@YShahinzadeh Profile picture

YS

@YShahinzadeh

Bug hunter, Security consultant and instructor

Similar User
mohammed eldeeb photo

@malcolmx0x

Amirabbas Ataei photo

@ImAyrix

Sadra photo

@MrMSA16

Mohammad Nikouei photo

@NikoueiMohammad

Lu3ky13 ⚡️⚡️ photo

@lu3ky13

 یاشو photo

@voorivex

AmirMohammad Safari photo

@AmirMSafari

A.fahimi photo

@af4himi

Abbas Heybati photo

@abbas_heybati

MorningStar photo

@0xMstar

LIL NIX photo

@thelilnix

Patrik Fehrenbach photo

@ITSecurityguard

Vegeta photo

@_justYnot

 Arman photo

@m7arm4n_

Esmaeil Rahimian photo

@H_Mosafer

YS Reposted

we are using @hashnode for our team blog (blog.voorivex.team). I submitted several reports, which they triaged however we are still discussing about the amount of bounty, but they have added my name to the Hall of Fame. thanks hashnode.com/hall-of-fame


YS Reposted

A few months ago, @YShahinzadeh and I were working on a famous company and managed to chain some flaws + CSP bypass, which resulted in an account takeover and a $3500 bounty. You can read the full article here. blog.voorivex.team/a-weird-csp-by…


since my last tweet about OAuth was welcomed, I decided to expand on my methodology in a blog post, do not skip OAuth authentication, even when testing public and well-known companies in bug bounty programs. I hope you find it useful blog.voorivex.team/drilling-the-r…


In OAuth, always look for custom implementations. In this case, there were two redirects. One was stored in the redirect_uri, which was completely safe (handled by Google). 2nd redirect was stored in the state parameter (JSON object), making it vulnerable to 1-click ATO :)

Tweet Image 1

just reported a DOM based XSS on a famous public program (payment section), can you spot the vulnerability? can you write an exploit code for it?

Tweet Image 1
Tweet Image 2

Hunting in an empty house while the maintenance crews are working, we’re both getting things done 😎

Tweet Image 1

got 26k in Q3 (I'm not a full time hunter). Still my favorites vulns are ATOs related to oAtuh, SSO and etc + DOM XSS. gonna publish some blog posts soon

Tweet Image 1

Recently, two of my bugs (totally 15 vulns, critical, high, medium, etc) got CVE number, CVE-2024-29849, CVE-2024-42024 (on Veeam product). I'm thinking of writing a blog post about my methodology in near future


YS Reposted

Great tip! But how does removing email from the scope lead to account takeover? Let’s look at how OAuth works. After you verify your identity with the OAuth provider and return to the app with a token, the app asks the OAuth provider to validate the token and return user info \1

Tweet Image 1

According to @itscachemoney, this sometimes leads to account takeover vulnerabilities. 🤯#BugBountyTip #HackWithIntigriti

Tweet Image 1


After a long time, I decided to disclose a DNS Rebinding vulnerability (including CloudFlare’s automated Python code) that I found a few months ago. I hope you find it useful: blog.voorivex.team/account-takeov…


YS Reposted

I saw this bug bounty tip recently, but have you thought about how it happens in an app? For implementing authentication mechanism, there are methods like tokens, sessions, and more. Imagine we have an app that uses JWT. This app relies on a secret key to sign the JWT tokens \1

Tweet Image 1

#bugbountytips #bugbounty How I was able to find multiple critical vulnerabilities to get Full Account Takeover with the help of PlayStore and AppStore region settings.

Tweet Image 1


YS Reposted

True story

Tweet Image 1

YS Reposted

This month, I managed to earn around $18.5k bounty from a public program on @Hacker0x01 after a year full of effort. One year ago, I earned $16.3k from a single report on a public program by creating a custom Nuclei template (merged in official repo). #BugBounty #bugbountytips

Tweet Image 1
Tweet Image 2
Tweet Image 3
Tweet Image 4

I've designed a web challenge based on a real-world vulnerability. the stack is NextJS and you should dig the web application, so drop tools and start hunting :) r.voorivex.academy

Tweet Image 1

Loading...

Something went wrong.


Something went wrong.