Ahmed Ehab

This is 🥭
0xACED

[Ahmed Ehab @HeBo117]

(ذَ ٰ⁠لِكَ فَضۡلُ ٱللَّهِ یُؤۡتِیهِ مَن یَشَاۤءُۚ وَٱللَّهُ ذُو ٱلۡفَضۡلِ ٱلۡعَظِیمِ)

[Ahmed Ehab @HeBo117]

@SirBagoza جاري إعادة امجاد شقة السليمانية

[Ahmed Ehab @HeBo117]

@SirBagoza عرفت مكان بيعملها اجمد
لازم تيجي نخبطلنا خروفين

[Sonar Research @Sonar_Research]

Shellcode execution as a service!

To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique:

https://t.co/HvWtrNbbK5

#appsec #security #vulnerability

[Ahmed Ehab @HeBo117]

@mountainaddict0 اللي انت عملته غلط حتا لو نصبوا عليك زي مانتا بتقول
وانت مكتفيتش بالغلط انت نشرته عشان تخلي الناس تشوف انك لسه طفل وشخص مش بروفيشنال
نصحية امسح التويتة دي ومتعملش كدا تاني مع اي بروجرام او شركة

[Ahmed Ehab @HeBo117]

https://t.co/nNZyL9tvc3

[payloadartist @payloadartist]

Do you watch Netflix in your free time?

Try hackflix for security conference talks

https://t.co/SVbkWApdoe

#cybersecurity #bugbounty

[Yassine Aboukir 🐐 @Yassineaboukir]

If you’re a good bug bounty researcher, AI amplifies your skills. If you lack the foundations, you just become a victim of slop, and so do the programs you hack.

Applies to all other fields.

[Ahmed Ehab @HeBo117]

@joaxcar @arcanuminfosec It's really scary where bugbounty is going to

[Ahmed Ehab @HeBo117]

@zhero___ ما شاء الله
What a transformation brother 🔥❤️

[Ahmed Ehab @HeBo117]

https://t.co/NG0T1GsWY1

[dbugs @ptdbugs]

🔐 Account Takeover via CSPT with Subsequent 2FA Bypass through Prototype Chain

Step 1. Client-Side Path Traversal

The CSPT primitive is fairly typical: the attacker changes the invite-sending request path "PUT /api/v2/teams/<teamId>/invites/<inviteId>" to the email-change endpoint "PUT /api/v2/user".`
`
As a result, when the victim follows the invite link, the client sends a request that changes the victim’s email address to one controlled by the attacker.

The interesting part is that CSPT only gives control over the URL, not the request body. According to HTTP semantics, PUT usually carries the new resource state in the request body. In this case, however, the server did not strictly require the new email to be supplied in the body and accepted it from a query parameter instead. This made account takeover possible.

Step 2. 2FA Bypass via Prototype Chain

Next, the researcher needed to log in to the compromised account and pass the OTP check. This was bypassed by sending "proto" instead of a valid code.

The issue relies on JavaScript property lookup. When reading an object property, JavaScript first checks the object’s own keys; if the key is not found, it continues up the prototype chain to "Object.prototype".

Based on the observed behavior, the server likely checked OTP validity with logic similar to:
│
│ if (pendingCodes[code]) {
│ // issue session
│ }
│

When the attacker sent: "X-2FA-Code: proto" there was no own key named "proto" in "pendingCodes", but "proto" is an inherited property available on ordinary JavaScript objects. Therefore, "pendingCodes["proto"] "returned the object prototype — a truthy value. The condition passed, and the server issued a session.

📎 Article: https://t.co/dcIcRdn0JR

#dbugs_attacks

[Ahmed Ehab @HeBo117]

Listen to this from @nnwakelam

[Nate @nnwakelam]

In the next 12-18 months there’s really never been a better time to make a million dollars doing bug bounties. If I was young and poor I would be locking myself in a room from now until this time next year and making finding a reproducible methodology or way of hacking that I can scale my primary and only objective in life.

[payloadartist @payloadartist]

This might be one of the most elegant LLM exploits

Grok got prompt injected, and the attacker managed to get 3B DRB worth $175k sent to a wallet they control

Crazy!

[incendiumrocks @incendiumrockz]

It's been a while since I wrote a blog post. My new post writes about some cool updates to the MS-RPC-Fuzzer for recursively fuzzing complex structures, logging using ETW, and we found a way to escalate to nt\authority system!

https://t.co/Guxzx0gu2J

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

0Day OpenAI Codex Sandbox Escape Vulnerability 👀 @gothburz
https://t.co/GUMRC7OXk6

[frycos @frycos]

Infosec community right now…

[Louis Nyffenegger @snyff]

"script kAIddie"

[shubs @infosec_au]

We've just released a high fidelity scanner for CVE-2026-41940 (cPanel/WHM authentication bypass). All public PoCs so far lead to false negatives, and are not reliable. @SLCyberSec's research team's notes on this here: https://t.co/7gik0IY4Cl &amp; tool here: https://t.co/RKoB6WaSQk