Blog-Archive-2014 on Mazin Ahmed

My Story with Onavo (Acquired by Facebook)

Mon, 09 Jun 2014 00:00:00 +0000

When I was checking the Facebook WhiteHat page, I realized that they added a new target to the scope: Onavo.

I downloaded their apps and started to intercept the links that I found.

One of the links raised an eyebrow. I said to myself that this looks vulnerable.

The link looks something like this: http://cf.onavo.com/iphone/mc/deactivate.html?url=https://mazinahmed.net/somethingthatIforget/&seed=1394953248

It seems vulnerable to Open Redirect.

I executed the link like this: http://cf.onavo.com/iphone/mc/deactivate.html?url=http://bing.com&seed=1394953248.

Cross-Site Scripting on WikiLeaks

Wed, 19 Feb 2014 00:00:00 +0000

I have reported a Cross-Site Scripting vulnerability on WikiLeaks’ new search engine. WikiLeaks has fixed the vulnerability promptly.

UPDATE: Read this article for more info: https://news.softpedia.com/news/XSS-Vulnerability-Found-in-WikiLeaks-Internal-Search-Engine-428166.shtml

PHP Code Execution on Bugcrowd

Thu, 13 Feb 2014 00:00:00 +0000

I have identified a PHP code execution vulnerability on Bugcrowd. Bugcrowd is the premier marketplace for security testing on web, mobile, source code, and client-side applications, with over 7000 security researchers participating in their bug bounty platform.

Acknowledged By Oracle

Thu, 06 Feb 2014 00:00:00 +0000

Oracle has acknowledged me for finding a Cross-Site Scripting Vulnerability.

Open Redirector on Google.com

Thu, 06 Feb 2014 00:00:00 +0000

I have found and reported an Open Redirector vulnerability on google.com.

The response of the security team was the following:

To demonstrate the impact of the vulnerability, I have made this video:

SQL Injection and Cross-site Scripting at the website of the University of Calgary

Thu, 06 Feb 2014 00:00:00 +0000

I have reported several critical vulnerabilities, such as SQL Injection and Cross-site Scripting, to the IT support center of the University of Calgary. The university has fixed the issues successfully.