LOG / 01 Independent security researchOnline as 0xAdham

breakingcodesince 13 ;)

Adham Mohammed
Web applications / Networks

Field notes on finding, understanding, and responsibly reporting the bugs that matter.

(01) The person behind the notes

Read the source.
Prove the impact.

I'm Adham Mohammed, known online as 0xAdham, a security researcher interested in offensive security.

I hunt bugs, trace root causes, and write up what matters in ways that are useful to both technical readers and the people who fix the issue.

More about me →

(02) Topics / focus

The work, in four steps.

01 / MAP

Recon

Map the target, endpoints, and parameters within scope and before testing.

02 / LEARN

Understand

Study roles, state, trust boundaries, and the assumptions behind the application.

03 / PROVE

Research

Test the weak assumption, connect related issues, and show why the finding matters.

04 / SHARE

Report

Write a concise, reproducible report, then share the useful lessons responsibly.

(03) From the research record

Vulnerability Research.

Krayin CRM / Vulnerability Research

Three CVEs disclosed. Fixed in 2.2.7.

Discovered CVE-2026-112286 (Quote IDOR, High 7.1), CVE-2026-112287 (Mail BOLA, High 8.3), and CVE-2026-112288 (SSRF filter bypass via DNS rebinding) in open-source Laravel CRM. Reported responsibly and documented in a full writeup.

Read the full Krayin CRM writeup →

(04) Writing / archive

Latest field notes.

Read all notes →

Oct 19, 2026

A Patch Is Not a Fix: Chaining Krayin CRM's Blind Spots

A white-box review of Krayin CRM turned up three CVEs: an incomplete-fix IDOR in Quote, a write-path BOLA in Mail, and a DNS-rebinding SSRF filter bypass. All were disclosed responsibly.

Responsible disclosureWeb security research Oct 07, 2026

API Hacking for Beginners: Breaking REST and GraphQL

Hands-on guide to discovering hidden endpoints, BOLA/IDOR vulnerabilities, mass assignment, and GraphQL introspection flaws in modern web APIs.

Bug bountyWeb security research Aug 17, 2026

0xVoid: Loopback Lens

SSRF filter bypass via decimal IP representation and redirect chaining to access internal cloud metadata and services.

CTFWeb security research Jul 31, 2026

EYCC: Mall Albostan

Full attack chain: error-based SQLi to extract JWT secret, forgery to admin portal, file upload filter bypass, and arbitrary command execution.

CTFWeb security research

(05) Responsible disclosure

Breaking things.
Responsibly.

Testing belongs inside the program's scope. A useful disclosure is careful, reproducible, and written to help the owner remediate, not to expose people to unnecessary risk.

My goal is simple: find the bug, explain the root cause, and leave the target stronger than it was before.