Tags

#blog-archive-2014

• Acknowledged By Oracle

• Open Redirector on Google.com

• SQL Injection and Cross-site Scripting at the website of the University of Calgary

• PHP Code Execution on Bugcrowd

• Cross-Site Scripting on Wikileaks

• My Story with Onavo (a Facebook's Acquisition)

#findings

• My Story with Onavo (a Facebook's Acquisition)

• Session Hijacking in Instagram Mobile App via MITM Attack [0-DAY]

• W3 Total Cache's W3TotalFail Vulnerability That Leads to Full Defacement (CVE-2014-9414)

• Facebook Messenger Multiple CSRF Vulnerabilities

• Bypassing Google Password Alert with One Line of Code

• Google UI-Redressing Bug That Discloses The User's Email Address

#blog

• Session Hijacking in Instagram Mobile App via MITM Attack [0-DAY]

• W3 Total Cache's W3TotalFail Vulnerability That Leads to Full Defacement (CVE-2014-9414)

• Summary of HSTS Support in Modern Browsers

• Facebook Messenger Multiple CSRF Vulnerabilities

• Bypassing Google Password Alert with One Line of Code

• Evading All Web-Application Firewalls XSS Filters

• Why Prebuilt Security Browsers are Bad: Introducing Firefox Security Toolkit

• Bypassing NoScript Security Suite Using Cross-Site Scripting and MITM Attacks

• Google UI-Redressing Bug That Discloses The User's Email Address

• Backup-File Artifacts: The Underrated Web-Danger

• Bug Bounty Hunting - Swiss Cyber Storm 2016

• Exploiting Misconfigured Apache server-status Instances with server-status_PWN

• Using Ubuntu .DESKTOP as a Malware Vector

• Starting in InfoSec - 101

• [Book Review] ModSecurity Handbook - 2nd Edition

• Bypassing CSP by Abusing JSONP Endpoints

• Using HTML Attribute Separators for Bypassing WAF XSS Filters

• Creating an Emojis PHP WebShell

• Practical Protection Against DNS Rebinding Attacks

• Backchannel Leaks on Strict Content-Security Policy

• [Research] Overview of the Application-Level Security of the Swiss Evoting System

• Practical Approaches for Testing and Breaking JWT Authentication

• Book Review: WASEC By Alessandro Nadalin

• OhMyZsh dotenv Remote Code Execution

• Hacking Zoom: Uncovering Tales of Security Vulnerabilities in Zoom

• Interview with Sectastic Podcast: How I started, What is FullHunt, and How are Security Startups in the GCC Region

• DDoS is not Dead: Building a Scalable DDoS Framework

• tfquery: Run SQL queries on your Terraform infrastructure

• Interview With the AppSec Podcast: Terraform Security

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

• Scan Terraform plans and changes with tfquery via SQL-powered framework

• Shennina Framework - Automating Host Exploitation with AI

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

• Speaking at BlakcHat MEA 2022

• Secrets Patterns DB: Building Open-Source Regex Database for Secret Detection

#research

• Session Hijacking in Instagram Mobile App via MITM Attack [0-DAY]

• W3 Total Cache's W3TotalFail Vulnerability That Leads to Full Defacement (CVE-2014-9414)

• Summary of HSTS Support in Modern Browsers

• Evading All Web-Application Firewalls XSS Filters

• Why Prebuilt Security Browsers are Bad: Introducing Firefox Security Toolkit

• Bypassing NoScript Security Suite Using Cross-Site Scripting and MITM Attacks

• Backup-File Artifacts: The Underrated Web-Danger

• Exploiting Misconfigured Apache server-status Instances with server-status_PWN

• Using Ubuntu .DESKTOP as a Malware Vector

• Bypassing CSP by Abusing JSONP Endpoints

• Using HTML Attribute Separators for Bypassing WAF XSS Filters

• Creating an Emojis PHP WebShell

• Practical Protection Against DNS Rebinding Attacks

• Backchannel Leaks on Strict Content-Security Policy

• [Research] Overview of the Application-Level Security of the Swiss Evoting System

• Practical Approaches for Testing and Breaking JWT Authentication

• OhMyZsh dotenv Remote Code Execution

• Hacking Zoom: Uncovering Tales of Security Vulnerabilities in Zoom

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

• Shennina Framework - Automating Host Exploitation with AI

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

• Secrets Patterns DB: Building Open-Source Regex Database for Secret Detection

#blog-archive-2015

• My Experience with eBay Bug Bounty Program

#book-review

• [Book Review] ModSecurity Handbook - 2nd Edition

• Book Review: WASEC By Alessandro Nadalin

#ModSecurity

• [Book Review] ModSecurity Handbook - 2nd Edition

#web-security

• The Path for Testing Path Traversal Vulnerabilities with Python

#automation

• The Path for Testing Path Traversal Vulnerabilities with Python

#thoughts

• Bad Marketing: COVID-19 and Cyber Security

#zoom

• Hacking Zoom: Uncovering Tales of Security Vulnerabilities in Zoom

#interview

• Interview with Sectastic Podcast: How I started, What is FullHunt, and How are Security Startups in the GCC Region

• Interview With the AppSec Podcast: Terraform Security

#podcast

• Interview with Sectastic Podcast: How I started, What is FullHunt, and How are Security Startups in the GCC Region

• Interview With the AppSec Podcast: Terraform Security

#project

• DDoS is not Dead: Building a Scalable DDoS Framework

• tfquery: Run SQL queries on your Terraform infrastructure

• Secrets Patterns DB: Building Open-Source Regex Database for Secret Detection

#stressful

• DDoS is not Dead: Building a Scalable DDoS Framework

#terraform

• tfquery: Run SQL queries on your Terraform infrastructure

• Interview With the AppSec Podcast: Terraform Security

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Scan Terraform plans and changes with tfquery via SQL-powered framework

#devops

• tfquery: Run SQL queries on your Terraform infrastructure

• Interview With the AppSec Podcast: Terraform Security

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

• Scan Terraform plans and changes with tfquery via SQL-powered framework

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

#devsecops

• tfquery: Run SQL queries on your Terraform infrastructure

• Interview With the AppSec Podcast: Terraform Security

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

• Scan Terraform plans and changes with tfquery via SQL-powered framework

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

#cloudsecurity

• tfquery: Run SQL queries on your Terraform infrastructure

• Interview With the AppSec Podcast: Terraform Security

• Attacking Modern Environments Series: Attack Vectors on Terraform Environments

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

• Scan Terraform plans and changes with tfquery via SQL-powered framework

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

#twitch

• Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

#tfquery

• Scan Terraform plans and changes with tfquery via SQL-powered framework

#tfplan

• Scan Terraform plans and changes with tfquery via SQL-powered framework

#shennina

• Shennina Framework - Automating Host Exploitation with AI

#exploitation

• Shennina Framework - Automating Host Exploitation with AI

#post-exploitation

• Shennina Framework - Automating Host Exploitation with AI

#host-exploitation

• Shennina Framework - Automating Host Exploitation with AI

#conference

• DoS Attacks are Dead: Demystifying Practical DoS Attacks

• Speaking at BlakcHat MEA 2022