Findings on Mazin Ahmed

Google UI-Redressing Bug That Discloses the User's Email Address

Fri, 08 Apr 2016 00:00:00 +0000

In this post, I will discuss an exciting bug affecting Google Blogger. This security bug has been left undiscovered since around 2007.

The bug allows an attacker to trick the victim into revealing his email address using UI-redressing techniques.

Background #

We always see a header on blogs that are hosted on Google Blogger that looks like the following:

For unauthenticated users:

Bypassing Google Password Alert with One Line of Code

Sat, 25 Jul 2015 00:00:00 +0000

Google Password Alert has become very popular recently. It’s practical and a great defensive way to mitigate phishing damages against Google users.

It has been bypassed several times as soon as it arrived, and Google has patched all the known techniques. After hearing that Google had patched all known techniques, I thought about testing it to see how long it would take me to bypass it.

My first idea was to use document.write and encode the phishing page in Unicode, and see the results. The method worked successfully in v1.12.

Facebook Messenger Multiple CSRF Vulnerabilities

Tue, 09 Jun 2015 00:00:00 +0000

In this post, I will demonstrate the findings of multiple interesting cross-site request forgery vulnerabilities I identified on Facebook. These vulnerabilities allow an attacker to force the victim to do various actions.

In April 2015, Facebook officially launched messenger.com, a stand-alone messenger for the web. After hearing about the launch, I started to test it in my spare time.

Sending Unrestricted Messages to Any User via CSRF #

Using this issue, I could force any user to send messages to other users without the user’s knowledge.

W3 Total Cache's W3TotalFail Vulnerability That Leads to Full Defacement (CVE-2014-9414)

Thu, 11 Dec 2014 00:00:00 +0000

In this post, I will be talking about a critical vulnerability that affects W3 Total Cache, the most popular WordPress plugin in the world. Most major companies use W3 Total Cache, which provides a vital service that every WordPress website needs.

Overview on W3 Total Cache #

“W3 Total Cache improves your site’s user experience by increasing server performance, reducing the download times, and providing transparent content delivery network (CDN) integration.”

Session Hijacking in Instagram Mobile App via MITM Attack [0-DAY]

Sat, 26 Jul 2014 00:00:00 +0000

In this post, I will share a new critical issue I identified on Instagram Mobile App. During my tests on their Android app, I set up a lab to pentest the app. Then, I started using the app on my phone and monitoring the traffic on the network using Wireshark, looking for evidence of unencrypted data that goes through the network or a technique to make this data unencrypted (if it were encrypted). As soon as I logged into my account on my phone, Wireshark captured unencrypted data that went through HTTP. This data includes the pictures the target is watching, the target’s session cookies, the username, and the ID.

My Story with Onavo (Acquired by Facebook)

Mon, 09 Jun 2014 00:00:00 +0000

When I was checking the Facebook WhiteHat page, I realized that they added a new target to the scope: Onavo.

I downloaded their apps and started to intercept the links that I found.

One of the links raised an eyebrow. I said to myself that this looks vulnerable.

The link looks something like this: http://cf.onavo.com/iphone/mc/deactivate.html?url=https://mazinahmed.net/somethingthatIforget/&seed=1394953248

It seems vulnerable to Open Redirect.

I executed the link like this: http://cf.onavo.com/iphone/mc/deactivate.html?url=http://bing.com&seed=1394953248.