# Sec-88

## Sec-88

- [Whoami](https://sallam.gitbook.io/sec-88/readme.md): Enjoy it ?  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Methodologies - Checklists](https://sallam.gitbook.io/sec-88/methodologies-checklists.md)
- [LLM Hacking Checklist](https://sallam.gitbook.io/sec-88/methodologies-checklists/llm-hacking-checklist.md)
- [Industry Based Web Checklist](https://sallam.gitbook.io/sec-88/methodologies-checklists/industry-based-web-checklist.md)
- [Web Services Based Checklist](https://sallam.gitbook.io/sec-88/methodologies-checklists/web-services-based-checklist.md)
- [Features Abuse CheckList](https://sallam.gitbook.io/sec-88/methodologies-checklists/features-abuse-checklist.md)
- [Android App Pentesting Checklist](https://sallam.gitbook.io/sec-88/methodologies-checklists/android-app-pentesting-checklist.md)
- [Hunting Methodology](https://sallam.gitbook.io/sec-88/methodologies-checklists/hunting-methodology.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Web Bug Based Checklist](https://sallam.gitbook.io/sec-88/methodologies-checklists/web-bug-based-checklist.md)
- [Web-AppSec](https://sallam.gitbook.io/sec-88/web-appsec.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Industry Based Checklist](https://sallam.gitbook.io/sec-88/web-appsec/industry-based-checklist.md)
- [Testing Financially-Oriented WepApps](https://sallam.gitbook.io/sec-88/web-appsec/industry-based-checklist/testing-financially-oriented-wepapps.md)
- [Testing localization - Translation WebApps](https://sallam.gitbook.io/sec-88/web-appsec/industry-based-checklist/testing-localization-translation-webapps.md)
- [Services Based Pentest Checklist](https://sallam.gitbook.io/sec-88/web-appsec/services-based-pentest-checklist.md)
- [Features Abuse Checklist](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse.md): Methodology to test features and pages that are very common
- [2FA](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/2fa.md)
- [Ban Feature](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/ban-feature.md)
- [CAPTCHA](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/captcha.md)
- [Commenting](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/commenting.md)
- [Contact us](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/contact-us.md)
- [File-Upload](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/file-upload.md)
- [Inviting Feature](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/inviting.md)
- [Messaging Features](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/messaging-features.md)
- [Money-Related Features](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/money-related-features.md): Premium...........Paywall Bypass....refund....etc
- [Newsletter](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/newsletter.md)
- [Email Change](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/email-change.md)
- [Password Change](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/password-change.md)
- [Change Name Feature](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/change-name-feature.md)
- [Change Phone Numbers](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/change-phone-numbers.md)
- [Logout Feature](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/logout-feature.md)
- [Registration](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/registration.md)
- [Reset Password](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/reset-password.md): Password Reset Security testing Checklist
- [Review](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/review.md)
- [Rich Editor/Text](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/rich-editor-text.md)
- [Social Sharing](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/social-sharing.md)
- [Addresses Management](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/billing-shipping-address-management.md)
- [Integrations - Webhooks](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/integrations-webhooks.md)
- [API Key Management](https://sallam.gitbook.io/sec-88/web-appsec/features-abuse/api-key-management.md)
- [Reconnaissance](https://sallam.gitbook.io/sec-88/web-appsec/reconnaissance.md)
- [Subdomain Enumeration](https://sallam.gitbook.io/sec-88/web-appsec/reconnaissance/web-app-security.md): Deep Subdomain Enumeration Notes
