---
title: "Amr Elsagaei - Blog, page 4"
description: "Page 4 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
canonical_url: "https://amrelsagaei.com/blog/4"
meta:
  "og:description": "Page 4 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
  "og:title": "Amr Elsagaei - Blog, page 4"
---

# Blog

Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.

- ## [JWT Analyzer in Caido - Built for Hackers](https://amrelsagaei.com/jwt-analyzer-in-caido-built-for-hackers)

  A Caido plugin for JWT work: decoding and inspecting tokens, breaking down their claims, and running built-in attack simulations without leaving the proxy.
- ## [How to Become a Successful Security Researcher | SecMeet 0x02](https://amrelsagaei.com/how-to-become-a-successful-security-researcher-secmeet-0x02)

  SecMeet 0x02 with James Kettle (albinowax) of PortSwigger on HTTP request smuggling, web cache poisoning, and finding techniques nobody has yet.
- ## [CVE-2025-32433 (Erlang/OTP SSH RCE vulnerability)](https://amrelsagaei.com/cve-2025-32433-erlang-otp-ssh-rce-vulnerability)

  CVE-2025-32433, unauthenticated RCE in the Erlang/OTP SSH implementation: full exploitation walkthrough plus network and host detection techniques.
- ## [JavaScript Analysis Masterclass - Part 2](https://amrelsagaei.com/javascript-analysis-masterclass-pt2)

  Static analysis finds endpoints and secrets; runtime analysis finds the bugs. Live debugging with DevTools, local overrides, logic flaws and DOM-based XSS.
- ## [JavaScript Analysis Masterclass - Part 1](https://amrelsagaei.com/javascript-analysis-masterclass-pt-1)

  Collecting a target's JavaScript with Burp, the Wayback Machine and the Archive.org CDX API, then analysing it statically for endpoints and secrets.
- ## [Inside the Mind of a $Million Bug Bounty Hunter | SecMeet 0x01](https://amrelsagaei.com/inside-the-mind-of-a-million-bug-bounty-hunter-secmeet-0x01)

  SecMeet 0x01 with Nikhil Shrivastava (niks), B-Sides Ahmedabad founder and Synack red teamer, on earning over a million dollars in bounties.
- ## [The Ultimate SAL1 Review + Giveaway 🔥 | Is TryHackMe Serious?](https://amrelsagaei.com/the-ultimate-sal1-review-giveaway-is-tryhackme-serious)

  TryHackMe's Security Analyst Level 1 certification reviewed: the training path, the exam structure, and whether it is serious blue team training.
- ## [Hacker vs. ChatGPT! Who Wins?](https://amrelsagaei.com/hacker-vs-chatgpt-who-wins)

  ChatGPT tested against real bug bounty challenges: analysing requests and responses, suggesting payloads, and whether AI can out-hunt a human.
- ## [Bug Bounty Hunting Methodology 2025](https://amrelsagaei.com/bug-bounty-hunting-methodology-2025)

  A streamlined bug bounty methodology for 2025 covering reconnaissance, enumeration and testing, from subdomain discovery through JavaScript analysis.

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.