---
title: "Voorivex (@Voorivex) | Hashnode"
description: "@yshahinzadeh. Read the latest articles by Voorivex on Hashnode."
url: "https://hashnode.com/@Voorivex"
---

@Voorivex

# Voorivex

@Voorivex · Joined September 2023

@yshahinzadeh

### [Story of Abusing a Fully Secured redirect\_uri in an OAuth Flow](https://blog.voorivex.team/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow?utm_source=hashnode&utm_medium=feed)

When it comes to bug hunting, authentication is my first choice. Nowadays, major companies' authentication systems have many implementations and enormous underlying complexity. So when I start testing

8 min read · [blog.voorivex.team](https://blog.voorivex.team/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow?utm_source=hashnode&utm_medium=feed)

[1](https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8) [Mar 21](https://hashnode.com/posts/story-of-abusing-a-fully-secured-redirect-uri-in-an-oauth-flow/69bee7154a1e513e411cffa8)

### [Hacking Veeam: Several CVEs and $30k Bounties](https://blog.voorivex.team/hacking-veeam-several-cves-and-30k-bounties?utm_source=hashnode&utm_medium=feed)

Hacking Veeam exposed vulnerabilities, earning $30k in bounties. Discover bug bounty tips and reverse engineering insights

8 min read · [blog.voorivex.team](https://blog.voorivex.team/hacking-veeam-several-cves-and-30k-bounties?utm_source=hashnode&utm_medium=feed)

[4](https://hashnode.com/posts/hacking-veeam-several-cves-and-30k-bounties/68979a72222b3a13e0cba23f) [Aug 9, 2025](https://hashnode.com/posts/hacking-veeam-several-cves-and-30k-bounties/68979a72222b3a13e0cba23f)

### [Puny-Code, 0-Click Account Takeover](https://blog.voorivex.team/puny-code-0-click-account-takeover?utm_source=hashnode&utm_medium=feed)

Puny-code inconsistencies can enable account takeovers by exploiting character parsing vulnerabilities, affecting email servers and databases

7 min read · [blog.voorivex.team](https://blog.voorivex.team/puny-code-0-click-account-takeover?utm_source=hashnode&utm_medium=feed)

[6](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9) [Jun 1, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9)

### [Stealing oAuth Token via Referrer Policy Override](https://blog.voorivex.team/leaking-oauth-token-via-referrer-leakage?utm_source=hashnode&utm_medium=feed)

Explore how referrer leakage can expose OAuth tokens in browser implementations and learn methodologies to protect against token theft

4 min read · [blog.voorivex.team](https://blog.voorivex.team/leaking-oauth-token-via-referrer-leakage?utm_source=hashnode&utm_medium=feed)

[3](https://hashnode.com/posts/leaking-oauth-token-via-referrer-leakage/681a735037f3a5e5dc98d8eb) [May 6, 2025](https://hashnode.com/posts/leaking-oauth-token-via-referrer-leakage/681a735037f3a5e5dc98d8eb)

### [From an Android Hook to RCE: $5000 Bounty](https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty?utm_source=hashnode&utm_medium=feed)

Discover how reverse engineering led to a $5000 bounty by exploiting a critical vulnerability in a popular Android app

15 min read · [blog.voorivex.team](https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty?utm_source=hashnode&utm_medium=feed)

[2](https://hashnode.com/posts/from-an-android-hook-to-rce-5000-bounty/673caadb9ae7a0a07c21b0ed) [Nov 19, 2024](https://hashnode.com/posts/from-an-android-hook-to-rce-5000-bounty/673caadb9ae7a0a07c21b0ed)