Skip to content
View the0x-pwn's full-sized avatar
🇮🇶
🇮🇶
5 followers · 24 following

Block or report the0x-pwn

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
the0x-pwn/README.md
Typing SVG

 🇮🇶 Iraq



Twitter LinkedIn HackTheBox TryHackMe

🛡️ whoami

the0x@arch ~ % whoami --verbose
[+] Role        : Cyber Security Researcher / Web Penetration Tester
[+] Based in    : 🇮🇶 Iraq
[+] OS Religion : Arch Linux (btw)
[+] Status      : Breaking apps responsibly, one request at a time
[+] Addiction   : CTF challenges & bug bounty hunting
[+] Mindset     : "If it's not tested, it's not secure"

🎯 Specialization

🔭 Currently working on    : Web Application Penetration Testing
🌱 Currently learning      : Advanced Privilege Escalation & Access Control techniques
👯 Looking to collaborate  : CTF teams & Bug Bounty projects
🤔 Looking for help with   : Advanced research in Vertical/Horizontal BAC
💬 Ask me about            : SQLi, XSS, IDOR, BAC, CTF Writeups
⚡ Fun fact                : I don't trust any user input — not even my own 😄

🧨 Exploitation Expertise

🔐 Access Control & Auth

  • Broken Access Control (BAC)
  • Vertical / Horizontal BAC
  • Context-Based BAC
  • Authentication Bypass (AUTH BYPASS)
  • Insecure Direct Object Reference (IDOR)
  • Privilege Escalation

💉 Injection Attacks

  • SQL Injection — Union-Based
  • SQL Injection — Error-Based
  • Blind SQLi — Boolean-Based
  • Blind SQLi — Time-Based
  • Second-Order SQL Injection

🧬 Client-Side Attacks

  • Cross-Site Scripting (Reflected)
  • Cross-Site Scripting (Stored)
  • DOM-Based XSS
  • Cross-Site Request Forgery (CSRF)

📁 File-Based Attacks

  • Unrestricted File Upload
  • File Upload RCE Chains

⚙️ Tech Arsenal — Languages & Technologies

Proficiency levels are based on my own self-assessment 🎯

PHP 85%
Laravel 80%
Python 90%
Go 65%
SQL 88%
MySQL 85%
JavaScript 78%
HTML 95%
CSS 90%
Bootstrap 85%
Tailwind 80%
Bash Script 60%

🖥️ Operating Systems

Arch Linux Windows

Arch Linux is my one true love — full control or nothing 🖤

📊 GitHub Stats


🚩 CTF & Bug Bounty

[*] Categories  : Web Exploitation | Network Pentest | Misc
[*] Mentality   : "Every app has a flaw, the only question is when you'll find it"
[*] Currently   : Hunting bugs & solving boxes

Popular repositories Loading

  1. ghostdir ghostdir Public

    Python 2

  2. sql_injection sql_injection Public

    PHP 2

  3. Bash-Scripting Bash-Scripting Public

    Shell

  4. lab-xss lab-xss Public

    9 XSS challenges covering Reflected, DOM-Based, and Filter Bypass — Easy to Hard

    HTML

  5. lab-CSRF lab-CSRF Public

    PHP

  6. the0x-pwn the0x-pwn Public