- [Dorking](https://sallam.gitbook.io/sec-88/web-appsec/reconnaissance/information-disclosure.md): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- [Fingerprinting](https://sallam.gitbook.io/sec-88/web-appsec/reconnaissance/fingerprinting.md)
- [Attacking Organizations with big scopes](https://sallam.gitbook.io/sec-88/web-appsec/reconnaissance/attacking-organizations-with-big-scopes.md): https://www.youtube.com/watch?v=vFk0XtHfuSg
- [Improper Authentication](https://sallam.gitbook.io/sec-88/web-appsec/improper-authentication.md)
- [JWT Security](https://sallam.gitbook.io/sec-88/web-appsec/improper-authentication/jwt-security.md)
- [SAML Authentication](https://sallam.gitbook.io/sec-88/web-appsec/improper-authentication/saml-authentication.md)
- [OAUTH Misconfigurations](https://sallam.gitbook.io/sec-88/web-appsec/oauth-misconfigurations.md)
- [OAuth 2.0 Basics](https://sallam.gitbook.io/sec-88/web-appsec/oauth-misconfigurations/oauth-2.0-basics.md)
- [OAUTH Misconfigurations](https://sallam.gitbook.io/sec-88/web-appsec/oauth-misconfigurations/oauth-to-ato.md)
- [Custom SSO Logins](https://sallam.gitbook.io/sec-88/web-appsec/oauth-misconfigurations/custom-sso-logins.md)
- [Broken Access Control](https://sallam.gitbook.io/sec-88/web-appsec/broken-access-control.md)
- [Insecure Direct Object References (IDOR)](https://sallam.gitbook.io/sec-88/web-appsec/broken-access-control/insecure-direct-object-references-idor.md): CWE-639: Authorization Bypass Through User-Controlled Key
- [403 Bypass](https://sallam.gitbook.io/sec-88/web-appsec/broken-access-control/403-bypass.md)
- [XSS-HTML Injection](https://sallam.gitbook.io/sec-88/web-appsec/xss_html-injection.md)
- [Self-XSS Bypass](https://sallam.gitbook.io/sec-88/web-appsec/xss_html-injection/self-xss-bypass.md)
- [WEB3 RoadMap By Co-Founder of SolidityScan](https://sallam.gitbook.io/sec-88/web-appsec/web3-roadmap-by-co-founder-of-solidityscan.md)
- [Auth0 Misconfigurations](https://sallam.gitbook.io/sec-88/web-appsec/auth0-misconfigurations.md)
- [Broken Link Injection](https://sallam.gitbook.io/sec-88/web-appsec/broken-link-injection.md)
- [Command Injection](https://sallam.gitbook.io/sec-88/web-appsec/command-injection.md)
- [CORS](https://sallam.gitbook.io/sec-88/web-appsec/cors.md): CWE-346: Origin Validation Error
- [CRLF](https://sallam.gitbook.io/sec-88/web-appsec/crlf.md): CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
- [CSRF](https://sallam.gitbook.io/sec-88/web-appsec/csrf.md): CWE-352: Cross-Site Request Forgery (CSRF)
- [Host Header Attacks](https://sallam.gitbook.io/sec-88/web-appsec/host-header-injection.md): CWE-644: Improper Neutralization of HTTP Headers
- [HTTP request smuggling](https://sallam.gitbook.io/sec-88/web-appsec/http-request-smuggling.md)
- [JSON Request Testing](https://sallam.gitbook.io/sec-88/web-appsec/json-request-testing.md)
- [LFI](https://sallam.gitbook.io/sec-88/web-appsec/lfi.md): CWE-23: Relative Path Traversal
- [LFI to RCE](https://sallam.gitbook.io/sec-88/web-appsec/lfi/lfi-to-rce.md)
- [No Rate Limit](https://sallam.gitbook.io/sec-88/web-appsec/no-rate-limit.md): CWE-400: Uncontrolled Resource Consumption
- [Parameters Manual Testing](https://sallam.gitbook.io/sec-88/web-appsec/parameters-manual-testing.md)
- [Open Redirect](https://sallam.gitbook.io/sec-88/web-appsec/open-redirect.md)
- [Registration & Takeover Bugs](https://sallam.gitbook.io/sec-88/web-appsec/registration-and-takeover-bugs.md): ( Credits: HackTricks )
- [Remote Code Execution (RCE)](https://sallam.gitbook.io/sec-88/web-appsec/remote-code-execution-rce.md)
- [Session Fixation](https://sallam.gitbook.io/sec-88/web-appsec/session-fixation.md): CWE-384: Session Fixation
- [SQL Injection](https://sallam.gitbook.io/sec-88/web-appsec/sql-injection.md): CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- [SQL To RCE](https://sallam.gitbook.io/sec-88/web-appsec/sql-injection/sql-to-rce.md)
- [SSRF](https://sallam.gitbook.io/sec-88/web-appsec/ssrf.md): CWE-918: Server-Side Request Forgery (SSRF)
- [SSTI](https://sallam.gitbook.io/sec-88/web-appsec/ssti.md): CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
- [Subdomain Takeover](https://sallam.gitbook.io/sec-88/web-appsec/subdomain-takeover.md)
- [Web Caching Vulnerabilities](https://sallam.gitbook.io/sec-88/web-appsec/wcd-wcp.md): CWE-524: Use of Cache Containing Sensitive Information
