Recent content on Mazin Ahmed
I’ve been working with agentic AI for the past two years, and I kept hitting the same wall: managing the tasks and to-dos it generates. Moving what it learns between sessions. Improving a product without keeping one session open for days. Keeping a session open for days builds up context, and I get billed for all of it on every request to Claude. Caching helps, but it’s still…
If you haven’t heard the news, GitHub confirmed unauthorized access to internal repositories through a malicious VS Code extension. I’ve been warning about this. I predicted it would happen in my talk Compromising Developers with Malicious Extensions last December at Black Hat MEA, where I presented several flaws in VS Code and the marketplace and how people can use them to run supply…
Introduction # VS Code and AI-powered IDEs could lead to the largest security breaches in the industry in the near future. They’re installed on almost all developer machines globally. Developers have access to sensitive data and credentials to push code that ends up in production. A supply chain attack could lead to gaining access to developers’ machines, which in turn could provide entry to…
Prompt injection attacks are one of the most common LLM security threats we have all seen while reviewing LLM implementations, integrations, and AI-powered systems. I have identified Prompt Injection attacks in numerous implementations and applications, and I’ve decided to write a blog post to recommend different methodologies I experimented with that can prevent prompt injection at scale. I will…
Large Language Models have completely changed how we automate, create, and solve problems. Integrating and experimenting with these models across different providers, along with optimizing LLM prompts and benchmarking them, can feel overwhelming. That’s why I built llmquery this year, to make interacting with Large Language Models and prototyping new GenAI-powered applications simpler and faster.…
What Happened? # On July 18, 2024, the world witnessed a global outage that disrupted major industries, including banking, airlines, healthcare, oil and gas, and governments. The outage was caused by a faulty software update by CrowdStrike that left Windows computers in a continuous BSOD (Blue Screen of Death) loop. (Banners of Time Square are showing Windows BSOD as a result of the CrowdStrike…
Ensuring the security of your organization’s sensitive information is critical for any security team, and detecting secrets is a key part of that. However, even if you have implemented advanced security controls, your program may still be at risk if passwords and API keys are committed to GitHub and subsequently exposed in a production environment, whether through a live web application, a…
Riyadh, Saudi Arabia, recently hosted BlackHat MEA (Middle East & Africa), the largest security conference in the Middle East and Africa region. BlackHat MEA featured various events, including an Executive Summit, Technical tracks, a Drone Hacking village, a Car Hacking village, a live Tesla hacking event, and a startup competition. My Talk # I had the opportunity to speak this year at BlackHat,…
I recently spoke at BlackHat MEA 2022, the largest security conference in the Middle East and Africa region. My talk, titled “Demystifying Practical DoS Attacks”, focused on the increasing threat of DoS attacks and the need for improved defense solutions and for practical validation of current DDoS prevention solutions. In my presentation, I shared my research on practical DoS attacks,…
In 2019, Khaled Farah and I participated in a security competition for developing offensive security tools. I enjoy building security tools, and this competition was funded by HITB (Hack-in-the-Box) with a reward of $100,000 for the winners. It would be an exciting challenge to work on as a side project. I met my friend Khaled, who was also interested in winning this competition. We signed up, and…
New Release: tfquery now supports SQL queries for Terraform Plan Scanning In case you’re an infrastructure security engineer and have not tried tfquery yet, this will be a great blog post for you. Tfquery is a framework that allows running SQL queries on Terraform code. It’s made to analyze your Terraform infrastructure, locate resources, run security compliance checks, spot…
# How was Twitch hacked? What security controls did Twitch build? The Twitch breach revealed more than 120 internal security tools developed by the Twitch Security team. I analyzed all the leaked security tools that were developed by Twitch Security. Check out the full research. Background # Twitch is an interactive live-streaming service for content, gaming, entertainment, sports, and music. In…
I have given a talk about my latest research, “Attack Vectors on Terraform Environments”. About the talk # Have you ever encountered an environment in an engagement that uses Terraform for IaC (infrastructure-as-code) management? Almost every modern company does now. In this talk, I will share techniques and attack vectors to exploit and compromise Terraform environments in…
