New Writeup❗️
Date: Wed, 24 Aug 2022 23:02:13 GMT
Title: Chaining Telegram bugs to steal session-related files.
Link: https://medium.com/p/c90eac4749bd
Date: Wed, 24 Aug 2022 23:02:13 GMT
Title: Chaining Telegram bugs to steal session-related files.
Link: https://medium.com/p/c90eac4749bd
Medium
Chaining Telegram bugs to steal session-related files.
We will discuss the chaining of two bugs on the telegram android application, which can make malicious applications steal internal telegram…
New Writeup❗️
Date: Mon, 18 Oct 2021 23:31:52 GMT
Title: Exploiting Request forgery on Mobile Applications.
Link: https://medium.com/p/e1d196d187b3
Date: Mon, 18 Oct 2021 23:31:52 GMT
Title: Exploiting Request forgery on Mobile Applications.
Link: https://medium.com/p/e1d196d187b3
Medium
Exploiting Request forgery on Mobile Applications.
We will tell a story about the Request forgery family and how it can attack mobile applications.
New Writeup❗️
Date: Thu, 18 Mar 2021 01:01:52 GMT
Title: TikTok for Android 1-Click RCE
Link: https://medium.com/p/240266e78105
Date: Thu, 18 Mar 2021 01:01:52 GMT
Title: TikTok for Android 1-Click RCE
Link: https://medium.com/p/240266e78105
Medium
TikTok for Android 1-Click RCE
Chaining multiple bugs on TikTok for Android to achieving Remote code execution in the application’s context.
New Writeup❗️
Date: Fri, 02 Oct 2020 13:47:58 GMT
Title: Arbitrary code execution on Facebook for Android through download feature
Link: https://medium.com/p/fb6826e33e0f
Date: Fri, 02 Oct 2020 13:47:58 GMT
Title: Arbitrary code execution on Facebook for Android through download feature
Link: https://medium.com/p/fb6826e33e0f
Medium
Arbitrary code execution on Facebook for Android through download feature
TL;DR
New Writeup❗️
Date: Fri, 13 Dec 2019 18:44:55 GMT
Title: Vimeo upload function SSRF
Link: https://medium.com/p/7466d8630437
Date: Fri, 13 Dec 2019 18:44:55 GMT
Title: Vimeo upload function SSRF
Link: https://medium.com/p/7466d8630437
Medium
Vimeo upload function SSRF
TL;DR
New Writeup❗️
Date: Sun, 01 Nov 2020 20:12:58 GMT
Title: An often overlooked Oauth misconfiguration.
Link: https://medium.com/p/7d2d441eae1f
Date: Sun, 01 Nov 2020 20:12:58 GMT
Title: An often overlooked Oauth misconfiguration.
Link: https://medium.com/p/7d2d441eae1f
Medium
An often overlooked Oauth misconfiguration.
Good afternoon.
New Writeup❗️
Date: Thu, 24 Jun 2021 13:35:34 GMT
Title: From Information Disclosure to interesting Privilege Escalation
Link: https://medium.com/p/61ed3aaaf218
Date: Thu, 24 Jun 2021 13:35:34 GMT
Title: From Information Disclosure to interesting Privilege Escalation
Link: https://medium.com/p/61ed3aaaf218
Medium
From Information Disclosure to interesting Privilege Escalation
Cool information disclosure which leads me to be an admin of the application eventually.
New Writeup❗️
Date: Wed, 15 Feb 2023 19:13:06 GMT
Title: Leaking internal CMS_OIDs gives access to internal Facebook support pages.
Link: https://medium.com/p/6ed1dbd94c11
Date: Wed, 15 Feb 2023 19:13:06 GMT
Title: Leaking internal CMS_OIDs gives access to internal Facebook support pages.
Link: https://medium.com/p/6ed1dbd94c11
Medium
Leaking internal CMS_OIDs gives access to internal Facebook support pages.
The Facebook help or support centre consists from 2 levels
New Writeup❗️
Date: Mon, 31 Jan 2022 15:25:30 GMT
Title: Disclose author of anonymous post on GAAP GraphQL object
Link: https://medium.com/p/b07145966b8
Date: Mon, 31 Jan 2022 15:25:30 GMT
Title: Disclose author of anonymous post on GAAP GraphQL object
Link: https://medium.com/p/b07145966b8
Medium
Disclose author of anonymous post on GAAP GraphQL object
The Facebook GraphQL object GroupAnonAuthorProfile has a field which lead to infer identity of author of anonymous post.
