Research on Mazin Ahmed

Attacking GraphQL APIs (OWASP PNW 2024)

Wed, 16 Sep 2026 00:00:00 +0000

I spoke at OWASP AppSec Days Pacific Northwest 2024 in Vancouver about attacking GraphQL APIs.

The talk covered a range of GraphQL attacks and advanced attack vectors, along with the security considerations that are beyond the traditional checklists.

Slides #

PDF: Attacking GraphQL APIs - OWASP AppSec Days Pacific Northwest 2024.pdf
PowerPoint: Attacking GraphQL APIs - OWASP AppSec Days Pacific Northwest 2024.pptx

Speaker Preview #

The conference published a short speaker preview ahead of the talk.

Preventing Prompt Injection Attacks at Scale

Mon, 09 Jun 2025 00:00:00 +0000

Prompt injection attacks are one of the most common LLM security threats we have all seen while reviewing LLM implementations, integrations, and AI-powered systems.

I have identified Prompt Injection attacks in numerous implementations and applications, and I’ve decided to write a blog post to recommend different methodologies I experimented with that can prevent prompt injection at scale.

I will also share a LangChain Prompt Injection attack vector, vulnerabilities in example MCP implementations, and practical ways to prevent prompt injection attacks.

Introducing LLMQuery Framework: Scaling GenAI Automation with Prompt Templates

Mon, 13 Jan 2025 00:00:00 +0000

Large Language Models have completely changed how we automate, create, and solve problems.

Integrating and experimenting with these models across different providers, along with optimizing LLM prompts and benchmarking them, can feel overwhelming. That’s why I built llmquery this year, to make interacting with Large Language Models and prototyping new GenAI-powered applications simpler and faster.

llmquery is all about making it easier to prototype new applications and use cases. It just starts with writing a single YAML template (or using one of the built-in YAML templates available) where the YAML template handles all the overhead of integrating with commercial and local providers, helping with validating models, calculating tokens, setting limits, rendering templates, and other checks.

Engineering Learnings from the CrowdStrike Falcon Outage

Fri, 26 Jul 2024 00:00:00 +0000

What Happened? #

On July 18, 2024, the world witnessed a global outage that disrupted major industries, including banking, airlines, healthcare, oil and gas, and governments. The outage was caused by a faulty software update by CrowdStrike that left Windows computers in a continuous BSOD (Blue Screen of Death) loop.

(Banners of Time Square are showing Windows BSOD as a result of the CrowdStrike incident)

Secrets Patterns DB: Building Open-Source Regex Database for Secret Detection

Tue, 07 Feb 2023 00:00:00 +0000

Ensuring the security of your organization’s sensitive information is critical for any security team, and detecting secrets is a key part of that. However, even if you have implemented advanced security controls, your program may still be at risk if passwords and API keys are committed to GitHub and subsequently exposed in a production environment, whether through a live web application, a compiled mobile app, or minified JavaScript code. To mitigate this risk, secrets must be secured and managed properly throughout development.

DoS Attacks are Dead: Demystifying Practical DoS Attacks

Sun, 04 Dec 2022 00:00:00 +0000

I recently spoke at BlackHat MEA 2022, the largest security conference in the Middle East and Africa region. My talk, titled “Demystifying Practical DoS Attacks”, focused on the increasing threat of DoS attacks and the need for improved defense solutions and for practical validation of current DDoS prevention solutions.

In my presentation, I shared my research on practical DoS attacks, including recent Application-Level DoS attacks and evasion techniques. I also discussed the discovery of unique DoS vectors in modern APIs and demonstrated how to simulate the most significant Layer 7 DDoS attack that Google Cloud experienced in August 2022.

Shennina Framework - Automating Host Exploitation with AI

Tue, 08 Nov 2022 00:00:00 +0000

In 2019, Khaled Farah and I participated in a security competition for developing offensive security tools.

I enjoy building security tools, and this competition was funded by HITB (Hack-in-the-Box) with a reward of $100,000 for the winners. It would be an exciting challenge to work on as a side project.

I met my friend Khaled, who was also interested in winning this competition. We signed up, and once accepted, we started meeting regularly to build this project.

Twitch Internal Security Tools: In-depth Analysis of the Leaked Twitch Security Tools

Wed, 01 Jun 2022 00:00:00 +0000

#

How was Twitch hacked? What security controls did Twitch build?

The Twitch breach revealed more than 120 internal security tools developed by the Twitch Security team.

I analyzed all the leaked security tools that were developed by Twitch Security. Check out the full research.

Background #

Twitch is an interactive live-streaming service for content, gaming, entertainment, sports, and music. In 2015, Amazon acquired Twitch for $970 million, and after COVID-19 time, its market value skyrocketed as more people adapted to live-streaming from home.

Attacking Modern Environments Series: Attack Vectors on Terraform Environments

Sat, 29 Jan 2022 00:00:00 +0000

I have given a talk about my latest research, “Attack Vectors on Terraform Environments”.