- [WebSockets](https://sallam.gitbook.io/sec-88/web-appsec/websockets.md)
- [XXE](https://sallam.gitbook.io/sec-88/web-appsec/xxe.md): CWE-611: Improper Restriction of XML External Entity Reference
- [XXE to RCE](https://sallam.gitbook.io/sec-88/web-appsec/xxe/xxe-to-rce.md)
- [Cookie Based Attacks](https://sallam.gitbook.io/sec-88/web-appsec/cookie-based-attacks.md)
- [CMS](https://sallam.gitbook.io/sec-88/web-appsec/cms.md)
- [AEM \[Adobe CMS\]](https://sallam.gitbook.io/sec-88/web-appsec/cms/aem-adobe-cms.md)
- [XSSI (Cross Site Script Inclusion)](https://sallam.gitbook.io/sec-88/web-appsec/xssi-cross-site-script-inclusion.md)
- [NoSQL injection](https://sallam.gitbook.io/sec-88/web-appsec/nosql-injection.md)
- [Local VS Remote Session Fixation](https://sallam.gitbook.io/sec-88/web-appsec/local-vs-remote-session-fixation.md)
- [Protection](https://sallam.gitbook.io/sec-88/web-appsec/protection.md)
- [Security Mechanisms for Websites](https://sallam.gitbook.io/sec-88/web-appsec/protection/security-mechanisms-for-websites.md)
- [Cookie Flags](https://sallam.gitbook.io/sec-88/web-appsec/protection/cookie-flags.md): https://www.invicti.com/white-papers/security-cookies-whitepaper/
- [SameSite Cookie Restrictions](https://sallam.gitbook.io/sec-88/web-appsec/protection/bypassing-samesite-cookie-restrictions.md): https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions
- [Same-origin policy (SOP)](https://sallam.gitbook.io/sec-88/web-appsec/protection/same-origin-policy-sop.md)
- [CSP](https://sallam.gitbook.io/sec-88/web-appsec/protection/csp.md)
- [Hacking IIS Applications](https://sallam.gitbook.io/sec-88/web-appsec/hacking-iis-applications.md)
- [Dependency Confusion](https://sallam.gitbook.io/sec-88/web-appsec/dependency-confusion.md)
- [Attacking Secondary Context](https://sallam.gitbook.io/sec-88/web-appsec/attacking-secondary-context.md)
- [Hacking Web Sockets](https://sallam.gitbook.io/sec-88/web-appsec/hacking-web-sockets.md)
- [IDN Homograph Attack](https://sallam.gitbook.io/sec-88/web-appsec/idn-homograph-attack.md)
- [DNS Rebinding Attack](https://sallam.gitbook.io/sec-88/web-appsec/dns-rebinding-attack.md)
- [Bypass URL Filtration](https://sallam.gitbook.io/sec-88/web-appsec/bypass-url-filtration.md)
- [Cross-Site Path Traversal (CSPT)](https://sallam.gitbook.io/sec-88/web-appsec/cross-site-path-traversal-cspt.md): CWE-35: Path Traversal
- [PostMessage Security](https://sallam.gitbook.io/sec-88/web-appsec/postmessage-security.md)
- [Prototype Pollution](https://sallam.gitbook.io/sec-88/web-appsec/prototype-pollution.md)
- [Client-Side Prototype Pollution](https://sallam.gitbook.io/sec-88/web-appsec/prototype-pollution/client-side-prototype-pollution.md)
- [Server-Side prototype pollution](https://sallam.gitbook.io/sec-88/web-appsec/prototype-pollution/server-side-prototype-pollution.md)
- [Tools-Extensions-Bookmarks](https://sallam.gitbook.io/sec-88/web-appsec/tools-extensions-and-softwares.md)
- [WAF Bypassing Techniques](https://sallam.gitbook.io/sec-88/web-appsec/waf-bypassing-techniques.md)
- [SSL/TLS Certificate Lifecycle](https://sallam.gitbook.io/sec-88/web-appsec/ssl-tls-certificate-lifecycle.md)
- [Serialization in .NET](https://sallam.gitbook.io/sec-88/web-appsec/serialization-in-.net.md)
- [Client-Side Attacks](https://sallam.gitbook.io/sec-88/web-appsec/client-side-attacks.md)
- [JavaScript Analysis](https://sallam.gitbook.io/sec-88/web-appsec/client-side-attacks/javascript-analysis.md)
- [Bug Bounty Platforms/Programs](https://sallam.gitbook.io/sec-88/web-appsec/bug-bounty-platforms-programs.md)
- [DNS Dangling / NS Takeover](https://sallam.gitbook.io/sec-88/web-appsec/dns-dangling-ns-takeover.md)
- [X-Correlation Injection](https://sallam.gitbook.io/sec-88/web-appsec/x-correlation-injection.md)
- [DoS - Exploiting WAF Request Size Limits](https://sallam.gitbook.io/sec-88/web-appsec/dos-exploiting-waf-request-size-limits.md)
- [Next.js middleware CP - DOS](https://sallam.gitbook.io/sec-88/web-appsec/next.js-middleware-cp-dos.md)
- [Cache Poisoning Test Plan for Next.js](https://sallam.gitbook.io/sec-88/web-appsec/cache-poisoning-test-plan-for-next.js.md)
- [Nuxt CP - DOS](https://sallam.gitbook.io/sec-88/web-appsec/nuxt-cp-dos.md)
- [Next.js Middleware Bypass](https://sallam.gitbook.io/sec-88/web-appsec/next.js-middleware-bypass.md)
