Ali Bahaa Alawsi 𝕏

Security Researcher | Computer Science Graduate

Hall of Fame: Meta, OpenAI, Google, Pinterest and more
Breaking apps, reporting bugs

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

Thank you @GoogleVRP for the reward on one of my security reports, and for the additional exceptional quality bonus 🎉
#BugBounty #GoogleVRP #Google

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@cotudv @GoogleVRP @Google I don't have information about Cloud VRP timelines

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

Thank you @GoogleVRP for the reward on one of my security reports, and for the additional exceptional quality bonus 🎉
#BugBounty #GoogleVRP #Google

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@cotudv @GoogleVRP @Google About 3.5 months in this case. Google panel reviews take time, so be patient

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@destro4evr @GoogleVRP @Google About 3.5 months in this case. Google panel reviews take time, so be patient

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@JubaBaghdad @GoogleVRP @Google Thank you

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

🔓 How I Hacked Payment Verification via Misconfiguration

What developers and merchants must know ?

In this article, I explain how I was able to achieve this:
https://t.co/H0zLEZNWHB

#BugBounty #CyberSecurity #EthicalHacking #InfoSec #WebSecurity #BugHunter #SecurityResearch

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

🔐 Reverse Engineering & API Security

I wrote an article about how I analyzed an API signature and how weak protection can be bypassed.

Article Title:
How I Broke and bypass “Request-Hash” or “Signature” Protection

https://t.co/NijNboGbC9

#APISecurity #WebSecurity #BugBounty

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@OpenAI has decided to reward me and include my name in their Security Hall of Fame after I discovered a vulnerability that could expose private images in @ChatGPTapp conversations.

#CyberSecurity #BugBounty

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

🥇The "seventh" security vulnerability of this year "2024" in the Instagram app.

Meta decided to reward me for the fifth time this year after reporting a security vulnerability in its Instagram app.

This vulnerability is considered the "Ninth" over the past 3 consecutive years.

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

🥇The "Sixth" security vulnerability of this year "2024" in the Instagram app.

Meta decided to reward me for the fifth time this year after reporting a security vulnerability in its Instagram app.

This vulnerability is considered the "Eighth" over the past 3 consecutive years.

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

🥇The "fifth" security vulnerability of this year "2024" in the Instagram app.

Meta decided to reward me for the fifth time this year after reporting a security vulnerability in its Instagram app.

This vulnerability is considered the "seventh" over the past 3 consecutive years.

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

brute-force attack on a JWT (JSON Web Token) to discover its secret key

The tool enables you to guess more than 100,000 secret keys in about 5 seconds.

The tool comes by default with over 100,000 popular secret keys.

If you are using Linux , Use "John"

https://t.co/HM1gvcriHf

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

- This is the "fourth" vulnerability I’ve found in "2024" in Instagram app

- And the "sixth" vulnerability I’ve found over three consecutive years.

@instagram
@fbsecurity

🏅🏅🏅🏅🏅🏅

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

@MustafaJamaI @telegram I'm not talking about what happened today

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

10 months ago, the "Iraqi 🇮🇶" government blocked the Telegram for a period,then it returned to work, but very slowly than before, and most of the time we need a proxy to use the app,

Please check the problem,Because Telegram is one of the best and favorite app in Iraq @telegram

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

The "third" security vulnerability in Instagram for the year 2024

- For the "third" time "this year", Meta (formerly Facebook) management decided to reward me

After I discovered a security vulnerability in the Instagram app owned by it

WhiteHat List : https://t.co/JbfbZnqKay

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

For the second time this year, Meta (formerly Facebook) management has decided to reward me

After discovering a "second" security vulnerability in its subsidiary app, "instagram"

- This marks the fourth vulnerability within three consecutive years.

#BugBounty

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

For the third consecutive year, Facebook (Meta) management has decided to reward me and include my name in WhitHat list of security bug discoverers for the year 2024,

after I discovered a security vulnerability in the Instagram app

WhiteHat List : https://t.co/YB2Bv7dmUZ

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

The best solution: Open a VPN, log in, then turn off the VPN

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

If you have a problem logging in to your account on the “ChatGPT” website,you write your email and password correctly and click Continue, but nothing appears and the browser does not send a login request

To solve the problem,turn off JavaScript in the browser

#chatgpt #chatgpt4

[Ali Bahaa Alawsi 𝕏 @ABAlawsi]

Meta decided to reward me and include my name in the whitehat list for the year 2023 after I discovered a security vulnerability in the Instagram app .

WhiteHat link : https://t.co/boZSdn7y3U

#bugbounty