Sabitlenmiş Tweet
23
46 posts
It's time for sharing, this is not a simple write-up, we are sharing our methodology and reasoning, detailing how we approached and hunted the flaw, I hope you like it :]
blog.voorivex.team/uxss-on-samsun…
Omid Rezaei@omidxrz
We got permission from the Samsung Security team to disclose this uXSS that we found in Samsung Browser, it was assigned a CVE (CVE-2025-58485) and patched. Here is the PoC, expect the write-up in the next upcoming days.
English
New triage on Google, I asked for permission to publish the previous 12k ATO on Google VRP, I'll drop a blog post once they grant it (1)
On top of that, I'm going to publish an OAuth 1-click ATO that I recently uncovered in a MAIN domain of a well-known company (2), stay tuned
English
I ranked 34th on H1 in 2025. I couldn’t work on H1 after the ban three months ago; if I could've, I would have ranked in the top 20 which was my yearly goal. this is the last time I see my username on the H1 leaderboard, and it’s sad, but never mind, let’s move forward :]
English
به ۸ تا دیگه رفت جا تو گوگل، luv u google
YS@YShahinzadeh
they decreased the bounty amount, I replies with my reasons and asked for a review, since it was a conditional RCE, they should have paid higher :]
فارسی
این تایمی که هانتو شروع کردیم با @aysanhain خیلی استرس داشتیم٫ دوست داشتیم بلاخره بعد یه سال باگ بزنیم و زدیمممم🔥
میدونم مبلغش کمه ولی ما براش خیلی زحمت کشیدیم، انتظار داشتیم بیشتر بانتی بدن ولی همینم کلی بهمون امید و انرژی داد :))
مرسی از حاج یاشار @voorivex ❤️🔥
فارسی
Locked in for the past ~1.5–2 months, grinding full-focus on hunting with my great friends @CSa6an and @DanialXray .
We dove deep into a big program (and some of its subsets), and the results were worth every hour.
More bugs, more learning, more experience. 🚀
@voorivex
English
Another one on Google VRP. this one is an old-buggy-pettern storing data as an object in State parameter and processing it in OAuth callback. I couldn't manipulate final url using attacker/domain or attacker@domain, but with attacker\u002fdomain. I expect 20k or 13k for this ;]
English
All I can say is that "PARAAM😲" and I just now understood what Yashar was saying...😨
@voorivex
یاشو@voorivex
به شاگردم میگم فیلم ۲۳ جیمکری رو ندیدی؟ بعد براش قلب سیاه زدم چون یوزرنیمش ۲۳ بود. برگشت گفت یاشار اون موقع که فیلم اومده ۳ سالم بوده، خدایی حق داره من پیر شدم 😂😂
English
@AmirFouladvand امروز خیلی ضربه سنگینی خوردم، تیمم «هیچکدوم» این فیلمو ندیدن، لفت دادم از گروه
فارسی
هکروان ماه پیش (بعد از مکانیزم ماشه) حساب منو بدون دلیل بست، تقریبا نیم میلیون دلار بانتی زده بودم توش و سال ۲۰۲۵ جز ۲۰ هکر اول بودم. حدود ۵۰ هزار دلارم تو حساب موند که بعیده یه روز بدنش، اینا در حالیه که من «هیچ» قانونیو نقض نکردم. هیچ دلیلی هم بم نگفتن، فشار زیادی بم اومد /
YS@YShahinzadeh
I’ve been hunting on H1 for almost 3 years, ranked #18 in 2025, have always tried to contribute positively to the hacker community. I’ve earned around $500k in bounties and was on the road to $1M. Yet I don’t even have HSM, and I feel I haven’t been recognized as I should 1/4
فارسی