MdHak
208 posts
It's time for sharing, this is not a simple write-up, we are sharing our methodology and reasoning, detailing how we approached and hunted the flaw, I hope you like it :]
blog.voorivex.team/uxss-on-samsun…
Omid Rezaei@omidxrz
We got permission from the Samsung Security team to disclose this uXSS that we found in Samsung Browser, it was assigned a CVE (CVE-2025-58485) and patched. Here is the PoC, expect the write-up in the next upcoming days.
English
We got permission from the Samsung Security team to disclose this uXSS that we found in Samsung Browser, it was assigned a CVE (CVE-2025-58485) and patched.
Here is the PoC, expect the write-up in the next upcoming days.
YS@YShahinzadeh
20 days ago I found a uXSS and reported, it got triaged now, I'll publish a blog post after fix and vendor permission, it's my first bug that I'm not happy with due to recent H1 situation 🖤
English
@uMdaliWethu @Bugcrowd Yeah I had similar experience as well. Very disappointing😔
English
The same report was triage after 7 minute's a day later it N/A my first worst triage experience @Bugcrowd
English
You can buy a subscription to any AI service. But you can't buy experience or become a "senior security engineer".
And yes, this is a report by a "security researcher" who couldn't even properly copy from LLM🤦♂️
And I feel sorry for managers who are forced to spend time on this.
English
New triage on Google, I asked for permission to publish the previous 12k ATO on Google VRP, I'll drop a blog post once they grant it (1)
On top of that, I'm going to publish an OAuth 1-click ATO that I recently uncovered in a MAIN domain of a well-known company (2), stay tuned
English
Conduit is helping the people in Iran gain access to the internet & you can help!
Download Conduit to your Android, MacOS, or Windows device and run your own Conduit station.
This allows users in Iran to reach the internet despite the various blockages. Join the movement and help Iranians get access now!
#IranBlackout #psiphon #InternetBlackoutIran
English
MdHak retweetledi
you can only win when your mind is stronger than your emotions
English
تنابنده ۲۰ میلیارد تومان برای پایتخت ۷ دریافت کرده.
بایدم کالابرگ توهین باشه براش.
رقم رو زیاد کنید برای ایشون.
فارسی
@Mohamad_M110 امام زمان ظهورم کنه اول نسل شما حرومزاده ها رو نسل کشی میکنه
فارسی
در روزگاری که با هلی برن شخص اول مملکت میدزدن،
شیعه باید قدرت نظامی داشته باشه تا جان امام زمانش حفظ کنه.
فارسی
If you don’t want to buy a punycode domain, this PoC is a simpler and more practical alternative..
youtu.be/Cj1sOFHDClM
YouTube
Abdelhy khaled🦅@cysky0x1
Hello everyone, 🧵Zero-click account takeover via Punycode email. One of the most critical and interesting vulnerabilities I’ve discovered recently leads to a full account takeover with zero user interaction. (1/7)
English
English
Shoutout to @JonathanBouman @fransrosen @avlidienbrunn for another great year of collaborations. Always a pleasure hacking alongside these legends , we’ve found some really really good crits this year and I get the feeling 2026 will be the same 🫣
English
