Story of Abusing a Fully Secured redirect_uri in an OAuth Flow
Voorivex
Command Palette
Search for a command to run...
Archive
21 posts published so far
uXSS on Samsung Browser [CVE-2025-58485 SVE-2025-1879]
Omid Rezaei
When Two Parsers Disagree: Exploiting Query String Differentials for XSS
Amirmohammad Safari
Shaking the MCP Tree: A Security Deep Dive
Amirmohammad Safari
DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK
HamidSj
Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit
Amirmohammad Safari
Hacking Veeam: Several CVEs and $30k Bounties
Voorivex
Puny-Code, 0-Click Account Takeover
Voorivex
Stealing oAuth Token via Referrer Policy Override
Voorivex
CSS Data Exfiltration to Steal OAuth Token
Amirmohammad Safari
OAuth Non-Happy Path to ATO
Omid Rezaei
From an Android Hook to RCE: $5000 Bounty
Voorivex
A Weird CSP Bypass led to $3.5k Bounty
Omid Rezaei
Drilling the redirect_uri in OAuth
Voorivex
Account Takeover due to DNS Rebinding
Voorivex
$20,300 Bounties from a 200 Hour Hacking Challenge
Mohammad Zaheri
Hijacking OAuth Code via Reverse Proxy for Account Takeover
Omid Rezaei
$7000 Bounty on a Single Web Application
Ayrix
$9240 Bounty in 30 days Hunt Challenge
Omid Rezaei
Bug Bounty Roadmap from Scratch
Voorivex
Uncovering a Command Injection, $2400 Bounty
Omid Rezaei