Security Researcher & Bug Bounty Hunter
YesWeHack · Intigriti
Chasing business logic, access control, and the bugs scanners miss. Occasionally the internet says thank you.
// OPERATOR PROFILE
ILYAS SALIOUI
Breaker of web apps · collector of stack traces · professional rabbit-hole diver.
I'm Ilyas Salioui — TheCzar if you've seen the handle. I'm a cybersecurity engineering student in Rabat who spends an unreasonable amount of time asking web apps uncomfortable questions.
I hunt bugs on YesWeHack and Intigriti. Some pay. The interesting ones end up here. A few made it into a hall of fame; the rest made it into this blog.
When I'm not hunting, I'm building recon automation, breaking my own labs, or explaining why "it's just a self-XSS" is not the end of the conversation.
Field notes
Independent Researcher & Technical Writer
@TheCzar
Recon automation, weird edge cases, and writeups on cookie tossing, origin IP discovery, and stack traces.
Selected research
Long-form writeups, imported from Medium. Some of them even have diagrams.
Cookie Tossing: Escalating Low-Impact XSS into Criticals
How a low-impact XSS or a controlled subdomain can become a critical account takeover through cookie tossing — cookie scoping, path precedence, attack patterns, and defenses.
Stack Traces: Unveiling Attack Surface
How to find, trigger, and weaponize stack traces during black-box recon — from dorking and Shodan to malformed requests, framework fingerprinting, and exploitation paths.
Origin IP Discovery Techniques: How Attackers Bypass WAF Protections
A practical recon guide to finding a target's origin IP behind Cloudflare and other WAFs — DNS history, favicon hashes, Shodan, certificate matches, and verification.
Intigriti Monthly Challenge Writeup: JWT Abuse → Admin Panel → SSTI → RCE → Flag
A full Intigriti monthly challenge walkthrough: JWT none-algorithm abuse, admin panel access, stored XSS, SSTI in Jinja2, and RCE to the flag.
Side quests
Moodle Assessment Logic Bypass (PoC)
JavaScript · DOM manipulation
A browser-console trick that convinced a quiz platform to grade itself. The writeup is on GitHub →
Permanent Student
TryHackMe · Hack The Box · PortSwigger
Always one room away from bedtime. Red teaming, web exploitation, and privilege escalation.
Origin story
INPT Rabat
Cybersecurity engineering · final year
Learning how the internet breaks and how to break it responsibly.
CPGE Rabat
Maths · physics · algorithms
Two years of learning to solve hard problems under pressure.
Baccalaureate
Physical sciences · honors
Loadout
Tools change; the urge to poke things doesn't.
- Burp Suite Pro
- Caido
- Nuclei
- FFuF
- Nmap
- Naabu
- httpx
- Katana
- Ghauri
- Metasploit
- Python
- Bash
- JavaScript
- Java
- SQL
- Linux / Kali
- Git
Paper trail
Certified in bug bounty, web pentesting, and the Cisco fundamentals. The paper trail: Wiz, TryHackMe, Cisco NetAcad.
Arabic native, English fluent, French professional, Spanish still negotiating.
Find the bug. Write it down. Help fix it.