Signal Acquired: Welcome to the Grid
Ilyas Salioui (TheCzar) opens a new home for offensive security research, bug bounty notes, and the occasional writeup.
// ARCHIVE// 05 ENTRIES
TRANSMISSIONS
Every post, newest first. No algorithm, no infinite scroll — just the archive.
2026
Cookie Tossing: Escalating Low-Impact XSS into Criticals
How a low-impact XSS or a controlled subdomain can become a critical account takeover through cookie tossing — cookie scoping, path precedence, attack patterns, and defenses.
2025
Stack Traces: Unveiling Attack Surface
How to find, trigger, and weaponize stack traces during black-box recon — from dorking and Shodan to malformed requests, framework fingerprinting, and exploitation paths.
Origin IP Discovery Techniques: How Attackers Bypass WAF Protections
A practical recon guide to finding a target's origin IP behind Cloudflare and other WAFs — DNS history, favicon hashes, Shodan, certificate matches, and verification.
Intigriti Monthly Challenge Writeup: JWT Abuse → Admin Panel → SSTI → RCE → Flag
A full Intigriti monthly challenge walkthrough: JWT none-algorithm abuse, admin panel access, stored XSS, SSTI in Jinja2, and RCE to the flag.