- [Exploiting Parser Flaws for Access Bypasses](https://sallam.gitbook.io/sec-88/web-appsec/exploiting-parser-flaws-for-access-bypasses.md)
- [Session Puzzling Attack](https://sallam.gitbook.io/sec-88/web-appsec/session-puzzling-attack.md)
- [ASP.NET Security Testing](https://sallam.gitbook.io/sec-88/web-appsec/asp.net-security-testing.md)
- [AI Security](https://sallam.gitbook.io/sec-88/ai-security.md)
- [MCP Bug Hunting](https://sallam.gitbook.io/sec-88/ai-security/mcp-bug-hunting.md)
- [LLM Hacking Checklist](https://sallam.gitbook.io/sec-88/ai-security/llm-hacking-checklist.md)
- [API-Sec](https://sallam.gitbook.io/sec-88/api-sec.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [GraphQL API Security Testing](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing.md)
- [The Basics](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/the-basics.md)
- [GraphQL Communication](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/graphql-communication.md)
- [Setting Up a Vulnerable GraphQL Server](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/setting-up-a-vulnerable-graphql-server.md)
- [GraphQL Hacking Tools](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/graphql-hacking-tools.md)
- [GraphQL Attack Surface](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/graphql-attack-surface.md)
- [RECONNAISSANCE](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/reconnaissance.md)
- [GraphQL DOS](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/graphql-dos.md)
- [Information Disclosure](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/information-disclosure.md)
- [AUTHENTICATION AND AUTHORIZATION BYPASSES](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/authentication-and-authorization-bypasses.md)
- [Injection Vulnerabilities in GraphQL](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/injection-vulnerabilities-in-graphql.md)
- [REQUEST FORGERY AND HIJACKING](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/request-forgery-and-hijacking.md)
- [VULNERABILITIES, REPORTS AND EXPLOITS](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/vulnerabilities-reports-and-exploits.md)
- [GraphQL Hacking Checklist](https://sallam.gitbook.io/sec-88/api-sec/graphql-api-security-testing/graphql-api-testing-checklist.md)
- [API Recon](https://sallam.gitbook.io/sec-88/api-sec/api-recon.md)
- [API Token Attacks](https://sallam.gitbook.io/sec-88/api-sec/api-token-attacks.md)
- [Broken Object Level Authorization (BOLA)](https://sallam.gitbook.io/sec-88/api-sec/broken-object-level-authorization-bola.md): API1: Broken Object Level Authorization (BOLA)
- [Broken Authentication](https://sallam.gitbook.io/sec-88/api-sec/broken-authentication.md): API2-Broken Authentication
- [Evasive Maneuvers](https://sallam.gitbook.io/sec-88/api-sec/evasive-maneuvers.md)
- [Improper Assets Management](https://sallam.gitbook.io/sec-88/api-sec/improper-assets-management.md)
- [Mass Assignment Attacks](https://sallam.gitbook.io/sec-88/api-sec/mass-assignment-attacks.md): API3-Broken Object Property Level Authorization (BOPLA)
- [SSRF](https://sallam.gitbook.io/sec-88/api-sec/ssrf.md)
- [Injection Vulnerabilities](https://sallam.gitbook.io/sec-88/api-sec/injection-vulnerabilities.md)
- [Excessive Data Exposure](https://sallam.gitbook.io/sec-88/api-sec/excessive-data-exposure.md): API3-Broken Object Property Level Authorization (BOPLA)
- [OWASP API TOP 10 MindMap](https://sallam.gitbook.io/sec-88/api-sec/owasp-api-top-10-mindmap.md)
- [Scanning APIs with OWASP ZAP](https://sallam.gitbook.io/sec-88/api-sec/scanning-apis-with-owasp-zap.md)
- [Android-AppSec](https://sallam.gitbook.io/sec-88/android-appsec.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Android App Pentesting Checklist](https://sallam.gitbook.io/sec-88/android-appsec/apk-pentesting-checklist.md)
- [Intercepting Cellular Android Traffic via Mobile Data and Ngrok](https://sallam.gitbook.io/sec-88/android-appsec/intercepting-cellular-android-traffic-via-mobile-data-and-ngrok.md)
- [Setup Android App Pentesting environment on Arch](https://sallam.gitbook.io/sec-88/android-appsec/setup-android-app-pentesting-environment-on-arch.md)
- [Setup Android App Pentesting environment on Mac M4](https://sallam.gitbook.io/sec-88/android-appsec/setup-android-app-pentesting-environment-on-mac-m4.md)