About the talk #

Have you ever encountered an environment in an engagement that uses Terraform for IaC (infrastructure-as-code) management? Almost every modern company does now.

In this talk, I will share techniques and attack vectors to exploit and compromise Terraform environments in engagements, along with patterns I have seen that achieve successful infrastructure takeover against companies. I will also cover detection and prevention methods for each attack vector discussed in my talk.

Hacking Zoom: Uncovering Tales of Security Vulnerabilities in Zoom

Sun, 09 Aug 2020 00:00:00 +0000

Hacking Zoom #

Uncovering Tales of Security Vulnerabilities in Zoom #

This blog post discusses my experiments in testing and hacking Zoom.

Zoom has become one of the most high-performing tech companies of 2020. Zoom is a digital video conferencing software that went public in an IPO last year1, a few months before the global pandemic.

OhMyZsh dotenv Remote Code Execution

Wed, 08 Apr 2020 00:00:00 +0000

Abstract #

OhMyZsh was vulnerable to an RCE (Remote Code Execution) vulnerability due to arbitrarily trusting ENV files in the dotenv plugin. Users downloading a malicious repository or a compressed file can have their machines compromised due to the vulnerability.

Background #

OhMyZsh is a highly popular framework for managing ZSH configuration. At the time of writing, it’s ranked in the top 10 GitHub repositories across all projects.

Practical Approaches for Testing and Breaking JWT Authentication

Fri, 25 Oct 2019 00:00:00 +0000

Introduction #

JWT (JSON Web Token) is a popular authentication/authorization protocol. It integrates cryptographic signatures into JSON objects to verify the object’s integrity.

The approach of JWT is systematic and relatively simple. Several pieces of research covered the security aspects of JWT authentication.

Several tools were also previously developed. However, after assessing the quality of the public tools, I concluded that we need better tools to perform testing against JWT. I have developed a set of scripts I call “jwt-pwn” that aims to test JWT authentication with stability, simplicity, and efficiency in mind. The script set is straightforward, integrating directly with the JWT Python library.

[Research] Overview of the Application-Level Security of the Swiss E-voting System

Tue, 16 Apr 2019 00:00:00 +0000

I’m publishing my security research on the overview of the application-level security of the Swiss E-voting system.

You can download the report at the following link:

Download: Overview of the Application-Level Security of the Swiss Evoting System

Best Regards,
Mazin Ahmed

Backchannel Leaks on Strict Content-Security Policy

Fri, 18 Jan 2019 00:00:00 +0000

Abstract #

Content-Security Policy (CSP) is one of the most important protection layers in client-side web security. A strict policy should not allow external communications to non-permitted hosts. This blog post demonstrates a bypass I found in Chrome and Firefox that permits backchannel communication leaks by requesting non-permitted domains.

Background #

I recently discussed how CSP can secure web applications against backchannel leaks. The concept sounded reasonable at first sight; CSP is designed to block unauthorized content from loading, which generically blocks XSS attacks and unsafe loading of remote JavaScript (and various resources and contents) from unauthorized origins.

Practical Protection Against DNS Rebinding Attacks

Tue, 31 Jul 2018 00:00:00 +0000

Background #

DNS rebinding is a known attack against the same origin policy of modern browsers.

The attack abuses DNS, where a request with a small TTL is set. After the TTL is reached, another query resolves to another IP address (a local or internal IP address in typical cases). This way, an unauthorized party can bypass the same origin policy by loading malicious code on browsers and executing it against local or internal networks. Theoretically speaking, SOP prevents this from happening. However, DNS rebinding can bypass this protection in certain circumstances.

Creating an Emojis PHP Webshell

Mon, 23 Jul 2018 00:00:00 +0000

I recently came across an interesting behavior in PHP. PHP permits the usage of Unicode characters as variable names. Therefore, friendly emojis can be used as a PHP variable.

<?php
$😶="Hello World!";
echo($😶);

Output: #

>> Hello World!

Which is valid.

I thought about making a fancy example of a PHP webshell using emojis. This is made for entertainment purposes. No real advantage is gained by using an emoji webshell. It may disturb/confuse a WAF or back-end parser, but it’s not confirmed against a real-world environment.

Using HTML Attribute Separators for Bypassing WAF XSS Filters

Tue, 17 Jul 2018 00:00:00 +0000

Abstract #

This is an experiment I have done to identify and utilize attribute separators in constructing XSS vectors. The crafted vectors can be used to bypass XSS filters on modern browsers. These characters can be used in bypassing WAF XSS filters.

Background #

An example of a common XSS vector is:

Bypassing CSP by Abusing JSONP Endpoints

Tue, 16 Jan 2018 00:00:00 +0000

This blog post discusses a technique that can be used to bypass CSP (Content Security Policy).

Background #

What is CSP? #

“Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.” — Mozilla Developer Documentation.

