Amr (@0d_3mrr) header
Amr (@0d_3mrr) profile picture

Amr

@0d_3mrr

Red Team Consultant & ex Bug Hunter || Ece MU graduated Engineer || Surviving in Egypt :))

 127.0.0.1
0d-amr.medium.com
Joined July 2015
  • Tweets30.2K
  • Following890
  • Followers3.2K
2.1KMedia
Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)Photo by Amr (@0d_3mrr)
None of this will matter when I am 30
17
شاهد السرعة الخامسة التي نفرط فيها تفريطا:
56
2,497
36
9,281
653,610
CVE-2026-119446 in NervesHub, fixed in 2.5.3. My advisory is out.
Image from Amr (@0d_3mrr)
5
1
34
754
640
16,423
1,360
96,244
6,253,621
𝗠𝗼𝗿𝗮𝗮 𝗔𝗜 𝗢𝗳𝗳𝘀𝗲𝗰 𝗔𝗴𝗲𝗻𝘁 github.com/Amrkadry/moraa-ai…
GitHub - Amrkadry/moraa-ai-offsec-agent: An offensive-security methodology that an AI coding agent...

GitHub - Amrkadry/moraa-ai-offsec-agent: An offensive-security methodology that an AI coding agent...

An offensive-security methodology that an AI coding agent can actually execute — 88 class docs, 6 agents, 24 scripts, evidence-first validation. Authorized testing only. - Amrkadry/moraa-ai-offsec-...

github.com
2
47
1,563
High sev. Resolved. Bounty + bonus. Not a forgotten subdomain. The identity core itself (UID). Everyone fuzzes the edges. The core assets are still the valuable ones.
Image from Amr (@0d_3mrr)
4
1
112
4,174
ATM assessments are often repetitive: same test cases, every time. The real constraint is time on site. So I built a read-only PowerShell collector to handle the enumeration in one run. Built for NCR Personas/APTRA. PRs welcome. github.com/Amrkadry/Amrs-ATM…
GitHub - Amrkadry/Amrs-ATM-Assessment: Amr's ATM Assessment - read-only PowerShell collector for...

GitHub - Amrkadry/Amrs-ATM-Assessment: Amr's ATM Assessment - read-only PowerShell collector for...

Amr's ATM Assessment - read-only PowerShell collector for authorised NCR Personas / APTRA ATM security assessments. 15 phases: XFS service-provider integrity and live CDM interaction, Radmi...

github.com
1
3
14
671
Just a domain check feature turned out to be an unauthenticated SSRF reaching inside a cloud estate's VPC.
Image from Amr (@0d_3mrr)
Image from Amr (@0d_3mrr)
5
1
113
5,126
أجدع واحد في اخواته
Image from Amr (@0d_3mrr)
11
276
How silly of me to forget how far I have come, just because I still have far to go.
3
244
الاتراك دول رهيبين بجد ، النادي دا بيدي درس لكل الكوكب ازاي تعمل براندينج لنفسك مظبوط
Trabzonspor (@Trabzonspor) profile pictureTrabzonspor
@TrabzonsporAug 9
"Rüyada görürsünüz" diyenler... Bizde rüyalar gerçek olur.
3
57
1,092
من افضل الانترفيوز اللي شوفتها للسيكيورتي بالعربي. حلقة خطيرة وممتعة اوي، تسلموا يشباب عالمجهود ❤️
Image from Amr (@0d_3mrr)
8
116
3,841
اكتشفت أن من القرارات الغلط اللي عملتها اخر سنة ونص اني وقفت bug hunting وركزت علي حاجات تانية زي المذاكرة والشغل
13
2
6
110
38,209
Alone in the fight, stronger because of it.
4
785
first ever 10/10 critical :) on a main asset in a public program. Started with app-wide SSRF, chained to RCE, ended with sensitive data exposure including 12+ stripe secret keys and access to critical parts of the system.
Image from Amr (@0d_3mrr)
30
5
5
350
18,641
In this write-up, I break down the story behind PyYAML’s CVEs, what really happened, why unsafe deserialization led to Remote Code Execution. 0d-amr.medium.com/from-yaml-…
From YAML to RCE: The PyYAML Deserialization Story

From YAML to RCE: The PyYAML Deserialization Story

Hi, I’m Amr Kadry, a Red Team Consultant and bug hunter, acknowledged by over 50 companies including Mozilla, CrowdStrike, Canva, Vimeo…

0d-amr.medium.com
1
3
14
894
sharing a new GitHub repository: Android Regex Cheat Sheet. github.com/Amrkadry/Android-… This repository provides a collection of regex patterns to facilitate static analysis of decompiled Android APKs. #Security #CyberSecurity #mobilesecurity
Image from Amr (@0d_3mrr)
Image from Amr (@0d_3mrr)
1
2
17
1,140
ChatGPT Atlas isn’t just another browser: it watches, infers, and acts on your behalf. Worryingly, there are still many open questions about how this product protects user data. If you're curious about what that means for privacy, read on… 1/8
63
300
31
2,012
86,416
Manchester City manager and football legend Pep Guardiola has spoken out in solidarity with Palestine, calling on people to flood the streets of Barcelona tomorrow to protest against the genocide. @PepTeam @Palestina_cat
1,395
24,869
2,503
96,156
7,052,162
It has been confirmed to us that the occupation navy stormed the ships Alma and Sirius. The occupation issued a threat to Alma, the fleet’s lead ship, but the response was a firm refusal and insistence on completing the mission. Our decision is to continue sailing without interruption. تأكد لنا اقتحام سفينتي ألما و سيريس من قبل بحرية الاحتلال وجه الاحتلال تهديد لسفينة ألما قائدة الأسطول فكان الرد بالرفض والإصرار على إتمام المهمة قرارنا مواصلة الإبحار دون توقّف #GlobalSumudFlotilla⁩ #أسطول_الصمود_العالمي
Image from ICBSG | اللجنة الدولية لكسر الحصار عن غزة (@ICBSOFGAZA)
64
1,193
72
2,426
137,629
Happy to fund your migration. For Core customers, send your Vercel/v0 cancellation screenshot to support@replit and we’ll give you $50 of credits. If you have an annual enterprise contract with them, we’ll wave up to $20k of equivalent contract value. Email sales@replit
Amjad Masad (@amasad) profile pictureAmjad Masad
@amasad29 Sep 2025
Many are asking if they can move their Next.js projects from Vercel to Replit? Yes! - Go to Import then GitHub - enter repo URL - Agent will take care of the rest It will set up the dev and deployment environments! For companies moving lots of work, happy to help + discount.
413
2,546
417
19,065
1,914,636
Load more