---
title: "Amr Elsagaei - Blog, page 5"
description: "Page 5 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
canonical_url: "https://amrelsagaei.com/blog/5"
meta:
  "og:description": "Page 5 of the archive. Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be."
  "og:title": "Amr Elsagaei - Blog, page 5"
---

# Blog

Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.

- ## [API Penetration Testing🔐 Part 2](https://amrelsagaei.com/api-penetration-testing-pt2)

  Reverse engineering APIs with Postman and mitmproxy2swagger, finding excessive data exposure, and scanning for weaknesses. Part two of API testing.
- ## [API Penetration Testing 🔐](https://amrelsagaei.com/api-penetration-testing-pt1)

  Building an API penetration testing environment: Kali Linux, Burp Suite, OWASP ZAP, FoxyProxy and labs built for finding hidden API endpoints.
- ## [FUZZ Everything! 📂](https://amrelsagaei.com/fuzz-everything)

  How to use ffuf to fuzz everything: hidden directories, file extensions, API endpoints, parameters and backup files that normal recon never surfaces.
- ## [VPN? 🔐 DPN? 🌍 TOR? 🧅](https://amrelsagaei.com/vpn-dpn-tor)

  VPNs, DPNs and Tor solve different privacy problems. How each one actually works, where the trade-offs are, and which to use for which threat model.
- ## [$1 Bug Bounty](https://amrelsagaei.com/1-bug-bounty)

  Why low-hanging fruit is the right place to start in bug bounty, the common easy wins to look for, and how small findings build toward bigger ones.
- ## [Master Code Injection Attacks, Ethically! 🔐](https://amrelsagaei.com/master-code-injection-attacks-ethically-1)

  Two hands-on code injection labs: injecting OS commands in a PortSwigger lab, then escalating to a PHP reverse shell in bWAPP automated with Commix.
- ## [Build Your Private Local AI Server Right Now!](https://amrelsagaei.com/build-your-private-local-ai-server-right-now)

  Run large language models on your own hardware: WSL and Ubuntu, Ollama setup, adding models, and monitoring GPU performance on a fully private server.
- ## [🚀 Get Your First Zero-Day RIGHT NOW!](https://amrelsagaei.com/get-your-first-zero-day-right-now)

  Get started finding zero-days in binary software and web applications, from setting up VMware to fuzzing real targets with AFL.
- ## [CSRF - Automate Vulnerability Testing 🛡️🔍](https://amrelsagaei.com/csrf-automate-vulnerability-testing)

  Automate cross-site request forgery testing with Burp Suite and Project Forgery, a Python tool for generating and validating CSRF proof-of-concepts at scale.

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.