Story of Abusing a Fully Secured redirect_uri in an OAuth FlowWhen it comes to bug hunting, authentication is my first choice. Nowadays, major companies' authentication systems have many implementations and enormous underlying complexity. So when I start testing2281AMar 21 · 8 min readblog.voorivex.team
Hacking Veeam: Several CVEs and $30k BountiesHello, I’m a web guy. Usually, I’m not working on non-web applications since my mind doesn’t know binary and reverse engineering. About one year ago, I started giving myself a shot at working on some macOS applications, and I managed to uncover sever...4MNCAug 9, 2025 · 8 min readblog.voorivex.team
Puny-Code, 0-Click Account TakeoverHello! This blog post is a detailed version of the talk given by Amir and me at Nahamcon 2025. We usually choose a topic to focus on, spending time on it - it might turn into a 0day or just a simple checklist. Then we apply our findings to our daily ...61SSJun 1, 2025 · 7 min readblog.voorivex.team
Stealing oAuth Token via Referrer Policy OverrideHello, let’s get straight to the main course. OAuth implementation has many hidden parts that have been discussed before on the internet. The most famous one is Account hijacking using “dirty dancing” in sign-in OAuth-flows, which inspired Omid and l...3MOMMay 6, 2025 · 4 min readblog.voorivex.team
From an Android Hook to RCE: $5000 BountyHello, today I want to share a research-based story about how I reverse-engineered a famous Android application called MyIrancell. I managed to achieve RCE, reported it to the vendor, and earned a bounty. A few days ago, I received permission from th...2HANov 19, 2024 · 15 min readblog.voorivex.team
