Amr Elsagaei

About

I'm Amr Elsagaei, also known as AmrSec. I'm a security researcher, bug bounty hunter and developer.

I report vulnerabilities to some of the world's largest companies and work with their security teams to get them fixed.

On YouTube and here I break down what I find: the bugs, the tools and the process, so other hunters can use it.

Security vulnerabilities found and reported to the teams who own the systems, across companies of every size.

and 100+ more

Duplicates Are Part Of The Process
A duplicate is not a rejection. It is the one closure reason that confirms you found a real, in-scope, payable bug. Here is what to do when they stack up.
Cache Poisoning: The Cache You Can't Purge
Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing.
Client Side 03: DOM Clobbering
DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks.
Hunting WebSockets: Bugs Behind 101 Switching Protocols
Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking.
Auth for Hackers
Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover.
3 Bugs I Found One Hour Before Giving Up
A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour.

Walkthroughs, tooling and live hunting from the channel.

Duplicates Are Part Of The Process
Views32Duration11:25Published2026-10-20
Cache Poisoning | The Cache You Can't Purge
Views5.7KDuration32:20Published2026-09-15
Client Side 03: DOM Clobbering
Views1.1KDuration34:06Published2026-08-25
Hunting Websockets
Views3.7KDuration36:36Published2026-07-15
Auth For Hackers
Views8.8KDuration1:37:55Published2026-06-13
3 Bugs I Found One Hour Before Giving Up
Views4.6KDuration31:10Published2026-05-20
How i do recon in 2026?
Views13KDuration23:00Published2026-05-05
Client Side 02: ServiceWorker Bugs
Views1.1KDuration27:56Published2026-04-20
I Let AI Run My Recon Here's What It Found.
Views6.1KDuration19:30Published2026-04-10