Web-Security on Mazin Ahmed

Attacking GraphQL APIs (OWASP PNW 2024)

Wed, 16 Sep 2026 00:00:00 +0000

I spoke at OWASP AppSec Days Pacific Northwest 2024 in Vancouver about attacking GraphQL APIs.

The talk covered a range of GraphQL attacks and advanced attack vectors, along with the security considerations that are beyond the traditional checklists.

Slides #

PDF: Attacking GraphQL APIs - OWASP AppSec Days Pacific Northwest 2024.pdf
PowerPoint: Attacking GraphQL APIs - OWASP AppSec Days Pacific Northwest 2024.pptx

Speaker Preview #

The conference published a short speaker preview ahead of the talk.

The Path for Testing Path Traversal Vulnerabilities with Python

Sun, 12 Apr 2020 00:00:00 +0000

I have noticed an odd behavior in the requests module in Python, which uses urllib3. I inspected the root cause via regression testing, and I found that the root cause was a change introduced in urllib3.

import requests
requests.get("http://127.0.0.1/../../../../doing/certain/check")

This should typically send the request to /../../../../doing/certain/check. Instead, it requests /doing/certain/check and modifies the specified input.

The reason is dot-segment normalization, following RFC3986.

The change to normalize URIs was introduced in this commit[1] to follow RFC3986[2]. The change is based on the “Remove Dot Segments” section in the RFC.

Search Engine Abuse in Popular Social Networks

Fri, 17 May 2019 12:03:11 +0000

This is a blog post by Mazin Ahmed and Khaled Farah.

Introduction #

Popular social networks are affected by a “by-design” security vulnerability that allows unauthorized parties to control their search history. Unauthorized parties are capable of inserting their own chosen keywords in the search history of Google, Facebook, LinkedIn, and YouTube.

Technical Details #

The bug is relatively simple in terms of explanation and exploitation. It has been reported by us, and possibly by others to the social networks, and it was marked as an “acceptable risk” by the affected companies. We agree it’s a low risk issue, but due to the trivial exploitation of this attack, it may be a good idea to implement a fix. We’re releasing a blog article to open a public discussion regarding the vulnerability.