Mohammad

Application Security Consultant @ | OSWE

"always forward, never backward."

[Mohammad @m0hammad_y4ser]

The one mentality you must have in life is that regardless of what is in front of you, you still must grind.

[Ahmed Abdel Rasoul🦅 @0xbartita]

𝗧𝗶𝗿𝗲𝗱 𝗼𝗳 𝘂𝗽𝗱𝗮𝘁𝗶𝗻𝗴 𝗰𝗼𝗼𝗸𝗶𝗲𝘀 𝗶𝗻 𝗲𝘃𝗲𝗿𝘆 𝗥𝗲𝗽𝗲𝗮𝘁𝗲𝗿 𝘁𝗮𝗯? 🍪

Burp extension that auto-replaces expired cookies/headers — perfect for retesting old requests without manual copy-paste.

🔗https://t.co/4cqCZusUPK

#bugbountytip #bugbountytips #PenTest

[Mohammad @m0hammad_y4ser]

@0xbartita 🔗 Advisory available on GitHub Security Advisories: https://t.co/OVlCpY1yTD

🔗 CVE Record: https://t.co/m3TZdvQApj

🔗 NIST NVD: https://t.co/f5UnhzTQtZ

[Mohammad @m0hammad_y4ser]

I and my friend @0xbartita responsibly disclosed a critical vulnerability in Laravel Reverb (CVSS 9.8/10), now patched and disclosed by the Laravel team.

CVE-2026-23524: https://t.co/OVlCpY1yTD

#bugbountytips #bugbountytip #CVE #Laravel #PHP #Reverb

[Mohammad @m0hammad_y4ser]

🎯 Officially OSWE certified! Grateful for the grind, lessons, and late nights that led here. Huge thanks to @offsectraining for the great training.
https://t.co/Gdeuwyg3pq
#OSWE #AWAE #OffSec #OffensiveSecurity #Offensive_Security

[Mohammad @m0hammad_y4ser]

@00xA7md On fire 🔥🔥🔥

[Mohammad @m0hammad_y4ser]

@spaceboy2O @mux0x they do not know that i can change the CPU register to AAAAAAAAAAAA...

[Mohammad @m0hammad_y4ser]

Deep Link Hijacking to Full Account Takeover: A Complete Guide

In this blog, I dive into how I exploited deep link vulnerabilities in Android applications to achieve full account takeover.

Check it out here: https://t.co/ipqGIE8KxO

[Mohammad @m0hammad_y4ser]

@AliSayed199 كلسن الشوكولاته
هتعزمني على قهوة 😂

[Mohammad @m0hammad_y4ser]

@sec_jota @Hacker0x01 Awesome, Jota
keep going!

[Mohammad @m0hammad_y4ser]

@richard_onyeka_ thanks, Richard

[Mohammad @m0hammad_y4ser]

During a bug bounty engagement for a program with four distinct Android applications, I discovered that one of the applications exposes a deep link handler associated with the login functionality, utilizing the scheme `scheme://login?token=...`.

Read the Comments ⬇️

[Mohammad @m0hammad_y4ser]

4. Impact: Full Account Compromise. Tips: If the target offers multiple Android applications and a vulnerability is identified in one, it is advisable to investigate whether the same or similar vulnerability exists across the other applications.

[Mohammad @m0hammad_y4ser]

3. With the stolen token, I successfully authenticated as the victim, leading to a full account takeover (ATO).

[Mohammad @m0hammad_y4ser]

@omidxrz use Nox if you have no WSL installed on your machine,
for better experience, use the emulator of the android studio.
one more thing, use the google pixel devices

[Mohammad @m0hammad_y4ser]

@Richard_Onyeka_ HBD, Richard!
wish you all the best

[Mohammad @m0hammad_y4ser]

@joo_elsaka Well done Joe!