[{"content":"Good Day!\nI hope you are doing well. Long time not writing anything… right? Well I am back again with two finding I have discoverd recently at some private program at Hackerone. I hope at the end you will going to learn something new :)\nالحمدلله و الصلاة و السلام على سيدنا محمد\nاللهم انصر اخواننا في فلسطين\nIn fact the bugs I am going to talk about not that much of complexity, the first bug is actually a simple IDOR with a High impact, but don\u0026amp;rsquo;t worry… I am not here to explain the IDOR. We …","date":"2025-08-02","permalink":"/posts/be-patient-keep-it-simple/","summary":"Good Day!\nI hope you are doing well. Long time not writing anything… right? Well I am back again with two finding I have discoverd recently at some private program at Hackerone. I hope at the end you …","tags":["bug-bounty","idor","access-control","web-security"],"title":"Be Patient and Keep it Simple, The Bug is There"},{"content":"Good day! I hope you\u0026amp;rsquo;re doing well.\nIn bug bounty, never say: \u0026amp;ldquo;This idea is silly to try; the result will be nothing.\u0026amp;rdquo; Bug bounty hunting is essentially black-box testing — you have to keep poking at your target until something turns up.\nالحمدلله والصلاة والسلام على سيدنا محمد اللهم انصر إخواننا في فلسطين\nThe target I was hunting already had several bugs I\u0026amp;rsquo;d found and reported before. I used to tell myself, \u0026amp;ldquo;I know everything about this website. If something new …","date":"2024-09-09","permalink":"/posts/hunting-hidden-api-endpoints-katana-hakrawler/","summary":"Good day! I hope you\u0026rsquo;re doing well.\nIn bug bounty, never say: \u0026ldquo;This idea is silly to try; the result will be nothing.\u0026rdquo; Bug bounty hunting is essentially black-box testing — you have …","tags":["bug-bounty","recon","idor","api","web-security"],"title":"Hunting for Hidden API Endpoints Using Katana and Hakrawler"},{"content":"Good morning!\nI hope you\u0026amp;rsquo;re doing well. Thank you for joining me today. Probably you\u0026amp;rsquo;re here because of the attractive title.I mean who doesn\u0026amp;rsquo;t want to make easy money in just a couple of hours every day? Especially if you live in the Middle East, India, or Africa. A reward with three or four digits can really make a difference.\nHowever, I\u0026amp;rsquo;m here to tell you that I didn\u0026amp;rsquo;t earn any easy money sadly. I wanted to talk about something I\u0026amp;rsquo;ve been thinking about a …","date":"2024-04-23","permalink":"/posts/how-easy-i-made-money/","summary":"Good morning!\nI hope you\u0026rsquo;re doing well. Thank you for joining me today. Probably you\u0026rsquo;re here because of the attractive title.I mean who doesn\u0026rsquo;t want to make easy money in just a …","tags":["bug-bounty","mindset","career"],"title":"How easy I made $$$$"},{"content":"Good day! I hope you\u0026amp;rsquo;re doing well.\nI\u0026amp;rsquo;ve been studying web cache vulnerabilities, so here\u0026amp;rsquo;s a shortcut through all the different techniques I\u0026amp;rsquo;ve come across so far. I\u0026amp;rsquo;ll assume you already have a basic understanding of web caching concepts.\nالحمدلله والصلاة والسلام على رسول الله\nObviously, the cache itself isn\u0026amp;rsquo;t a vulnerability. What makes web applications vulnerable to web cache attacks is either chaining them with other bugs (most often XSS) or abusing …","date":"2024-04-05","permalink":"/posts/web-cache-poisoning-and-deception/","summary":"Good day! I hope you\u0026rsquo;re doing well.\nI\u0026rsquo;ve been studying web cache vulnerabilities, so here\u0026rsquo;s a shortcut through all the different techniques I\u0026rsquo;ve come across so far. I\u0026rsquo;ll …","tags":["bug-bounty","web-cache-poisoning","web-security","dos","xss"],"title":"Don't Trust the Cache: Exposing Web Cache Poisoning and Deception Vulnerabilities"},{"content":"Good Day!\nI hope you are doing well. Today, I am going to share a Broken Access Control (BAC) bug that I found a while ago in one of the HackerOne private programs. The website I was testing on is a popular chess platform, but I\u0026amp;rsquo;ll refer to it as redacted.com :)\nالحمدلله و الصلاة و السلام على سيدنا محمد\nInitially, I tested the platform using my main account instead of creating a new one. I spent two days testing, but I only received informative and \u0026amp;ldquo;N/A\u0026amp;rdquo; responses from the …","date":"2024-03-07","permalink":"/posts/click-intercept-hack-access-control/","summary":"Good Day!\nI hope you are doing well. Today, I am going to share a Broken Access Control (BAC) bug that I found a while ago in one of the HackerOne private programs. The website I was testing on is a …","tags":["bug-bounty","access-control","burp-suite","web-security"],"title":"Click, Intercept, Hack: Checkmate on Access Control Vulnerability"},{"content":"Good Day!\nRemember when I first started bug hunting? I used to think looking into JS files was unnecessary — would I really find bugs in files everyone can see? But after some reading, I realized I was missing out on a lot. So I want to share some resources, tools, tutorials, and other ways to dig deeper into JavaScript analysis.\nResources and Tools Diving into JS files can be very rewarding. It lets you uncover hidden functionality, credentials, API keys, paths, and more — especially valuable …","date":"2024-01-10","permalink":"/posts/javascript-for-bug-hunting/","summary":"Good Day!\nRemember when I first started bug hunting? I used to think looking into JS files was unnecessary — would I really find bugs in files everyone can see? But after some reading, I realized I …","tags":["bug-bounty","javascript","recon","web-security"],"title":"Bugs \u0026 JS: A Closer Look at JavaScript for Successful Bug Hunting"},{"content":"Good day! I hope you are well.\nI\u0026amp;rsquo;ll get straight into a couple of bugs I found a while ago in a private program on HackerOne. Let\u0026amp;rsquo;s call it redacted.com :)\nThe program resolves any subdomain (anything.redacted.com) to the main login page (redacted.com/login). That behavior was new to me, so I initially thought subdomain-gathering tools would be useless here.\nI started with a simple Shodan dork:\nssl:redacted.com Plenty of results came up, until I found an IP resolving to the subdomain …","date":"2023-12-19","permalink":"/posts/how-one-bug-scored-me-double-rewards/","summary":"Good day! I hope you are well.\nI\u0026rsquo;ll get straight into a couple of bugs I found a while ago in a private program on HackerOne. Let\u0026rsquo;s call it redacted.com :)\nThe program resolves any …","tags":["bug-bounty","idor","recon","web-security"],"title":"How One Bug Scored Me Double Rewards!"}]