Ibrahim

Security Consultant @cloudsek | Offensive security | VAPT | CTF Development @ YCF | Exploring vulnerabilities, risks, and adversarial thinking.

[Ibrahim @ibzsaify]

8)
- A second API accepted the ucode and returned additional PII
- Predictable identifiers enabled large-scale record enumeration.

3 subdomains, Multiple API endpoints. One chained finding.

A seemingly low-impact endpoint can become the entry point to a much larger exposure!!

[Ibrahim @ibzsaify]

Started this week with an awesome bug. What followed was a chain of APIs, 3 subdomains, and 300K+ exposed records!

Here's how it unfolded:

1)Fired up GLM's ZCode Harness with my recon skill. Within few minutes, it spotted an interesting API endpt burried in a minified JS bundle

[Ibrahim @ibzsaify]

7) One identifier had become the bridge between two APIs and a much larger data exposure.

Full chain:
- Recon identified the first endpt in minified Javascript
- Auth BOLA exposed other user's names and ucode values
- Prod testing confirmed the issue wasn't limited to QA.

[Ibrahim @ibzsaify]

@ajxro Been here since 2k24...but safe to say that BLR weather never fails to surprise🙃

[Ibrahim @ibzsaify]

@Yogehi Justifiable tbh, given the number of twists😭

[Ibrahim @ibzsaify]

Finally got around to this DEFCON talk a year later, and now that I’m familiar with Android security, seeing how the Xiaomi 13P exploit chain came together was so much fun!

Absolutely loved the talk! esp. the mini heart attacks😭
https://t.co/vJ0guq8e1Q
Props to @Yogehi & Ilyes

[Ibrahim @ibzsaify]

Had an absolute banger with this one! Finally wrapped up and captured the flag for "KYC Me If You Can" by @MobileHackLab

Check out the full writeup here: https://t.co/MuuUu8E2S4

#MobileSecurity #AndroidHacking #ReverseEngineering #Cybersecurity #AppSec #CTF

[Ibrahim @ibzsaify]

@lunadreaamy Simple Enough ...is it 127??

[Ibrahim @ibzsaify]

Found an exposed auth prod API that accepted a victim's phone number and returned the generated OTP directly in the API response!

It could then be used to log in as the victim via the app resulting in account takeover and access to PII, identity documents etc.
Crazyy shi fr💀

[Ibrahim @ibzsaify]

Full blog: [https://t.co/NkclHHpweV](https://t.co/NkclHHpweV)
Author Profile: https://t.co/67t4BzgPZe

#Cybersecurity #ICS #AI #CriticalInfrastructure

[Ibrahim @ibzsaify]

As tensions rise between the US and Iran, cyber risks to critical infrastructure are also escalating.

In 2024, a pro-Iranian actor reportedly used ChatGPT to research exposed industrial control systems, including ports, default credentials, & internet-facing devices. Read More.

[Ibrahim @ibzsaify]

The key shift is that AI is compressing the research phase of cyberattacks. Tasks that once required years of specialized ICS knowledge can now be accelerated using AI combined with open-source intelligence.

Not a new weapon, just a faster way to find weak doors.

Read More...

[Ibrahim @ibzsaify]

🔍 Red flags:
• 70–90% unrealistic discounts
• Domains ending in safe, sale, fast, shop
• Flashy red banners + fake “low stock” alerts
• Newly created domains, & other such indicators

Stay safe this holiday season.
#CyberSecurity #BlackFriday #Phishing #Fraud #HolidayScams

[Ibrahim @ibzsaify]

With Thanksgiving & Black Friday coming up, we’re seeing a spike in fake online stores impersonating major brands. Two clusters found: Amazon typosquats + 1K+ .shop domains mimicking Samsung, Xiaomi & more!

Blog: https://t.co/BvkdpKrEyf

Author Profile: https://t.co/67t4BzgPZe

[Ibrahim @ibzsaify]

These sites reuse the same templates, Black Friday banners, urgency pop-ups, fake trust seals & suspicious CDN infra. Many showed a “Comming Soon” page last week - Now, they’re fully active with aggressive holiday-themed scam storefronts.