YS

@YShahinzadeh

Security enthusiastic, chess player

Istanbul, Turkey

voorivex.team

Joined September 2012

2KPosts 17KFollowers 479Following

You might like

@malcolmx0x

@ImAyrix

@MrMSA16

@NikoueiMohammad

@lu3ky13

@voorivex

@AmirMSafari

@af4himi

@abbas_heybati

@0xMstar

@bubanisepehr

@thelilnix

@ITSecurityguard

@_justYnot

@m7arm4n_

Pinned

YS

@YShahinzadeh

Nov 19, 2024

How I reverse-engineered an Android app, bypassed custom encryption layer, achieved server-side RCE, and earned a $5000 bounty. read the full story here (TLDR; but worth reading) blog.voorivex.team/from-an-androi…

YShahinzadeh's tweet image. How I reverse-engineered an Android app, bypassed custom encryption layer, achieved server-side RCE, and earned a $5000 bounty. read the full story here (TLDR; but worth reading)

blog.voorivex.team/from-an-androi…

YS

@YShahinzadeh

20 h

public program on BugCrowd, tip: in OAuth, check every "login with" seprately. Google, Apple, etc. each might have different implementaion and flaw, btw I'm going to write a blog post for 0-click, the scenario was interesting, happy hacking

YShahinzadeh's tweet image. public program on BugCrowd, tip: in OAuth, check every "login with" seprately. Google, Apple, etc. each might have different implementaion and flaw, btw I'm going to write a blog post for 0-click, the scenario was interesting, happy hacking

YS

@YShahinzadeh

Nov 19

Another one on Google VRP. this one is an old-buggy-pettern storing data as an object in State parameter and processing it in OAuth callback. I couldn't manipulate final url using attacker/domain or attacker@domain, but with attacker\u002fdomain. I expect 20k or 13k for this ;]

$YShahinzadeh's tweet image. Another one on Google VRP. this one is an old-buggy-pettern storing data as an object in State parameter and processing it in OAuth callback. I couldn't manipulate final url using attacker/domain or attacker@domain, but with attacker\u002fdomain. I expect 20k or 13k for this ;]$

YS

@YShahinzadeh

Nov 1

why are most SPA web apps vulnerable to DOM XSS? I've found MANY bugs in Oauth when custom implementation gets involved, many ATO and DOM XSS. never overlook custom OAuth setups, like what? storing DATA in state parameter, happy hunting :]

YShahinzadeh's tweet image. why are most SPA web apps vulnerable to DOM XSS? I've found MANY bugs in Oauth when custom implementation gets involved, many ATO and DOM XSS. never overlook custom OAuth setups, like what? storing DATA in state parameter, happy hunting :]

YS

@YShahinzadeh

Oct 27

This one was easy: searched JS files → revealing endpoints → JSON HTTP request → exposed PII. Tip: account for lazy-loading. many hunters miss endpoints. Method: click to trigger lazy-loaded JS, then search again for endpoints. Happy hunting :]

YShahinzadeh's tweet image. This one was easy: searched JS files → revealing endpoints → JSON HTTP request → exposed PII. Tip: account for lazy-loading. many hunters miss endpoints. Method: click to trigger lazy-loaded JS, then search again for endpoints. Happy hunting :]

YS

@YShahinzadeh

Oct 25

I haven’t fully returned to BB since my H1 acc was suddenly closed, but this week I tried to start working again. I spent some time on BC and found an XSS and an IDOR, the XSS was easy with a simple payload :]

YShahinzadeh's tweet image. I haven’t fully returned to BB since my H1 acc was suddenly closed, but this week I tried to start working again. I spent some time on BC and found an XSS and an IDOR, the XSS was easy with a simple payload :]

YS reposted

AmirMohammad Safari

@AmirMSafari

Oct 19

If a CSPT bug can't be exploited on the same origin, you can pivot it to another one. Cloudflare Image Transform can act as a cross‑origin gadget to reach more sensitive endpoints on different origins - you can read more about it here ;) blog.voorivex.team/cloudflare-ima…

AmirMSafari's tweet card. Explore Cloudflare's Image Proxy as a CSPT exploit tool, enabling impactful cross-origin path traversal attacks through redirect techniques

Cloudflare Image Proxy CSPT Exploit Explained

Source: blog.voorivex.team

YS

@YShahinzadeh

Oct 1

20 days ago I found a uXSS and reported, it got triaged now, I'll publish a blog post after fix and vendor permission, it's my first bug that I'm not happy with due to recent H1 situation 🖤

YShahinzadeh's tweet image. 20 days ago I found a uXSS and reported, it got triaged now, I'll publish a blog post after fix and vendor permission, it's my first bug that I'm not happy with due to recent H1 situation 🖤

YS reposted

Youssef Sammouda (sam0)

@samm0uda

Sep 30

Due to the repeated screw-ups and zero transparency around bans by @Hacker0x01, I’ve chosen to leave with dignity. My account is now fully deactivated and to be removed. If you need my services, I’m still available at @Bugcrowd @intigriti @immunefi @HackenProof @StandoffBB

YS

@YShahinzadeh

Sep 27

I’ve been hunting on H1 for almost 3 years, ranked #18 in 2025, have always tried to contribute positively to the hacker community. I’ve earned around $500k in bounties and was on the road to $1M. Yet I don’t even have HSM, and I feel I haven’t been recognized as I should 1/4

YShahinzadeh's tweet image. I’ve been hunting on H1 for almost 3 years, ranked #18 in 2025, have always tried to contribute positively to the hacker community. I’ve earned around $500k in bounties and was on the road to $1M. Yet I don’t even have HSM, and I feel I haven’t been recognized as I should 1/4

YS reposted

Ben Sadeghipour

@NahamSec

Sep 29

Really disappointed to see @Hacker0x01 do this. I also had a similar interaction with h1 about a month ago where they questioned my nationality and place of residence after 10+ on the platform.

This post is unavailable.

YS reposted

Youssef Sammouda (sam0)

@samm0uda

Sep 26

@Hacker0x01 is now banning people without explanation or providing how the terms and conditions were violated. While other platforms are advancing, H1 revolutionary new vision is to track hackers on social media, make assumptions and ban them without a real proof.

YS reposted

Jorian

@J0R1AN

Sep 13

Bit late but this is a nice challenge, worth trying if you haven't already :D Otherwise, my solution is below, it's a really fun technique that makes me re-evaluate all the .source checks I've seen before...

Omid Rezaei

@omidxrz

May 19

this is the second challenge, and it’s a hard one, can you exploit it?

YS

@YShahinzadeh

Sep 15

I love engaging with programs being professional and communicating in a well-mannered way, especially when assessing severity, worked on a private program recently and reported 3 High bugs that earned +12k, the bugs were found reading JavaScript codes

YShahinzadeh's tweet image. I love engaging with programs being professional and communicating in a well-mannered way, especially when assessing severity, worked on a private program recently and reported 3 High bugs that earned +12k, the bugs were found reading JavaScript codes

YS

@YShahinzadeh

Sep 1

just crossed 10k on H1

YS

@YShahinzadeh

Aug 25

poking around with @AmirMSafari on a public program, no WAF bypass, no special payload 3x Dom XSS: javascript:alert(origin) CSPT + parameter pollution: critical CSRF HTMLi: leaking URL equipped with token Tip: read JS files curiously, do not rush for bug, enjoy the process :]