ElAnanyAli (@abdallaeg1) 's Twitter Profile
ElAnanyAli

@abdallaeg1

Guardian of the digital realm, slayer of cyber dragons, and occasional breaker of firewalls.

ID: 1267136501772619777

calendar_today31-05-2020 16:51:10

125 Tweet

221 Followers

741 Following

Joe Hattab (@joe_hattab) 's Twitter Profile Photo

🇵🇸 This is the West Bank in 2009, by @60minutes, posted two days ago. Showing how Palestinian have been living under occupation.

أبو الأمجاد (@thydetective) 's Twitter Profile Photo

@Ebn_ElQonsol202 أحمد الطيب الجامعة العربية للإنصاف لها "موقفاً" كبيراً يسع أكثر من مائة سيارة أمام المبنى - جلال عامر

easygoing48 (@easygoing48) 's Twitter Profile Photo

If your a Muslim an have downloaded Islamic app on iOS App Store or on Google Play from ZipoApps then avoid. They are an Israeli company.

If your a Muslim an have downloaded Islamic app on iOS App Store or on Google Play from ZipoApps then avoid. They are an Israeli company.
ElAnanyAli (@abdallaeg1) 's Twitter Profile Photo

New writeup just dropped: How I found XSS and PostMessage vulnerabilities in zoho, then escalated them to ATO medium.com/@0xUsername/zo… #bugbountytips #bugbountytip #infosec #bugbounty

ElAnanyAli (@abdallaeg1) 's Twitter Profile Photo

Who needs to write malware when you've got @zoho assist? Remote support software that lets you do almost anything on the user’s machine—no questions asked, no alerts given, and all in the background. #Infosec

Who needs to write malware when you've got @zoho assist? Remote support software that lets you do almost anything on the user’s machine—no questions asked, no alerts given, and all in the background. #Infosec
ElAnanyAli (@abdallaeg1) 's Twitter Profile Photo

Republished, How I found XSS and PostMessage vulnerabilities in Zoho, then escalated them to ATO medium.com/@0xUsername/zo… #bugbountytips #bugbountytip #infosec #bugbounty

ElAnanyAli (@abdallaeg1) 's Twitter Profile Photo

Yes, I earned $5000 for reporting ATO 🔥 Steps: - Used this script to detect postMessage events gist.github.com/alanEG/cedc7a3… - Found PM misconfiguration and escalated it to XSS - Chained the XSS to achieve full Account Takeover #bugbountytip #BugBounty #InfoSec #WebSecurity

Yes, I earned $5000 for reporting  ATO 🔥

Steps:
- Used this script to detect postMessage events  gist.github.com/alanEG/cedc7a3…

- Found PM misconfiguration and escalated it to XSS

- Chained the XSS to achieve full Account Takeover

#bugbountytip #BugBounty #InfoSec #WebSecurity
ElAnanyAli (@abdallaeg1) 's Twitter Profile Photo

A real-world example I found in the wild: In this code, accountId is an array, but parseInt([1111, 2222]) → 1111, leading to incorrect auth checks! This could let unauthorized users access data. #bugbountytips #BugBounty #JavaScript #InfoSec

A real-world example I found in the wild:

In this code, accountId is an array, but parseInt([1111, 2222]) → 1111, leading to incorrect auth checks! This could let unauthorized users access data. 

#bugbountytips #BugBounty #JavaScript #InfoSec