Researcher Spotlight: Ammar Askar on Authentication Bugs and the Art of the Hunt

GitHub’s Bug Bounty Program has been running for nine years, and in that time it has paid out over $3.8 million in rewards via HackerOne. As part of its ongoing push to highlight the researchers behind those submissions, the program recently sat down with Ammar Askar, a contributor who focuses on privilege escalation and authentication/access control flaws.

Askar's path into security started early, with modding Minecraft. Seeing how a single Java exception could take down a server for dozens of players sparked a lasting interest. In college, CTF competitions helped build a broad skill set across forensics, web security, and reverse engineering. After that, the reputation of GitHub’s program—particularly its responsive security team—made it a natural first destination for applying those skills in a bounty context.

For Askar, the appeal of bug hunting is its puzzle-like nature. It involves forming theories about how systems work, then trying to break them. That process of experimenting and learning is what keeps things fulfilling.

Finding the Complex Bugs

When asked about how they approach large software projects, Askar draws a distinction between two categories of vulnerabilities. The first includes common issues like SQL injection and XSS, which are increasingly rare in mature codebases because they are easy to spot with static analysis and often mitigated by safe-by-default libraries like prepared statements and DOMPurify.

The second—and more interesting—category emerges from complexity. As features accrue, developers have to make assumptions about how different parts of the system behave. Find a wrong assumption, and you’ve likely found a security bug.

Askar points to CVE-2023-23761, a bug reported to GitHub, as a concrete example. Learning that GitHub supports SSH certificate authentication led to a natural question: what happens if an organization issues a certificate for someone who isn’t actually a member? The answer, it turned out, was that the certificate would not grant access to that organization’s repos. But that dead end prompted a different avenue—checking where else SSH access could be used on the platform. Gists can be edited as Git repositories, and with the fraudulent certificate, it was possible to edit anyone’s gists.

Staying Informed and Getting Started

Keeping up with vulnerability trends is a mix of sources for Askar, including the /r/netsec subreddit for general news, the Google Project Zero blog for deep dives into low-level memory safety issues, and DEF CON talks from its YouTube channel. A few X accounts round out the list: Matthew Green for cryptography, LiveOverflow for video content, and David3141593 for reverse engineering writeups.

For researchers looking to enter the field, Askar stresses practical application. Read a blog post or watch a video about a technique—then test it in your own toy app so you understand both how to exploit it and how to patch it.

If you don’t find bugs in mature programs right away, treat it as a learning opportunity. Reading writeups from previous bounties on those platforms can teach you a lot about how they mitigate issues and guide where you should look next. Above all, Askar recommends brushing up on web and mobile security basics, most bounty programs involve them, and calls out PortSwigger’s Web Security Academy and CTFs as useful starting points.

Outside of hacking, Askar is an avid runner—recent races number four in the last year—and enjoys electronics tinkering and 3D printing as a way to create physical objects.

  • Who: Ammar Askar (@ammaraskar on GitHub)
  • Focus areas: Privilege escalation, authentication and access control flaws
  • Example work: CVE-2023-23761 (GitHub Gists SSH certificate bypass)
  • Links: ammaraskar.com