Offensive security notes from Ilyas Salioui (TheCzar) — breaking web apps, chasing bugs, and automating recon.https://theczar.dev/en-ushttps://theczar.dev/blog/welcome-to-the-grid/https://theczar.dev/blog/welcome-to-the-grid/Ilyas Salioui (TheCzar) opens a new home for offensive security research, bug bounty notes, and the occasional writeup.Mon, 09 Nov 2026 00:00:00 GMThttps://theczar.dev/blog/cookie-tossing/https://theczar.dev/blog/cookie-tossing/How a low-impact XSS or a controlled subdomain can become a critical account takeover through cookie tossing — cookie scoping, path precedence, attack patterns, and defenses.Tue, 17 Feb 2026 00:00:00 GMThttps://theczar.dev/blog/stack-traces/https://theczar.dev/blog/stack-traces/How to find, trigger, and weaponize stack traces during black-box recon — from dorking and Shodan to malformed requests, framework fingerprinting, and exploitation paths.Wed, 31 Dec 2025 00:00:00 GMThttps://theczar.dev/blog/origin-ip-discovery/https://theczar.dev/blog/origin-ip-discovery/A practical recon guide to finding a target's origin IP behind Cloudflare and other WAFs — DNS history, favicon hashes, Shodan, certificate matches, and verification.Tue, 09 Dec 2025 00:00:00 GMThttps://theczar.dev/blog/intigriti-jwt-to-rce/https://theczar.dev/blog/intigriti-jwt-to-rce/A full Intigriti monthly challenge walkthrough: JWT none-algorithm abuse, admin panel access, stored XSS, SSTI in Jinja2, and RCE to the flag.Tue, 25 Nov 2025 00:00:00 GMT