Puny-Code, 0-Click Account Takeover

Hello! This blog post is a detailed version of the talk given by Amir and me at Nahamcon 2025. We usually choose a topic to focus on, spending time on it - it might turn into a 0day or just a simple checklist. Then we apply our findings to our daily ...

blog.voorivex.team7 min read

#puny-code #account-takeover #oauth2

Responses6

Markdown supported · ⌘↵ to post

1F

13erCheng F10wers

Oct 20, 2025

very good

Great One.

swaroop venkat

Sri W

6

Navid Navid

Nice trick I use this to get account take over in my university but The database used in university is Microsoft sql server and its accent-sensitive by default 😔

M

m1k0er

Jun 2, 2025

Thank you for sharing. I have a question for you. In the "Forgot Password section", you registered the SMTP service of victim@gmàil.com to get the victim's reset link, right? How can I register an SMTP service similar to gmàil.com?

S4

Sam 499

Jun 3, 2025

I also have the same question.

NN

Navid Navid

Jun 3, 2025

By domain and create emai server

R

rootface

Jun 2, 2025

amazing , do its smart!

Search Hashnode

Puny-Code, 0-Click Account Takeover

Responses6