- [Genymotion - Proxying Android App Traffic Through Burp Suite](https://sallam.gitbook.io/sec-88/android-appsec/genymotion-proxying-android-app-traffic-through-burp-suite.md)
- [Setup Android Pentesting Environment on Debian Linux](https://sallam.gitbook.io/sec-88/android-appsec/setup-android-pentesting-environment-on-debian-linux.md)
- [Android App Fundamentals](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals.md)
- [Android Architecture](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals/android-architecture.md)
- [Android Security Model](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals/android-security-model.md)
- [Android App Components](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals/android-app-components.md)
- [Intents](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals/android-app-components/intents.md)
- [Pending Intents](https://sallam.gitbook.io/sec-88/android-appsec/android-app-fundamentals/android-app-components/pending-intents.md)
- [Android App Components Security Cheatsheet](https://sallam.gitbook.io/sec-88/android-appsec/android-app-components-security-cheatsheet.md)
- [SSL Pinning Bypass](https://sallam.gitbook.io/sec-88/android-appsec/ssl-pinning-bypass.md)
- [Decompile a Hermes React Native Binary](https://sallam.gitbook.io/sec-88/android-appsec/decompile-a-hermes-react-native-binary.md)
- [Get APK for Target](https://sallam.gitbook.io/sec-88/android-appsec/how-to-get-apk-file-for-application.md)
- [ADB Commands](https://sallam.gitbook.io/sec-88/android-appsec/adb-commands.md): https://www.automatetheplanet.com/adb-cheat-sheet/
- [APK structure](https://sallam.gitbook.io/sec-88/android-appsec/apk-structure.md)
- [Android Permissions](https://sallam.gitbook.io/sec-88/android-appsec/android-permissions.md)
- [Exported Activity Hacking](https://sallam.gitbook.io/sec-88/android-appsec/exported-activity-hacking.md)
- [BroadcastReceiver Hacking](https://sallam.gitbook.io/sec-88/android-appsec/broadcastreceiver-hacking.md)
- [Content Provider Hacking](https://sallam.gitbook.io/sec-88/android-appsec/content-provider-hacking.md)
- [Signing the APK](https://sallam.gitbook.io/sec-88/android-appsec/signing-the-apk.md)
- [Reverse Engineering APK](https://sallam.gitbook.io/sec-88/android-appsec/reverse-engineering-apk.md)
- [Deep Links Hacking](https://sallam.gitbook.io/sec-88/android-appsec/deep-links-hacking.md)
- [Drozer Cheat Sheet](https://sallam.gitbook.io/sec-88/android-appsec/drozer-cheat-sheet.md)
- [SMALI](https://sallam.gitbook.io/sec-88/android-appsec/smali.md)
- [SMALI Cheat Sheet](https://sallam.gitbook.io/sec-88/android-appsec/smali/smali-cheat-sheet.md): Little Help with SMALI
- [Smali Code Patching Guide](https://sallam.gitbook.io/sec-88/android-appsec/smali/patching-with-smali.md)
- [Intent Redirection Vulnerability](https://sallam.gitbook.io/sec-88/android-appsec/intent-redirection-vulnerability.md): Risk: High - MASVS\_CODE\_4
- [Janus Vulnerability (CVE-2017-13156)](https://sallam.gitbook.io/sec-88/android-appsec/janus-vulnerability-cve-2017-13156.md)
- [Task Hijacking](https://sallam.gitbook.io/sec-88/android-appsec/task-hijacking.md)
- [Frida Cheat Sheet](https://sallam.gitbook.io/sec-88/android-appsec/frida-cheat-sheet.md)
- [Magisk & LSPosed Modules](https://sallam.gitbook.io/sec-88/android-appsec/magisk-and-lsposed-modules.md)
- [IOS-AppSec](https://sallam.gitbook.io/sec-88/ios-appsec.md)
- [iOS Device/Simulator Setup](https://sallam.gitbook.io/sec-88/ios-appsec/ios-device-simulator-setup.md)
- [Understanding iOS Security Basics](https://sallam.gitbook.io/sec-88/ios-appsec/understanding-ios-security-basics.md)
- [iOS Pentesting Environment Setup](https://sallam.gitbook.io/sec-88/ios-appsec/ios-pentesting-environment-setup.md)
- [Configuring Xcode iOS Simulator with Burp Suite for Pentesting on macOS](https://sallam.gitbook.io/sec-88/ios-appsec/configuring-xcode-ios-simulator-with-burp-suite-for-pentesting-on-macos.md)
- [How to GET/PULL/Install IPA](https://sallam.gitbook.io/sec-88/ios-appsec/how-to-get-pull-install-ipa.md)
- [Common SSH and libimobiledevice Commands](https://sallam.gitbook.io/sec-88/ios-appsec/common-ssh-and-libimobiledevice-commands.md)
- [Intercepting Network Traffic with Burp Suite](https://sallam.gitbook.io/sec-88/ios-appsec/intercepting-network-traffic-with-burp-suite.md)
