Why write it down?
I'm Adham Mohammed, known online as 0xAdham. I work across offensive security research and vulnerability discovery, with a focus on web applications and networks.
I play web and reversing CTFs with G4mra and hunt bugs on HackerOne and Bugcrowd. When I find something, I want the report to be clear enough that the next person can reproduce it, so the owner can fix it.
A shell is just the start. The report is what helps turn a finding into a fix.
The process
- Recon: map the scope, subdomains, endpoints, and parameters before touching anything.
- Understand: learn the roles, state, trust boundaries, and assumptions in the application.
- Attack: test a weak assumption safely, connect related issues when justified, and prove the impact.
- Report: write steps a triager can reproduce quickly, then share lessons responsibly.
Outside the articles
Practice and competition are part of the work. The supplied portfolio links the following profiles: