Commix. - [Mastering the eJPT Exam: Tips for Success](/mastering-the-ejpt-exam-tips-for-success): How to pass the eLearnSecurity eJPT exam with a 91% score: key concepts, realistic practice, thorough enumeration and time management on exam day. - [SegFault: Your Ultimate Cybersecurity Workspace πŸŒπŸ”’](/segfault-your-ultimate-cybersecurity-workspace): SegFault gives you a free root server in a virtual environment over SSH, with Kali tooling, VPN-routed egress, transparent Tor, port forwarding and proxies. - [Servers & Services Enumeration | eJPT](/servers-services-enumeration-ejpt): eJPT notes on server and service enumeration, covering SMB protocols, OS discovery, security modes and session enumeration with nmap scripts. - [SSTI From Input To RCE](/ssti-from-input-to-rce): Server-side template injection from first principles: how template engines work, where they break, and Jinja2 exploitation from input to RCE. - [Stop Guessing. Start Hunting. (The Roadmap)](/stop-guessing-start-hunting-the-roadmap): A path from beginner to paid bug bounty hunter: Linux and networking fundamentals, hands-on practice, structured training and private invites. - [System-Host Based Attacks | eJPT](/system-host-based-attacks-ejpt): eJPT notes on host-based attacks: Microsoft IIS WebDAV, brute forcing with Hydra, SMB exploitation with PsExec and EternalBlue, and WinRM access. - [The Bug Bounty Report Blueprint Triagers Don’t Ignore](/the-bug-bounty-report-blueprint-triagers-dont-ignore): A real vulnerability still gets rejected if the report fails to tell the story. The anatomy of a report triagers act on, section by section. - [The TrashCash | Turning Deleted Files Into Bounties](/the-trashcash-turning-deleted-files-into-bounties): TrashCash: restoring deleted files from Git history to recover the secrets developers thought they wiped. The biggest payouts aren't always payloads. - [The Ultimate SAL1 Review + Giveaway πŸ”₯ | Is TryHackMe Serious?](/the-ultimate-sal1-review-giveaway-is-tryhackme-serious): TryHackMe's Security Analyst Level 1 certification reviewed: the training path, the exam structure, and whether it is serious blue team training. - [Unveiling Hidden URLs - Web Enumeration with Hakrawler](/unveiling-hidden-urls-web-enumeration-with-hakrawler): Hakrawler crawls a target for subdomains, paths and other signals. Installing it via Go, Docker or apt, and using it to map a site's real attack surface. - [Amr Elsagaei - Videos](/videos): Recorded walkthroughs of web application attacks, from first recon to the written report. One bug on one real target, worked through start to finish. - [VPN? πŸ” DPN? 🌍 TOR? πŸ§…](/vpn-dpn-tor): VPNs, DPNs and Tor solve different privacy problems. How each one actually works, where the trade-offs are, and which to use for which threat model. - [Vulnerability Assessment | eJPT](/vulnerability-assessment-ejpt): eJPT notes on vulnerability assessment: nmap script scanning for Heartbleed (CVE-2014-0160), EternalBlue (CVE-2017-0143) and SSL cipher enumeration. - [Amr Elsagaei - Blog](/blog): Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 2](/blog/2): Page 2 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 3](/blog/3): Page 3 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 4](/blog/4): Page 4 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 5](/blog/5): Page 5 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 6](/blog/6): Page 6 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 7](/blog/7): Page 7 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be. - [Amr Elsagaei - Blog, page 8](/blog/8): Page 8 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.