Asim Alharbi — Security Researcher

The story.

Who's behind the handle, and what I'm actually after.

Asim Alharbi0x4s3m · web & API security

bugbounty.sa ↗

I'm a web and API penetration tester based in Saudi Arabia. I hunt on public bug bounty programs — mostly broken access control, authorization flaws and server-side bugs — and I write them up so they actually get fixed.

I came up through web and rev CTF and still play with my team, C00kie_Byte (0xCB). I'd rather go deep on one bug class than find one of everything, so most of my time goes into object-level authorization — finding where an app forgets to check who you are.

Roles I fit

Penetration Tester Application Security Engineer Bug Bounty Hunter Red Team Analyst

What I break.

The vulnerability classes I go looking for first — where business logic and identity meet.

/ 001

Broken Access Control

IDOR & BOLA where an object ID is all that stands between you and someone else's data. The most common critical, and the most overlooked.

IDORBOLABFLA

/ 002

Server-Side Request Forgery

SSRF pivots into internal networks and cloud metadata. Chaining a fetch primitive into full internal reach where filters are too trusting.

SSRFCLOUD-METABLIND

/ 003

Authorization Logic

Privilege escalation and tenant isolation gaps — the flaws a scanner never sees because they live entirely in how the app decides who you are.

PRIV-ESCMULTI-TENANT

/ 004

WordPress Plugin Research

Auditing plugin source for auth bypass, injection and unrestricted actions, then coordinating disclosure with vendors and the wider ecosystem.

SOURCE-AUDITCVE

/ 005

API Abuse

Undocumented endpoints, mass-assignment and rate-limit gaps. Where the docs end is usually where the interesting behaviour begins.

MASS-ASSIGNRESTGRAPHQL

/ 006

Reverse Engineering

Rev challenges in CTF and binary logic bugs in the wild — reading what a program actually does, not what its docs claim.

REVSTATICDYNAMIC

Reports Triaged

Programs

Critical / High

⏳

CVE · pending

Selected disclosures.

Each one written as a case study — problem, action, outcome. Click to open. Swap for your real findings.

CRITICAL

Object-level authorization bypass in a national services portal

BOLA · CVSS 9.1 · bugbounty.sa

2025

▸

Problem

Any authenticated user could read another citizen's records by changing a numeric ID in an API request — no ownership check existed.

Action

Mapped the endpoint, confirmed cross-account access with two test accounts, and captured a clean, minimal proof of concept with no real user data exposed.

Outcome

Triaged as critical and fixed within days; server-side authorization now enforced on every object. Reported and handled under coordinated disclosure.

ROLE: PENETRATION TESTER

HIGH

Blind SSRF via unvalidated webhook URL → internal metadata

SSRF · CVSS 8.2 · Public program

2025

▸

Problem

A webhook feature fetched arbitrary user-supplied URLs, letting a request reach internal-only services and cloud metadata endpoints.

Action

Proved reachability with an out-of-band collaborator, then demonstrated access to an internal endpoint without exfiltrating sensitive values.

Outcome

Vendor added an allow-list and blocked link-local ranges. Documented the filter-bypass chain so the fix covered the root cause, not just my payload.

ROLE: APPSEC ENGINEER

CRITICAL

Auth bypass in a WordPress plugin (150k+ installs)

ACCESS-CONTROL · CVE-2025-XXXXX · Coordinated

2025

▸

Problem

A popular plugin exposed a privileged action to unauthenticated requests because of a missing capability check in an AJAX handler.

Action

Found it by reading the plugin source, wrote a proof of concept against a local install, and drafted a clear remediation for the maintainer.

Outcome

Patched release shipped to all users; CVE assigned. Coordinated timing so a fix was public before any details were.

ROLE: SECURITY RESEARCHER

HIGH

Tenant isolation failure exposing cross-account records

MULTI-TENANT · CVSS 7.7 · Private program

2024

▸

Problem

A shared identifier let one tenant enumerate and read another tenant's data through a reporting endpoint.

Action

Set up two isolated tenants, confirmed leakage, and scoped the exact parameter and endpoints affected.

Outcome

Team added tenant-scoped checks and audited sibling endpoints for the same pattern.

ROLE: PENETRATION TESTER

MEDIUM

Mass-assignment lets a user grant themselves an elevated role

API · CVSS 6.5 · Public program

2024

▸

Problem

A profile-update endpoint accepted a role field it should have ignored, so a normal user could promote their own account.

Action

Demonstrated the escalation on a throwaway account and showed the minimal request needed to trigger it.

Outcome

Endpoint switched to an explicit field allow-list; role changes moved behind a server-side check.

ROLE: APPSEC ENGINEER

Break the logic.
Report the bug.

The story.

What I break.

Broken Access Control

Server-Side Request Forgery

Authorization Logic

WordPress Plugin Research

API Abuse

Reverse Engineering

Selected disclosures.

Object-level authorization bypass in a national services portal

Blind SSRF via unvalidated webhook URL → internal metadata

Auth bypass in a WordPress plugin (150k+ installs)

Tenant isolation failure exposing cross-account records

Mass-assignment lets a user grant themselves an elevated role

Certifications.

Web Application Penetration Tester eXtreme

Certified Web Red Team Analyst

Off the clock: CTF.

C00kie_Byte

Found something worth breaking?