Using Ubuntu .DESKTOP as a Malware Vector

Sat, 08 Apr 2017 00:00:00 +0000

I have noticed a weird behavior in .DESKTOP file extensions that can be used as a malware vector. This issue is not detected as malware by any known AVs, and the way it behaves makes it a rich resource for spreading malware against Ubuntu and Linux Desktop users in general. I will focus on Ubuntu Desktop in this blog post.

Introduction #

File managers on Ubuntu (Nautilus, Caja, and Thunar are tested) treat .desktop files specially. They parse .desktop and view the files as saved in their .desktop entry. In addition, it also changes the file icon to the one specified in the .desktop entry.

Exploiting Misconfigured Apache server-status Instances with server-status_PWN

Fri, 13 Jan 2017 00:00:00 +0000

One of the things that my clients like in my work is that I always like to do my best in providing technical Proof of Concepts in findings I discover. This makes it easier for technical departments to reproduce the issues and is also an excellent way to show how bugs and issues can be exploited.

I recently had an assessment where I discovered several publicly exposed Apache server-status instances. If you are unfamiliar with Apache server-status, please read this document.

Backup-File Artifacts: The Underrated Web-Danger

Thu, 18 Aug 2016 00:00:00 +0000

Testing and Exploiting Backup-File Artifacts with BFAC #

On August 13th, 2016, I talked about Backup-File Artifacts. This attack vector is not commonly known, nor tested by penetration testers, yet it can be critical to the security of the web environment. At the end of the talk, I released BFAC, an automated security tool that tests for Backup-File Artifacts missed on web servers and can disclose the web application’s source code.

Bypassing NoScript Security Suite Using Cross-Site Scripting and MITM Attacks

Thu, 17 Mar 2016 00:00:00 +0000

Recently, I have been working on research that discusses various techniques for bypassing the protection of the NoScript Security Suite.

In this paper, I have demonstrated techniques that can be used to bypass the NoScript Security Suite using MITM attacks. I have also provided a valid proof of concept that can be used in real-world attacks. Furthermore, I have shown how bypassing NoScript Security is possible using a single cross-site scripting vulnerability against the default allowlisted sites.

Why Prebuilt Security Browsers are Bad: Introducing Firefox Security Toolkit

Tue, 03 Nov 2015 00:00:00 +0000

This post will discuss why a professional penetration tester should not use OWASP Mantra or HconSTF. I will also introduce “The Firefox Security Toolkit,” a simple tool I have built that can be an excellent replacement for these two projects and provides better security for the penetration tester.

What are OWASP Mantra and HconSTF? #

OWASP Mantra & HconSTF are browsers that are explicitly made for penetration testers. They provide many extensions that can help penetration testers do their daily work. They’re focused on testing web applications. The concept of the project seems decent, but those browsers have many issues.

Evading All Web-Application Firewalls XSS Filters

Wed, 09 Sep 2015 00:00:00 +0000

During recent months, I have been working on research showing that all web application firewalls fail to protect against attacks as expected. The research focuses on evading the XSS filters of all popular web application firewalls, such as F5 Big IP, Imperva Incapsula, AQTRONIX WebKnight, PHP-IDS, ModSecurity, Sucuri, QuickDefense, and Barracuda WAF. All of them were evaded in the research.

After evading the products, I have worked with vendors to patch all the discovered issues. The research should have been published in July 2015, but as a supporter of the responsible disclosure concept, I waited for companies to patch the bypasses and get their final responses.

Summary of HSTS Support in Modern Browsers

Fri, 29 May 2015 00:00:00 +0000

I have recently released an article about HSTS Policy in Modern Browsers. It has been released on ProtonMail Blog.

Title: Summary of HSTS Support in Modern Browsers #

Date of Publish: May 28th, 2015 #

Link: https://blog.protonmail.ch/summary-of-hsts-support-in-modern-browsers/ #

In case there are any issues in viewing the article, you can download the article in PDF via the following links:

W3 Total Cache's W3TotalFail Vulnerability That Leads to Full Defacement (CVE-2014-9414)

Thu, 11 Dec 2014 00:00:00 +0000

In this post, I will be talking about a critical vulnerability that affects W3 Total Cache, the most popular WordPress plugin in the world. Most major companies use W3 Total Cache, which provides a vital service that every WordPress website needs.

Overview on W3 Total Cache #

“W3 Total Cache improves your site’s user experience by increasing server performance, reducing the download times, and providing transparent content delivery network (CDN) integration.”

Session Hijacking in Instagram Mobile App via MITM Attack [0-DAY]

Sat, 26 Jul 2014 00:00:00 +0000

In this post, I will share a new critical issue I identified on Instagram Mobile App. During my tests on their Android app, I set up a lab to pentest the app. Then, I started using the app on my phone and monitoring the traffic on the network using Wireshark, looking for evidence of unencrypted data that goes through the network or a technique to make this data unencrypted (if it were encrypted). As soon as I logged into my account on my phone, Wireshark captured unencrypted data that went through HTTP. This data includes the pictures the target is watching, the target’s session cookies, the username, and the ID.