Signal Acquired: Welcome to the Grid
Ilyas Salioui (TheCzar) opens a new home for offensive security research, bug bounty notes, and the occasional writeup.
I’m Ilyas Salioui — better known as TheCzar on bug bounty platforms and in the parts of the internet that enjoy a good stack trace.
This is my new home on the web: a place for offensive security research, recon notes, bug bounty war stories, and the occasional writeup that got too long for a social post.
What you’ll find here
- Web & API pentesting — business logic, access control, auth, and the bugs scanners miss.
- Recon — the unglamorous work that finds the interesting attack surface.
- Bug bounty — what paid, what didn’t, and what I learned from both.
- Writeups — full chains, not just the final payload.
The archive
I’ve imported my Medium research into the archive, including:
- Cookie Tossing: Escalating Low-Impact XSS into Criticals
- Stack Traces: Unveiling Attack Surface
- Origin IP Discovery Techniques
- Intigriti Monthly Challenge Writeup: JWT Abuse → RCE
New posts will land here first, and occasionally on Medium too.
Who am I?
I’m Ilyas Salioui — TheCzar if you’ve seen the handle. I’m a cybersecurity engineering student in Rabat who spends too much time asking web apps uncomfortable questions.
I hunt bugs on YesWeHack and Intigriti. Some pay. The interesting ones end up here.
The full dossier is on the about page. The short version: I like finding the bug that everyone else walked past.
Find the bug. Write it down. Help fix it.
Welcome to the grid.