Bug Hunter & Web Application Pentester
Joined September 2021
- Tweets610
- Following469
- Followers4.5K
- Likes2.2K
Amirabbas Ataei retweeted
Safari wanted a decryption key. @AmirMSafari gave it alert(1).
Two fresh XSS vectors using <audio>, <video> and onwebkitneedkey just landed in our PortSwigger XSS cheat sheet.
He keeps finding gems. We keep adding them.
ALT <audio src=data:,%23EXTM3U%0A%23EXT-X-TARGETDURATION:1%0A%23EXT-X-KEY:METHOD=AES-128,URI=%22skd:%22%0A%23EXTINF:1%0Ax onwebkitneedkey=alert(1)></audio>
I’ve been using a custom extension on my daily targets for a while. Writing target-specific regexes lets me track new endpoints and catch bugs on upcoming features before they even fully launch.
It’s also super useful for quick targets when you just need a clean list of endpoints right away.
Spruced up the code with AI recently and published it on GitHub if anyone wants to try Unvix:github.com/ImAyrix/Unvix
Amirabbas Ataei retweeted
There are two solutions to this challenge. One lets you leak the full URL using pure CSS in Chrome 150+! Full write-up here:
blog.voorivex.team/oauth-tok…
This page is part of an OAuth callback. Can you hijack the authorization code?
🧪 Try it live on pwnbox.io/challenges/purifie…
Amirabbas Ataei retweeted
One value, read two ways. When a function is overloaded, the argument's type picks which version runs, and a validator and a sink don't have to agree on what that value is. That gap is the bug.
Full writeup + three pwnbox challenges to practice
blog.voorivex.team/javascrip…
Amirabbas Ataei retweeted
Amir (@AmirMSafari) and I found a CVE in the latest version of Tomcat. It was an easy bug. It's a winning strategy: 0day discovery -> scanning all BB programs -> easy and certain triage
This also works for newcommers, not all 0days are hard to find
herodevs.com/vulnerability-d…
Amirabbas Ataei retweeted
We're dropping 3 Adminer 0-days after nearly three months without acknowledgment from the maintainers. Among these vulnerabilities and our previous cPanel 0-day, we've earned a five-digit bounty total, Happy hunting ;)
blog.voorivex.team/three-0-d…
🤖 Made with AI
Amirabbas Ataei retweeted
I just dropped a new blog post, happy hacking :)
blog.voorivex.team/two-cpane…
Amirabbas Ataei retweeted
I wrote this story in a blog post, starting with my old challenge and leading up to this point. Chromium has since patched this attack vector. The full post is linked below, hope you enjoy reading it ;)
blog.voorivex.team/we-need-t…
Amirabbas Ataei retweeted
I published one of the techniques that I've been using against OAuth providers, honetly, it's led me to discover many flaws, and recently I used it to find a 1-click ATO on one of the most widely visited websites,I hope you find it useful :-)
blog.voorivex.team/story-of-…
🤖 Made with AI
Amirabbas Ataei retweeted
It's time for sharing, this is not a simple write-up, we are sharing our methodology and reasoning, detailing how we approached and hunted the flaw, I hope you like it :]
blog.voorivex.team/uxss-on-s…
Amirabbas Ataei retweeted
We got permission from the Samsung Security team to disclose this uXSS that we found in Samsung Browser, it was assigned a CVE (CVE-2025-58485) and patched.
Here is the PoC, expect the write-up in the next upcoming days.
Both challenges were interesting
Thanks for sharing.
Yousef (@samm0uda) gave me a challenge few days ago, it's a redesign of Amir's recent challenge, the solution is quite interesting, I was able to solve it in 10 minutes as I'd previously debugged QS library it, I highly RECOMMEND it, the source code:
gist.github.com/samm0uda/91e…
Amirabbas Ataei retweeted
Thanks for participating in this challenge! I analyzed the qs parser source code and wrote about the inconsistency between the backend and frontend query parsers, along with two possible solutions. Hope you enjoy it!
blog.voorivex.team/when-two-…
Can you spot the XSS vulnerability? 👀
Test it out live at: pwnbox.xyz
ALT https://github.com/VoorivexTeam/white-box-challenges/blob/main/MisParse/index.js
Amirabbas Ataei retweeted
I recently discovered several vulnerabilities in MCP servers across different attack scenarios (DOM XSS, Stored XSS, SSRF, etc.) and decided to publish a blog post to share my knowledge. Hope you enjoy it! :D
blog.voorivex.team/shaking-t…
For the past year, I've been using a private wordlist generated from actual bug bounty reports.
I grabbed disclosed report texts by simply appending .json to the report URLs (as shown below) and fed them into fallparams to mine parameters from the included requests and snippets.
