0xsl4m

About

Islam (0xsl4m) — bug bounty hunter and junior penetration tester. eWPTXv3 certified, preparing for eMAPT. Notes on web and Android application security.

Who I am

I’m Islam (0xsl4m), a bug bounty hunter working toward my first role as a penetration tester. I’ve been studying offensive security since early 2025, mostly web applications, and more recently Android apps.

I hunt on public bug bounty programs and I’m still building my track record there. Most of what I learn along the way ends up on this site.

What I focus on

  • Web application security — authentication and access control, injection, CSRF, CORS, and business logic flaws.
  • Android application security — I’m working through a full Android pentesting roadmap, writing an article for every lesson, on the way to the eMAPT exam.
  • API security — REST APIs, tokens and JWT handling.
  • AI-assisted hunting — since mid-2026 I’ve been building an AI agent that supports my recon and hunting workflow.

I can read JavaScript, PHP and Java well enough to follow an application’s logic and spot vulnerable code paths. I’m not a developer, though; I read code to break it.

What’s on this site

Most articles are written in Egyptian Arabic, to give Arabic speakers a clear path into security. The English versions of my Android notes live on GitHub.

  • Basics — networking and web fundamentals, in reading order.
  • Vulnerabilities — how common web bugs work, and how to find and fix them.
  • Android — my Android pentesting roadmap, with an article for every lesson.
  • Certifications — honest exam reviews.

Certifications

  • eWPTXv3 — Web Application Penetration Tester eXtreme (INE), August 2026 · verify
  • eMAPT — Mobile Application Penetration Tester (INE) · in progress

Projects

  • DroidSiege — an intentionally vulnerable Android app with graded challenges aligned with the OWASP Mobile Top 10.
  • NoSQLi Hunter — a Burp Suite extension for finding NoSQL injection.

Open to work

I’m open to junior penetration tester roles. If you’re hiring, or just want to talk security, reach out on any of the links below.

Get in touch