Cache Poisoning: The Cache You Can't Purge
Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing.
About
I'm Amr Elsagaei, also known as AmrSec. I'm a security researcher, bug bounty hunter and developer.
I report vulnerabilities to some of the world's largest companies and work with their security teams to get them fixed.
On YouTube and here I break down what I find: the bugs, the tools and the process, so other hunters can use it.
Companies I Have Hacked
Security vulnerabilities found and reported to the teams who own the systems, across companies of every size.
- Amazon
- Asana
- Contentsquare
- HackerOne
- Hostinger
- Meta
- Monash University
- Netflix
- Notion
- OpenAI
- Stripe
and 100+ more
Latest Articles
Client Side 03: DOM Clobbering
DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks.
Hunting WebSockets: Bugs Behind 101 Switching Protocols
Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking.
Auth for Hackers
Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover.
3 Bugs I Found One Hour Before Giving Up
A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour.
How I Do Recon in 2026?
The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does.
Watch on YouTube
Walkthroughs, tooling and live hunting from the channel.
Cache Poisoning | The Cache You Can't Purge
Views5.7KDurationPublished
Client Side 03: DOM Clobbering
Views1.1KDurationPublished
Hunting Websockets
Views3.6KDurationPublished
Auth For Hackers
Views8.6KDurationPublished
3 Bugs I Found One Hour Before Giving Up
Views4.6KDurationPublished
How i do recon in 2026?
Views12.8KDurationPublished
Client Side 02: ServiceWorker Bugs
Views1.1KDurationPublished
I Let AI Run My Recon Here's What It Found.
Views6.1KDurationPublished
Claude Code For Hackers
Views35KDurationPublished
Partners
Trusted by industry teams
I work with companies around the world on security research, bug bounty and technical consulting.