- [Automatic Static Analysis](https://sallam.gitbook.io/sec-88/ios-appsec/automatic-static-analysis.md)
- [IOS Reverse Engineering](https://sallam.gitbook.io/sec-88/ios-appsec/ios-reverse-engineering.md)
- [Network-Sec](https://sallam.gitbook.io/sec-88/network-sec.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Networking Fundamentals](https://sallam.gitbook.io/sec-88/network-sec/networking-fundamentals.md)
- [Open Ports Security Testing](https://sallam.gitbook.io/sec-88/network-sec/open-ports-security-testing.md)
- [Vulnerability Scanning](https://sallam.gitbook.io/sec-88/network-sec/vulnerability-scanning.md)
- [Client Side Attacks](https://sallam.gitbook.io/sec-88/network-sec/client-side-attacks.md)
- [Port Redirection and Tunneling](https://sallam.gitbook.io/sec-88/network-sec/port-redirection-and-tunneling.md)
- [Password Attacks](https://sallam.gitbook.io/sec-88/network-sec/password-attacks.md)
- [Privilege Escalation \[PrevEsc\]](https://sallam.gitbook.io/sec-88/network-sec/privilege-escalation-prevesc.md)
- [Linux Privilege Escalation](https://sallam.gitbook.io/sec-88/network-sec/privilege-escalation-prevesc/linux-privilege-escalation.md)
- [Buffer Overflow (BOF)](https://sallam.gitbook.io/sec-88/network-sec/buffer-overflow-bof.md)
- [VulnServer](https://sallam.gitbook.io/sec-88/network-sec/buffer-overflow-bof/vulnserver.md)
- [Sync Breez Enterprize](https://sallam.gitbook.io/sec-88/network-sec/buffer-overflow-bof/sync-breez-enterprize.md): Sync Breez Enterprize v10.0.28
- [Crashed CTF](https://sallam.gitbook.io/sec-88/network-sec/buffer-overflow-bof/crashed-ctf.md)
- [BOF for Linux](https://sallam.gitbook.io/sec-88/network-sec/buffer-overflow-bof/bof-for-linux.md)
- [AV Evasion](https://sallam.gitbook.io/sec-88/network-sec/av-evasion.md)
- [Post Exploitation](https://sallam.gitbook.io/sec-88/network-sec/post-exploitation.md)
- [File Transfer](https://sallam.gitbook.io/sec-88/network-sec/post-exploitation/file-transfer.md)
- [Maintaining Access](https://sallam.gitbook.io/sec-88/network-sec/post-exploitation/maintaining-access.md)
- [Pivoting](https://sallam.gitbook.io/sec-88/network-sec/post-exploitation/pivoting.md)
- [Clean Up](https://sallam.gitbook.io/sec-88/network-sec/post-exploitation/clean-up.md)
- [Active Directory](https://sallam.gitbook.io/sec-88/network-sec/active-directory.md)
- [Basic AD Pentesting](https://sallam.gitbook.io/sec-88/network-sec/active-directory/basic-ad-pentesting.md)
- [Desktop AppSec](https://sallam.gitbook.io/sec-88/desktop-appsec.md)
- [Thin Client vs. Thick Client](https://sallam.gitbook.io/sec-88/desktop-appsec/thin-client-vs.-thick-client.md): https://ko-fi.com/h0tak88r
- [Cloud Sec](https://sallam.gitbook.io/sec-88/cloud-sec.md)
- [Salesforce Hacking](https://sallam.gitbook.io/sec-88/cloud-sec/salesforce-hacking.md)
- [Basics](https://sallam.gitbook.io/sec-88/cloud-sec/salesforce-hacking/basics.md)
- [Salesforce SAAS Apps Hacking](https://sallam.gitbook.io/sec-88/cloud-sec/salesforce-hacking/salesforce-saas-apps-hacking.md)
- [Firebase](https://sallam.gitbook.io/sec-88/cloud-sec/firebase.md)
- [S3 Buckets Misconfigurations](https://sallam.gitbook.io/sec-88/cloud-sec/s3-buckets-misconfigurations.md)
- [Amazon Cognito Misconfiguraitons](https://sallam.gitbook.io/sec-88/cloud-sec/amazon-cognito-misconfiguraitons.md)
- [Firebase Test Cases](https://sallam.gitbook.io/sec-88/cloud-sec/firebase-test-cases.md)
- [Programming](https://sallam.gitbook.io/sec-88/programming.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [HTML](https://sallam.gitbook.io/sec-88/programming/html.md)
- [JavaScript (JS)](https://sallam.gitbook.io/sec-88/programming/javascript-js.md)
- [window.location object](https://sallam.gitbook.io/sec-88/programming/javascript-js/window.location-object.md)
- [Python](https://sallam.gitbook.io/sec-88/programming/python.md)
- [Python Tips](https://sallam.gitbook.io/sec-88/programming/python/python-tips.md)
- [Set](https://sallam.gitbook.io/sec-88/programming/python/set.md)
- [SetMethods](https://sallam.gitbook.io/sec-88/programming/python/set/setmethods.md)
- [JAVA](https://sallam.gitbook.io/sec-88/programming/java.md)
- [Java Essentials](https://sallam.gitbook.io/sec-88/programming/java/java-essentials.md)
- [Java Essentials Code Notes](https://sallam.gitbook.io/sec-88/programming/java/java-essentials-code-notes.md)
