---
title: "Amr Elsagaei - Blog"
description: "Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
canonical_url: "https://amrelsagaei.com/blog"
meta:
  "og:description": "Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
  "og:title": "Amr Elsagaei - Blog"
---

# Blog

Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.

- ## [Cache Poisoning: The Cache You Can't Purge](https://amrelsagaei.com/cache-poisoning-the-cache-you-cant-purge)

  Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing.
- ## [Client Side 03: DOM Clobbering](https://amrelsagaei.com/client-side-03-dom-clobbering)

  DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks.
- ## [Hunting WebSockets: Bugs Behind 101 Switching Protocols](https://amrelsagaei.com/hunting-websockets-bugs-behind-101-switching-protocols)

  Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking.
- ## [Auth for Hackers](https://amrelsagaei.com/auth-for-hackers)

  Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover.
- ## [3 Bugs I Found One Hour Before Giving Up](https://amrelsagaei.com/3-bugs-i-found-one-hour-before-giving-up)

  A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour.
- ## [How I Do Recon in 2026?](https://amrelsagaei.com/how-i-do-recon-in-2026)

  The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does.
- ## [Client Side 02: ServiceWorker Bugs](https://amrelsagaei.com/client-side-02-serviceworker-bugs)

  A Service Worker registered through a vulnerability lives in the victim's browser and outlives the patch. The lifecycle, the persistence, the hunt.
- ## [I Let AI Run My Recon Here's What It Found.](https://amrelsagaei.com/i-let-ai-run-my-recon-heres-what-it-found)

  Recon eats time. What happened when Penligent was pointed at a target and left to map the attack surface, validate findings and produce a report unattended.
- ## [Claude Code For Hackers](https://amrelsagaei.com/claude-code-for-hackers)

  Claude Code is everywhere in development, almost nowhere in security. Setting it up for hacking: project context, permissions, skills, real workflows.

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.