RunKeeper Stored XSS Vulnerability – Where worms are able to run too!

 

RunKeeper is a GPS fitness-tracking app for iOS and Android with over 40 million users. First launched in 2008 by CEO Jason Jacobs with the help of “moonlighting engineers”. In late 2011 RunKeeper secured $10 million in a Series B financing, led by Spark Capital. In February, 2016, RunKeeper was acquired by ASICS.

Continue reading “RunKeeper Stored XSS Vulnerability – Where worms are able to run too!”

Share

TopCoder.com Vulnerabilities – A tail of site-wide bugs leads to accounts compromise & payments hijacking

TopCoder_logo

Hi Folks,
TopCode.com is a website where the most skilled top coders around the world are solving challenges, Competing and writing codes to achieve a specific tasks. Top high profile companies like (Facebook, Google, Twitter, etc..) are getting help from such websites in their recruitment process!

Continue reading “TopCoder.com Vulnerabilities – A tail of site-wide bugs leads to accounts compromise & payments hijacking”

Share

Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features

 

Introduction:

Modern Web Applications nowadays are relaying on a lot of technologies where typical web applications vulnerabilities are hard to find (eg. Clickjacking is an ABC security bug) but bug hunters are always the best!

Yammer is a freemium enterprise social networking service used for private communication within organizations. Access to a Yammer network is determined by a user’s Internet domain so that only individuals with approved email addresses may join their respective networks.

Continue reading “Microsoft Yammer Clickjacking – Exploiting HTML5 Security Features”

Share

When your privacy disclosure is a “feature” not a “bug” – Badoo & HotorNot failure!

badoo10

Your privacy on the internet is the biggest concern ever and when it comes to “Dating websites” and “Social Networks” it means more and more!

Let me tell you a story of two websites that don’t respect yours and putting it on danger…

Continue reading “When your privacy disclosure is a “feature” not a “bug” – Badoo & HotorNot failure!”

Share

Fiverr.com Full Accounts Takeover – A Vulnerability Puts $50 Million Company At Risk

Fiverr_logo__tagline

Fiverr.com, a global online marketplace which provides a platform for people to sell their services for five dollars per job, is vulnerable to a critical web application vulnerability that puts its millions of users at risk.

Fiverr raised $30 million in a third round of institutional funding to continue supporting the new version of its marketplace, but the company ignored the advance warning of the critical bug reported responsibly by a vulnerability hunter and fails to patch up their website before his public release.

Continue reading “Fiverr.com Full Accounts Takeover – A Vulnerability Puts $50 Million Company At Risk”

Share

Facebook Vulnerability – a “Cute Bug” that reveals the “likes” of deleted posts regardless of their privacy settings

facebook-content-banner-2
Hi Folks,
My name is Mohamed Abdel Aty, an Egyptian Web Developer & Bug Hunter, Today I would like to share with you a “cute” bug I found while doing some bug hunting in Facebook.

Testing different sub-domains is a common procedure in bug hunting , while searching the domain “mbasic.facebook.com” I noticed this link

Continue reading “Facebook Vulnerability – a “Cute Bug” that reveals the “likes” of deleted posts regardless of their privacy settings”

Share

Facebook movies recommendation vulnerability – A bug capable of erasing all your important notifications!


Hi Folks,

Facebook is the largest social network ever known on the internet, People are using Facebook for contacting friends, Family and sometimes for Work!

When it comes to Work that means an important notifications from your company’s page, work account, work admins, business accounts, etc…

Continue reading “Facebook movies recommendation vulnerability – A bug capable of erasing all your important notifications!”

Share

WhatsApp Clickjacking Vulnerability – Yet another web client failure!

s

Hi Folks,
I know it’s a little bit lame to mention 2 clickjacking vulnerabilities in row but that what bug hunters always do exposing the largest companies security failures, (Previously was Telegram) this time is the gigantic well-known 19 billion dollar messenger WhatsApp.

Continue reading “WhatsApp Clickjacking Vulnerability – Yet another web client failure!”

Share