One Quote, 107 Tables, One Crit
A classic first-order SQLi in a legacy parameter, sqlmap, and 107 tables of very sensitive data. Target redacted.
SIGNAL ACQUIRED// ILYAS SALIOUI
THE CZAR
I break web apps for fun and, occasionally, profit. This is where I write down the interesting parts — recon, weird bugs, and the occasional 2 a.m. rabbit hole.
theczar@grid:~$ whoami
Ilyas Salioui — offensive security, mostly.
theczar@grid:~$ cat mission.txt
Find the bug. Write it down. Help fix it.
theczar@grid:~$ ls /transmissions
06 entries found. newest first.
theczar@grid:~$ cat links.txt
yeswehack / intigriti: theczar
theczar@grid:~$
//LATEST TRANSMISSIONS
VIEW ALL →The Bucket Said Yes: A Severity Plot Twist
A public-write S3 bucket, a harmless .txt PoC, and the classic "it is only Medium" plot twist.
Cookie Tossing: Escalating Low-Impact XSS into Criticals
How a low-impact XSS or a controlled subdomain can become a critical account takeover through cookie tossing — cookie scoping, path precedence, attack patterns, and defenses.
//CURRENT STATUS
FULL DOSSIER →N+1Bugs to find
99+Open tabs
24/7Recon mode
???Next target
// OPERATOR PROFILE
ILYAS SALIOUI
Cybersecurity engineering student, bug bounty hunter, and professional rabbit-hole diver. I write about the bugs that keep me up at night and the recon that finds them.
READ THE FULL DOSSIER →