- [Java OOP1](https://sallam.gitbook.io/sec-88/programming/java/java-oop1.md): (Class, Object, Constructor, Overloading, Java Access Modifiers, Recursion, Instanceof Operator)
- [JAVA OOP Principles](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles.md)
- [Inheritance](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/inheritance.md)
- [Method Overriding](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/method-overriding.md)
- [Abstract Class](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/abstract-class.md)
- [Interface](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/interface.md)
- [polymorphism](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/polymorphism.md)
- [Encapsulation](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/encapsulation.md)
- [Composition](https://sallam.gitbook.io/sec-88/programming/java/java-oop-principles/composition.md)
- [Java OOP Challenges](https://sallam.gitbook.io/sec-88/programming/java/java-oop-challenges.md)
- [Exception Handling](https://sallam.gitbook.io/sec-88/programming/java/exception-handling.md)
- [Go](https://sallam.gitbook.io/sec-88/programming/go.md)
- [Go Syntax Tutorial in one file](https://sallam.gitbook.io/sec-88/programming/go/go-syntax-tutorial-in-one-file.md)
- [Methods and Interfaces](https://sallam.gitbook.io/sec-88/programming/go/methods-and-interfaces.md): methods and intefaces in golang
- [Go Slices](https://sallam.gitbook.io/sec-88/programming/go/go-slices.md)
- [Go Maps](https://sallam.gitbook.io/sec-88/programming/go/go-maps.md)
- [Go Functions](https://sallam.gitbook.io/sec-88/programming/go/go-functions.md)
- [Concurrency](https://sallam.gitbook.io/sec-88/programming/go/concurrency.md)
- [Read Files](https://sallam.gitbook.io/sec-88/programming/go/read-files.md)
- [Write Files](https://sallam.gitbook.io/sec-88/programming/go/write-files.md)
- [Package](https://sallam.gitbook.io/sec-88/programming/go/package.md)
- [How to make personal Package](https://sallam.gitbook.io/sec-88/programming/go/package/how-to-make-personal-package.md)
- [regexp Packages](https://sallam.gitbook.io/sec-88/programming/go/package/regexp-packages.md)
- [Json](https://sallam.gitbook.io/sec-88/programming/go/package/json.md)
- [bufio](https://sallam.gitbook.io/sec-88/programming/go/package/bufio.md): https://pkg.go.dev/bufio
- [Time](https://sallam.gitbook.io/sec-88/programming/go/package/time.md)
- [Signals-Exit](https://sallam.gitbook.io/sec-88/programming/go/signals-exit.md)
- [Unit Testing](https://sallam.gitbook.io/sec-88/programming/go/unit-testing.md): https://blog.jetbrains.com/go/2022/11/22/comprehensive-guide-to-testing-in-go
- [Operating Systems](https://sallam.gitbook.io/sec-88/operating-systems.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Linux](https://sallam.gitbook.io/sec-88/operating-systems/linux.md)
- [Linux Commands](https://sallam.gitbook.io/sec-88/operating-systems/linux/linux-commands.md)
- [Tools](https://sallam.gitbook.io/sec-88/operating-systems/linux/tools.md)
- [Linux File System](https://sallam.gitbook.io/sec-88/operating-systems/linux/linux-file-system.md)
- [Bash Scripting guide](https://sallam.gitbook.io/sec-88/operating-systems/linux/bash-scripting-guide.md)
- [tmux](https://sallam.gitbook.io/sec-88/operating-systems/linux/tmux.md)
- [Git](https://sallam.gitbook.io/sec-88/operating-systems/linux/git.md)
- [Install Go tools from private repositories using GitHub PAT](https://sallam.gitbook.io/sec-88/operating-systems/linux/install-go-tools-from-private-repositories-using-github-pat.md)
- [VPS](https://sallam.gitbook.io/sec-88/operating-systems/vps.md)
- [Burp Suite](https://sallam.gitbook.io/sec-88/operating-systems/burp-suite.md)
- [Write-Ups](https://sallam.gitbook.io/sec-88/write-ups.md)
- [Discord OAuth Misconfig → ATO, Pre-ATO & 2FA Bypass](https://sallam.gitbook.io/sec-88/write-ups/discord-oauth-misconfig-ato-pre-ato-and-2fa-bypass.md): Collaboration with Amr A'laa https://www.linkedin.com/in/amr-alaa-a14b65216/
- [How to Use Claude Code for Bug Hunting — For Free (A Beginner's Guide)](https://sallam.gitbook.io/sec-88/write-ups/how-to-use-claude-code-for-bug-hunting-for-free-a-beginners-guide.md)