New Writeup❗️
Date: Thu, 26 Aug 2021 10:27:38 GMT
Title: Show Facebook stack trace error messages
Link: https://medium.com/p/97485f04898a
Date: Thu, 26 Aug 2021 10:27:38 GMT
Title: Show Facebook stack trace error messages
Link: https://medium.com/p/97485f04898a
Medium
Show Facebook stack trace error messages
Some raw stack trace error messages could be showed to the user when doing specific requests. include debugging info and some filenames…
New Writeup❗️
Date: Sun, 18 Apr 2021 19:31:25 GMT
Title: (POC) Untrim any live video on Facebook
Link: https://medium.com/p/ad6b97bad7c0
Date: Sun, 18 Apr 2021 19:31:25 GMT
Title: (POC) Untrim any live video on Facebook
Link: https://medium.com/p/ad6b97bad7c0
Medium
(POC) Untrim any live video on Facebook
Description / Impact
New Writeup❗️
Date: Sat, 17 Apr 2021 22:29:08 GMT
Title: (POC) Update business fyi message as Facebook page analyst
Link: https://medium.com/p/d36170fdede2
Date: Sat, 17 Apr 2021 22:29:08 GMT
Title: (POC) Update business fyi message as Facebook page analyst
Link: https://medium.com/p/d36170fdede2
Medium
(POC) Update business fyi message as Facebook page analyst
Description / Impact
New Writeup❗️
Date: Sat, 17 Apr 2021 20:10:00 GMT
Title: (POC) Remove any Facebook’s live video ($14,000 bounty)
Link: https://medium.com/p/70c8135b7b4c
Date: Sat, 17 Apr 2021 20:10:00 GMT
Title: (POC) Remove any Facebook’s live video ($14,000 bounty)
Link: https://medium.com/p/70c8135b7b4c
Medium
(POC) Remove any Facebook’s live video ($14,000 bounty)
Description / Impact
New Writeup❗️
Date: Tue, 22 Oct 2019 18:41:36 GMT
Title: (POC) Disclose members in any closed Facebook group
Link: https://medium.com/p/259783fa4bf
Date: Tue, 22 Oct 2019 18:41:36 GMT
Title: (POC) Disclose members in any closed Facebook group
Link: https://medium.com/p/259783fa4bf
Medium
(POC) Disclose members in any closed Facebook group
Description / Impact
New Writeup❗️
Date: Tue, 23 Feb 2021 02:53:52 GMT
Title: Privilege Escalation from Improper Access Control [Medium] — $700
Link: https://medium.com/p/51c44a3cb53f
Date: Tue, 23 Feb 2021 02:53:52 GMT
Title: Privilege Escalation from Improper Access Control [Medium] — $700
Link: https://medium.com/p/51c44a3cb53f
Medium
Privilege Escalation from Improper Access Control [Medium] — $700
I will be discussing how I was able to leverage an Improper Access Control Vulnerability to a Privilege Escalation Vulnerability on one…
New Writeup❗️
Date: Mon, 08 Feb 2021 16:39:32 GMT
Title: Strict Rate Limiting Policy Leads to Massive DoS
Link: https://medium.com/p/268b20d354c8
Date: Mon, 08 Feb 2021 16:39:32 GMT
Title: Strict Rate Limiting Policy Leads to Massive DoS
Link: https://medium.com/p/268b20d354c8
Medium
Strict Rate Limiting Policy Leads to Massive DoS
I will be discussing an interesting observation on how policies implemented on Auth Endpoint could backfire and turn into massive DoS…
New Writeup❗️
Date: Wed, 06 Jan 2021 23:37:23 GMT
Title: Stored XSS on Product Description [HIGH] — $400
Link: https://medium.com/p/2f078fd70fd2
Date: Wed, 06 Jan 2021 23:37:23 GMT
Title: Stored XSS on Product Description [HIGH] — $400
Link: https://medium.com/p/2f078fd70fd2
New Writeup❗️
Date: Mon, 21 Feb 2022 15:59:02 GMT
Title: Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
Link: https://medium.com/p/90b27f6542b4
Date: Mon, 21 Feb 2022 15:59:02 GMT
Title: Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
Link: https://medium.com/p/90b27f6542b4
Medium
Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
It was found that unexpected behaviors in the query’s escape function could cause a SQL injection in mysqljs/mysql
New Writeup❗️
Date: Mon, 21 Jun 2021 14:55:57 GMT
Title: CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring.
Link: https://medium.com/p/e946bd69177a
Date: Mon, 21 Jun 2021 14:55:57 GMT
Title: CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring.
Link: https://medium.com/p/e946bd69177a
Medium
CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring.
Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.
New Writeup❗️
Date: Mon, 21 Jun 2021 06:34:48 GMT
Title: CVE-2020–15702 Race Condition vulnerability in handling of PID by apport
Link: https://medium.com/p/4047f2e00a67
Date: Mon, 21 Jun 2021 06:34:48 GMT
Title: CVE-2020–15702 Race Condition vulnerability in handling of PID by apport
Link: https://medium.com/p/4047f2e00a67
Medium
CVE-2020–15702 Race Condition vulnerability in handling of PID by apport
Note) It’s just an English version of previous post.
New Writeup❗️
Date: Tue, 24 Nov 2020 12:09:20 GMT
Title: How images on Github will leak your private information
Link: https://medium.com/p/88f3b563e7d9
Date: Tue, 24 Nov 2020 12:09:20 GMT
Title: How images on Github will leak your private information
Link: https://medium.com/p/88f3b563e7d9
Medium
How images on Github will leak your private information
I was browsing a github repository where a guy posted its food travel pictures and while the pics were very appetizing, my mind wondered…