RSSAmplifier

Blog

Bhavuk Jain

Full stack developer interested in Web and Mobile Security.

bhavukjain.comRSS feed ↗7 posts

Latest posts

Hijacking an UltraHuman Ring: How Unauthenticated Bluetooth Allows Attackers to Steal and Modify Health Data

Imagine wearing a smart ring that tracks your health data—your heart rate, sleep patterns, and activity levels. Now, what if I told you… Keep reading .

Account Takeover via Custom OTP, No User Interaction Required!

Me - My Favorite number is 1337. System, can you please generate this OTP for all the users? System - No!! However, since you insist, here… Keep reading .

Capturing HTTP Requests from a non-proxy-aware Mobile Application

UPDATE - This post has been updated to include a stable set of NAT rules for iptables. Mobile applications are becoming increasingly… Keep reading .

Zero-day in Sign in with Apple

What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a… Keep reading .

Account Takeover Due to Misconfigured Login with Facebook/Google

The mobile applications that uses Login with Facebook or Login with Google, I’ve found more than 70% of them suffers a misconfiguration in… Keep reading .

Zomato Account Takeover using Victim's Facebook ID

This was an issue, I reported to Zomato a few months back where an attacker could have compromised any user's account who had linked their… Keep reading .

Extracting Sensitive PII From a Tracking Number in Grab Parcel

While checking out website, I found a link that looked a bit suspicious to me as it was from a different domain. https://app.detrack.com… Keep reading .