https://anashamidi.com/ Blog über Offensive Security: Bug Bounty, Penetration Testing, Write-ups, Tooling-Notizen und ausgewählte Security-News. Hugo de Anas Hamidi Anas Hamidi 2026 Anas Hamidi Sat, 05 Sep 2026 00:00:00 +0000 https://anashamidi.com/en/posts/bug-bounty-tools-that-actually-work/ Sat, 05 Sep 2026 00:00:00 +0000 https://anashamidi.com/en/posts/bug-bounty-tools-that-actually-work/ A few tools I reach for every day in my bug bounty workflow: httpx, notify, anew, Param Miner, hakrawler, jq/cut/awk, Logger++ and GitHub recon, with the exact flags I use. bug-bounty recon tools automation web-security https://anashamidi.com/en/posts/be-patient-keep-it-simple/ Sat, 02 Aug 2025 00:00:00 +0000 https://anashamidi.com/en/posts/be-patient-keep-it-simple/ Two simple but high-impact findings, and the lessons that led me to them. bug-bounty idor access-control web-security https://anashamidi.com/en/posts/hunting-hidden-api-endpoints-katana-hakrawler/ Mon, 09 Sep 2024 00:00:00 +0000 https://anashamidi.com/en/posts/hunting-hidden-api-endpoints-katana-hakrawler/ Crawling a target I thought I knew — with Katana, hakrawler, waybackurls, and unfurl — surfaced a hidden /HelpApi/ endpoint and an IDOR leaking users' PII. bug-bounty recon idor api web-security https://anashamidi.com/en/posts/how-easy-i-made-money/ Tue, 23 Apr 2024 00:00:00 +0000 https://anashamidi.com/en/posts/how-easy-i-made-money/ A reality check on bug bounty and the myth of easy money. bug-bounty mindset career https://anashamidi.com/en/posts/web-cache-poisoning-and-deception/ Fri, 05 Apr 2024 00:00:00 +0000 https://anashamidi.com/en/posts/web-cache-poisoning-and-deception/ A field guide to web cache attacks — from CP-DoS tricks (oversize headers, meta characters, method override, unkeyed ports, redirect DoS) to poisoning with XSS payloads and web cache deception via path confusion. bug-bounty web-cache-poisoning web-security dos xss https://anashamidi.com/en/posts/click-intercept-hack-access-control/ Thu, 07 Mar 2024 00:00:00 +0000 https://anashamidi.com/en/posts/click-intercept-hack-access-control/ A Broken Access Control bug on a chess platform, via request interception and cookie swapping. bug-bounty access-control burp-suite web-security https://anashamidi.com/en/posts/javascript-for-bug-hunting/ Wed, 10 Jan 2024 00:00:00 +0000 https://anashamidi.com/en/posts/javascript-for-bug-hunting/ Why JavaScript files are a goldmine for bug hunters — the tools (JSleak, JSecret, jsluice), the workflow, and the resources I use to dig secrets, endpoints, and client-side bugs out of JS. bug-bounty javascript recon web-security https://anashamidi.com/en/posts/how-one-bug-scored-me-double-rewards/ Tue, 19 Dec 2023 00:00:00 +0000 https://anashamidi.com/en/posts/how-one-bug-scored-me-double-rewards/ A forgotten subdomain, a Shodan dork, and a single PUT request — how one overlooked endpoint led to an information disclosure and then an IDOR into users' video session data. bug-bounty idor recon web-security