Started this week with an awesome bug. What followed was a chain of APIs, 3 subdomains, and 300K+ exposed records!
Here's how it unfolded:
1)Fired up GLM's ZCode Harness with my recon skill. Within few minutes, it spotted an interesting API endpt burried in a minified JS bundle
7) One identifier had become the bridge between two APIs and a much larger data exposure.
Full chain:
- Recon identified the first endpt in minified Javascript
- Auth BOLA exposed other user's names and ucode values
- Prod testing confirmed the issue wasn't limited to QA.
Finally got around to this DEFCON talk a year later, and now that I’m familiar with Android security, seeing how the Xiaomi 13P exploit chain came together was so much fun!
Absolutely loved the talk! esp. the mini heart attacks😭
youtu.be/B0A8F_Izmj0
Props to @Yogehi & Ilyes
Had an absolute banger with this one! Finally wrapped up and captured the flag for "KYC Me If You Can" by @MobileHackLab
Check out the full writeup here: medium.com/@ibzsaify/bypassi…
#MobileSecurity #AndroidHacking #ReverseEngineering #Cybersecurity #AppSec #CTF
Found an exposed auth prod API that accepted a victim's phone number and returned the generated OTP directly in the API response!
It could then be used to log in as the victim via the app resulting in account takeover and access to PII, identity documents etc.
Crazyy shi fr💀
As tensions rise between the US and Iran, cyber risks to critical infrastructure are also escalating.
In 2024, a pro-Iranian actor reportedly used ChatGPT to research exposed industrial control systems, including ports, default credentials, & internet-facing devices. Read More.
The key shift is that AI is compressing the research phase of cyberattacks. Tasks that once required years of specialized ICS knowledge can now be accelerated using AI combined with open-source intelligence.
Not a new weapon, just a faster way to find weak doors.
Read More...
Full blog: [cloudsek.com/blog/ai-the-ira…](cloudsek.com/blog/ai-the-ira…)
Author Profile: cloudsek.com/authors/ibrahim…
#Cybersecurity #ICS #AI #CriticalInfrastructure
With Thanksgiving & Black Friday coming up, we’re seeing a spike in fake online stores impersonating major brands. Two clusters found: Amazon typosquats + 1K+ .shop domains mimicking Samsung, Xiaomi & more!
Blog: cloudsek.com/blog/cloudsek-d…
Author Profile: cloudsek.com/authors/ibrahim…
🔍 Red flags:
• 70–90% unrealistic discounts
• Domains ending in safe, sale, fast, shop
• Flashy red banners + fake “low stock” alerts
• Newly created domains, & other such indicators
Stay safe this holiday season.
#CyberSecurity #BlackFriday #Phishing #Fraud #HolidayScams
I recently came across a post from ransomware[.]live about the Spacebears Ransomware Group and their latest victim.
I was able to deanonymize their Onion Data Leak Site (DLS) and uncover the following details:
DLS IP: 92.51.2[.]31
ASN: 209588
Enabled Ports: 22, 80, and 3389
Pivot: DLS Onion Site Title & Server Information
FOFA Query: (title="Space Bears") && (server=="nginx/1.18.0 (Ubuntu)")
#ThreatIntelligence #OSINT
#ransomwaregroup #CyberSecurity #ransomware
Ibrahim retweeted
Our investigation exposes how this TA sold over 6,500+ fake licenses to more than 4,500+ buyers, generating $785,000 in profit using a vast infrastructure of 83+ domains.
@ScammerPayback @NanoBaiter @_JohnHammond @Kitboga @MichalKoczwara