CyberTalents CTF web security challenges write-up

Hey Folks,

My name is Mahmoud, a web application penetration tester, I have recently joined Seekurity and today I will share with you the details of the National Cyber Security CTF we recently had in Egypt.

This year, CyberTalents organised a cyber security CTF in Egypt sponsored by Trend Micro which is probably the largest and most-organised CTF we ever had in the middle east.

Continue reading “CyberTalents CTF web security challenges write-up”


Facebook Messenger and HSTS

Pic Source:

This article was originally covered by Tom Spring of ThreatPost.

On Tuesday, Seekurity Founder and Cyber Security Advisor, Mohamed A. Baset, published a proof-of-concept video demonstrating what he calls a Facebook flaw that allows an attacker to access audio or video files from Facebook servers and play them back.

Facebook is dismissing claims by a researcher who says multimedia content such as audio-based messages sent via its Facebook Messenger service can be intercepted by a third-party under certain conditions.

Facebook is dismissing Baset’s claims, telling Threatpost, “We appreciate researcher reports, but this is not a flaw and does not impact the normal functioning of voice clips on Messenger.”

Baset concedes that the alleged threat he illustrates represents a “narrow attack surface” and is “not really that dangerous for most users.”

Continue reading “Facebook Messenger and HSTS”


QRLJacking – Your QR-based session belongs to us!



Before we start we need to explain some frequently mentioned terms which are: QR Code, SSO and Clickjacking.

What is QR Code?

QR code (abbreviated from Quick Response Code) is the trademark for a type of matrix barcode (or two-dimensional barcode) first designed for the automotive industry in Japan. A barcode is a machine-readable optical label that contains information about the item to which it is attached. A QR code uses four standardized encoding modes (numeric, alphanumeric, byte/binary, and kanji) to efficiently store data; extensions may also be used.

Continue reading “QRLJacking – Your QR-based session belongs to us!”


#OperationTakeDown: Netflix Phishing Attack & Analysis


Hi Folks,

Days ago, one of our clients received an email with the next subject in Spanish: “Problemas con tu membresia de Netflix” (Problems with your Netflix membership).
The email was in his SPAM folder with the follow caption: “Be careful with this message. It contains a suspicious link that has been used to steal people’s personal information. Unless you trust the sender, don’t click on links or reply with personal information.”
Thanks Google SPAM filters! But we aren’t sure if the rest of email service providers can flag the email as SPAM, maybe not because Google has a powerful spam filter. The first time we took down the malicious site, it appeared again in a few hours.
Here is what we found:

Continue reading “#OperationTakeDown: Netflix Phishing Attack & Analysis”


BMW Vulnerabilities – Hijack Cars ConnectedDrive™ Service!

Hi Folks,
Let me tell you the story about some typical vulnerabilities that was discovered by @Seekurity Team in BMW ConnectedDrive service which will allow any beginner attacker to hijack the whole service!


First what is BMW ConnectedDrive service?
BMW ConnectedDrive – a technology packet full of services and apps that connects you closely to the world around you. It makes tasks easier and quicker to perform, giving you more time for what’s really important: your family, friends and free time.

Continue reading “BMW Vulnerabilities – Hijack Cars ConnectedDrive™ Service!”


RunKeeper Stored XSS Vulnerability – Where worms are able to run too!


RunKeeper is a GPS fitness-tracking app for iOS and Android with over 40 million users. First launched in 2008 by CEO Jason Jacobs with the help of “moonlighting engineers”. In late 2011 RunKeeper secured $10 million in a Series B financing, led by Spark Capital. In February, 2016, RunKeeper was acquired by ASICS.

Continue reading “RunKeeper Stored XSS Vulnerability – Where worms are able to run too!”


Cookie stuffing: How we are part of a fraud of millions of dollars


What is Cookie stuffing fraud?

Is an activity which allows actors online to defraud affiliate marketing programs by causing themselves to receive credit for purchases made by web users (for this case users who made an online purchase in Amazon, Walmart, eBay or any other Online Store), even if the affiliate marketer didn’t actively perform any marketing for the affiliate program. It occurs when a fraudulent publisher, tricks a web user’s browser into visiting an Online Store, that the web user didn’t intent to visit. This links causes to the Online Store to record that the publisher generated the “sale” and gives the fraudulent publisher credit for any purchases the web user might make.

Continue reading “Cookie stuffing: How we are part of a fraud of millions of dollars”

Share Vulnerabilities – A tail of site-wide bugs leads to accounts compromise & payments hijacking


Hi Folks, is a website where the most skilled top coders around the world are solving challenges, Competing and writing codes to achieve a specific tasks. Top high profile companies like (Facebook, Google, Twitter, etc..) are getting help from such websites in their recruitment process!

Continue reading “ Vulnerabilities – A tail of site-wide bugs leads to accounts compromise & payments hijacking”


Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features



Modern Web Applications nowadays are relaying on a lot of technologies where typical web applications vulnerabilities are hard to find (eg. Clickjacking is an ABC security bug) but bug hunters are always the best!

Yammer is a freemium enterprise social networking service used for private communication within organizations. Access to a Yammer network is determined by a user’s Internet domain so that only individuals with approved email addresses may join their respective networks.

Continue reading “Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features”