- [API BAC leads to PII Data Disclosure](https://sallam.gitbook.io/sec-88/write-ups/api-bac-leads-to-pii-data-disclosure.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Misconfigured OATUH leads to Pre-Account Takeover](https://sallam.gitbook.io/sec-88/write-ups/misconfigured-oatuh-leads-to-pre-account-takeover.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Automating Bug Bounty with GitHub Actions](https://sallam.gitbook.io/sec-88/write-ups/automating-bug-bounty-with-github-actions.md)
- [From Recon to Reward: My Bug Bounty Methodology when Hunting on Public Bug Bounty Programs](https://sallam.gitbook.io/sec-88/write-ups/from-recon-to-reward-my-bug-bounty-methodology-when-hunting-on-public-bug-bounty-programs.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [Exploring Subdomains: From Enumeration to Takeover Victory](https://sallam.gitbook.io/sec-88/write-ups/exploring-subdomains-from-enumeration-to-takeover-victory.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [0-Click Account Takeover via Insecure Password Reset Feature](https://sallam.gitbook.io/sec-88/write-ups/0-click-account-takeover-via-insecure-password-reset-feature.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [How a Simple Click Can Lead to Account Takeover: An OAuth Insecure Implementation Vulnerability](https://sallam.gitbook.io/sec-88/write-ups/how-a-simple-click-can-lead-to-account-takeover-an-oauth-insecure-implementation-vulnerability.md): If you enjoy what I do, please support me  Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [The Power Of IDOR even if it is unpredictable IDs](https://sallam.gitbook.io/sec-88/write-ups/finding-high-impact-bugs-in-a-private-bug-bounty-program-our-success-story.md)
- [Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens](https://sallam.gitbook.io/sec-88/write-ups/unlocking-the-weak-spot-exploiting-insecure-password-reset-tokens.md): Buy Me Ko-fi! https://ko-fi.com/h0tak88r
- [AI Under Siege: Discovering and Exploiting Vulnerabilities](https://sallam.gitbook.io/sec-88/write-ups/ai-under-siege-discovering-and-exploiting-vulnerabilities.md)
- [Inside the Classroom: How We Hacked Our Way Past Authorization on a Leading EdTech Platform](https://sallam.gitbook.io/sec-88/write-ups/inside-the-classroom-how-we-hacked-our-way-past-authorization-on-a-leading-edtech-platform.md)
- [How We Secured Our Client’s Platform Against Interaction-Free Account Thefts](https://sallam.gitbook.io/sec-88/write-ups/how-we-secured-our-clients-platform-against-interaction-free-account-thefts.md)
- [Unchecked Privileges: The Hidden Risk of Role Escalation in Collaborative Platforms](https://sallam.gitbook.io/sec-88/write-ups/unchecked-privileges-the-hidden-risk-of-role-escalation-in-collaborative-platforms.md)
- [Decoding Server Behavior: The Key to Mass Account Takeover](https://sallam.gitbook.io/sec-88/write-ups/decoding-server-behavior-the-key-to-mass-account-takeover.md)
- [Exploiting JSON-Based CSRF: The Hidden Threat in Profile Management](https://sallam.gitbook.io/sec-88/write-ups/exploiting-json-based-csrf-the-hidden-threat-in-profile-management.md)
- [How We Turned a Medium XSS into a High Bounty by Bypassing HttpOnly Cookie](https://sallam.gitbook.io/sec-88/write-ups/how-we-turned-a-medium-xss-into-a-high-bounty-by-bypassing-httponly-cookie.md)
- [How Monitoring Target Updates Helped Me Earn Bounties in Bug Bounty](https://sallam.gitbook.io/sec-88/write-ups/how-monitoring-target-updates-helped-me-earn-bounties-in-bug-bounty.md)
- [Semi-Automating My Android Bug Hunting Flow with apkX](https://sallam.gitbook.io/sec-88/write-ups/semi-automating-my-android-bug-hunting-flow-with-apkx.md)
- [Using N8N To Orchestrate Web and Mobile Bug Hunting](https://sallam.gitbook.io/sec-88/write-ups/using-n8n-to-orchestrate-web-and-mobile-bug-hunting.md)
- [Hacking Android Labs](https://sallam.gitbook.io/sec-88/write-ups/hacking-labs.md)
- [Injured Android](https://sallam.gitbook.io/sec-88/write-ups/hacking-labs/injured-android.md)
- [Hacking the VulnWebView Lab](https://sallam.gitbook.io/sec-88/write-ups/hacking-labs/hacking-the-vulnwebview-lab.md): Lab Link: https://github.com/t4kemyh4nd/vulnwebview
- [Hacking InsecureBankv2 App](https://sallam.gitbook.io/sec-88/write-ups/hacking-labs/hacking-insecurebankv2-app.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on a page URL with the `ask` query parameter:
```
GET https://sallam.gitbook.io/sec-88/readme.md?ask=<question>
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.