Novran.

Not your favourite infosec guy. Full-time Father.

[Novran. @xchopath]

Account Takeover through XSS on websites is nothing new. But does the same attack vector exist on Android?

This was one of the most complex findings we came across in 2025.

https://t.co/x3sGhc8Fg4

[Novran. @xchopath]

Just organizing some notes, other write-ups are in progress. Hope it's helpful.

https://t.co/7BLwrETgMj

[Novran. @xchopath]

HTML Injection That Paid $3K

Main issue: most websites only rely on SameSite cookies for CSRF protection.

No XSS? No problem.

HTML Injection + <form> can still trigger sensitive actions.

Hope this helps!

Honorable mention to my bug bounty partner @fariqfgi 🙌

[Novran. @xchopath]

@Masonhck3571 Thank you man!

[Novran. @xchopath]

I am actually taking a break, but out of nowhere, an old report got paid "again."
Alhamdulillah.

[Novran. @xchopath]

@fteagleeye1 Thank you brother.

[Novran. @xchopath]

@MAbdullah78619 Thank you!

[Novran. @xchopath]

@devmuzzaiyyan Thank you!

[Novran. @xchopath]

@LocalHost31337 That's pretty new for me mas, thanks for the reference.

[Novran. @xchopath]

Quick track Next.js target front-end endpoints using browser devtool, maybe some are missing from your HTTP history.

window.__BUILD_MANIFEST

[Novran. @xchopath]

“Curse of knowledge” is real 🫠

[Novran. @xchopath]

@ramizwebti Action Bias, being too focused on finding bugs instead of learning how the app works. Also tends to switch programs too often.

[Novran. @xchopath]

Once, a friend told me, "If you know how to hack but still struggle with dupes or informatives, stop asking for technical advice, start asking for psychological advice instead."

Now, my ChatGPT is basically my personal psychiatrist 😂

[Novran. @xchopath]

@wearehackerone Lol

[Novran. @xchopath]

@OriginalSicksec Was* 😅

[Novran. @xchopath]

For a naturally lazy and moody person, this felt like a significant achievement, lol 😂

[Novran. @xchopath]

@wearehackerone It's pretty normal to be a young dad in my country, lol.

[Novran. @xchopath]

💯

When I was a teenager about 6 years ago, it hit me hard... made me quit hunting, and now, in the middle of this year, I'm starting again from zero.

Just enjoy your hundred rejections/duplicates/informative. But don't stop.

[Behi @Behi_Sec]

Bug Bounty Tip:

Don't compare your day-to-day with someone else's wins.

Behind every $10K bug post are dozens of duplicates, N/As, and dead ends.

Stay consistent; that's what really counts.

[Novran. @xchopath]

@wearehackerone Thanks man!
20s 😅

[Novran. @xchopath]

@amansmughal Thanks man! But I still don't have much experience, gotta put in more grind.

[Novran. @xchopath]

@get_root1 @Troll_13 Lol, but healing takes time. My friend once said, "Don't fall in love with one finding. Submit it, report it, and move on."

[Novran. @xchopath]

@Troll_13 It was in scope, but suddenly oos.
But forget it, it was 6 years ago.