---
title: "Amr Elsagaei - Blog, page 2"
description: "Page 2 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
canonical_url: "https://amrelsagaei.com/blog/2"
meta:
  "og:description": "Page 2 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
  "og:title": "Amr Elsagaei - Blog, page 2"
---

# Blog

Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.

- ## [AI Just Made Bug Bounty Way Easier](https://amrelsagaei.com/ai-just-made-bug-bounty-way-easier)

  Feeding an open-source target's own source code to an AI assistant, with a local and VPS setup, so you stop guessing how your input is handled.
- ## [Client Side 01: postMessage Bugs](https://amrelsagaei.com/client-side-01-postmessage-bugs)

  postMessage bugs sit unnoticed in checkout pages, auth flows and chat widgets. Origins, senders, receivers, sinks, and the mistakes that expose them.
- ## [SSTI From Input To RCE](https://amrelsagaei.com/ssti-from-input-to-rce)

  Server-side template injection from first principles: how template engines work, where they break, and Jinja2 exploitation from input to RCE.
- ## [The Bug Bounty Report Blueprint Triagers Don’t Ignore](https://amrelsagaei.com/the-bug-bounty-report-blueprint-triagers-dont-ignore)

  A real vulnerability still gets rejected if the report fails to tell the story. The anatomy of a report triagers act on, section by section.
- ## [GraphQL for Bug Bounty Hunters](https://amrelsagaei.com/graphql-for-bug-bounty-hunters)

  How GraphQL really works and why its flexibility is a goldmine: schemas, queries, mutations, fragments, and testing an endpoint like an attacker.
- ## [Deploy Your Next Hacking Lab in 30 Seconds](https://amrelsagaei.com/deploy-your-next-hacking-lab-in-30-seconds)

  Three ways to deploy a vulnerable web app lab: manual Docker commands, Docker Compose, and a visual Compose manager that removes the command line entirely.
- ## [3 Tricks to Hunt Faster in Bug Bounty](https://amrelsagaei.com/3-tricks-to-hunt-faster-in-bug-bounty)

  Three small workflow changes that remove friction from a hunt: proxy match-and-replace rules, repeatable workflows, and a fast note-taking system.
- ## [The TrashCash | Turning Deleted Files Into Bounties](https://amrelsagaei.com/the-trashcash-turning-deleted-files-into-bounties)

  TrashCash: restoring deleted files from Git history to recover the secrets developers thought they wiped. The biggest payouts aren't always payloads.
- ## [How I Found IDORs That Shouldn’t Exist](https://amrelsagaei.com/how-i-found-idors-that-shouldnt-exist)

  IDORs that survive modern access control: trailing slashes, path normalisation, double slashes and obfuscated paths, with testable examples.

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.