Tthesecurityguyinthesecurityguy.hashnode.dev·Apr 8, 2025 · 2 min readHow a Simple Firebase Misuse Can Lock Out Users From Signing UpIn the world of user authentication, ensuring that email addresses are properly validated and managed is crucial. But what happens when an attacker can abuse a third-party authentication system to "reserve" someone else's email, effectively blocking ...00
Tthesecurityguyinthesecurityguy.hashnode.dev·Mar 31, 2025 · 3 min readThe Curious Case lof Hidden Phone Number Change & POST-to-GET CSRF — A Hacker’s Tale with a twistIntroduction Sometimes, the most interesting vulnerabilities aren’t the flashy ones — they’re the sneaky, almost accidental bugs that show just how broken the logic behind a system can be. This is one such story where a "simple" password change page ...00
Tthesecurityguyinthesecurityguy.hashnode.dev·Mar 31, 2025 · 1 min read💸 "65 Euros for an Account Deletion Fail — When Deleted Doesn’t Mean Deleted"The Bug I found a weird issue with the platform’s account deletion flow: When a user deletes their account, their added email addresses were not removed from the system. If the user tried to sign up again using the same email, they couldn’t — the s...00
Tthesecurityguyinthesecurityguy.hashnode.dev·Mar 31, 2025 · 1 min read🔥 Account Takeover via Duplicate Registration — A 1500 Euro JackpotThe Bug Found a critical account takeover in a web application’s registration flow.The platform allowed creating the same account (same email) from a different session, even though the account already existed. Step-by-Step PoC Create account with em...00
Tthesecurityguyinthesecurityguy.hashnode.dev·May 3, 2023 · 1 min readPhishing in AndroidThe app can be launched by any other app because its deeplink activity is exported=true. Adb exploit adb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk Exploi...00
