Subhi Alsyale

Hunt HTTP Request Smuggling (CL.TE, TE.CL, TE.TE, H2.CL, H2.TE, downgrade smuggling). Use when target is behind a reverse proxy / load balancer / CDN and you want to test for desync attacks that bypass front-end security controls.

中文简介正在准备中。当前显示原文说明。

Hunt vulnerabilities in LLM-powered applications — direct/indirect prompt injection, system prompt extraction, ASCII smuggling, RCE via code tools, agentic AI exploits (ASI01-ASI10), data exfiltration via response channels, IDOR in chat history, jailbreak chains, RAG poisoning. Use when target has a chatbot, AI assistant, copilot, or agentic AI features.

中文简介正在准备中。当前显示原文说明。

Mobile (Android) app recon and analysis — decompile APK, extract secrets, find hardcoded endpoints, exposed Firebase / AWS / API keys, deeplink abuse, intent vulnerabilities, exported components, WebView XSS, MobSF static analysis. Use when target's scope includes Android apps (.apk).

中文简介正在准备中。当前显示原文说明。

Hunt cloud misconfigurations exposed externally — open S3/GCS buckets, exposed IAM-tied EC2 metadata, Cognito misconfig, GitHub Actions secret leakage, exposed Kubernetes API, public Elastic / Kibana / Mongo, Firebase RTDB rules, weak AWS access keys discovered in JS/mobile. Use when leveraging leaked credentials or hunting cloud surface in scope.

中文简介正在准备中。当前显示原文说明。

Validate a bug bounty finding before writing a report — the 7-Question Gate, 4 pre-submission gates, always-rejected list, conditional chain table, CVSS 3.1 quick reference, and severity decision guide. Use BEFORE writing any report to avoid N/A and low quality submissions.

中文简介正在准备中。当前显示原文说明。

Write production-grade HackerOne reports — title formula, impact-led writing, CVSS 3.1 scoring, complete PoC formatting, attached files, and submission etiquette. Use AFTER triage-validation passes and you're ready to submit on HackerOne.

中文简介正在准备中。当前显示原文说明。