I interviewed with the AppSec Podcast to talk about IaC and Terraform. We discussed Terraform, why IaC is important to your organization, the technical risks introduced when running Terraform in your environment, and a few discussions related to my DEFCON talk about Attack Vectors on Terraform Environments . Listen to the Podcast # Watch on YouTube # Listen on Spotify # Listen on Apple Podcast #
Have you ever tried analyzing a Terraform environment with thousands of cloud resources for security and DevOps? It used to be hard, until now! I’m open-sourcing my newest project, tfquery: a framework that allows running SQL queries on Terraform code. It saved me dozens of hours in analysis. tfquery helps answer questions that are hard to answer about your infrastructure-as-code. It allows…
Abstract # I’m releasing my latest project, Stressful.io , an advanced DDoS framework for testing DDoS defenses at scale. I also provide free simulations to non-profit organizations and startups focused on privacy and digital rights. I have always been fascinated by DDoS attacks. You may have the most sophisticated defenses, yet your organization can be directly affected by a DDoS attack…
I did an interview with Milad Aslaner about how I started in cyber security, what I have been building at FullHunt, the concept of asset discovery and continuous security, and how I started one of the first cyber security startups in the GCC region. Watch on YouTube # Listen on Spotify #
Hacking Zoom # Uncovering Tales of Security Vulnerabilities in Zoom # This blog post discusses my experiments in testing and hacking Zoom. Zoom has become one of the most high-performing tech companies of 2020. Zoom is a digital video conferencing software that went public in an IPO last year 1 , a few months before the global pandemic.
Cyber Security, as well as many industries, is trying to use COVID-19 for marketing purposes. As sad as it sounds, it’s true. COVID-19-themed attacks by threat actors are real. However, this is nothing new to the security world. We have always seen APTs utilizing global (and local) events and situations to their benefit. Threat Intelligence is the way to understand and protect against these…
I have noticed an odd behavior in the requests module in Python, which uses urllib3. I inspected the root cause via regression testing, and I found that the root cause was a change introduced in urllib3. import requests requests . get( 'http://127.0.0.1/../../../../doing/certain/check' ) This should typically send the request to /../../../../doing/certain/check . Instead, it requests…
Abstract # OhMyZsh was vulnerable to an RCE (Remote Code Execution) vulnerability due to arbitrarily trusting ENV files in the dotenv plugin. Users downloading a malicious repository or a compressed file can have their machines compromised due to the vulnerability. Background # OhMyZsh is a highly popular framework for managing ZSH configuration. At the time of writing, it’s ranked in the…
This blog post reviews the WASEC (Web Application Security for the Everyday Software Engineer) book by Alessandro Nadalin. First, I have worked with Alessandro to build the security program for Namshi (an Emaar-acquired company in Dubai, United Arab Emirates). It was an excellent experience with great talents I had the chance to work with. Alessandro was the CTO of Namshi, with a high record of…
Introduction # JWT (JSON Web Token) is a popular authentication/authorization protocol. It integrates cryptographic signatures into JSON objects to verify the object’s integrity. The approach of JWT is systematic and relatively simple. Several pieces of research covered the security aspects of JWT authentication. Several tools were also previously developed. However, after assessing the…
This is a blog post by Mazin Ahmed and Khaled Farah . Introduction # Popular social networks are affected by a “by-design” security vulnerability that allows unauthorized parties to control their search history. Unauthorized parties are capable of inserting their own chosen keywords in the search history of Google, Facebook, LinkedIn, and YouTube. Technical Details # The bug is…
I’m publishing my security research on the overview of the application-level security of the Swiss E-voting system. You can download the report at the following link: Download: Overview of the Application-Level Security of the Swiss Evoting System Best Regards, Mazin Ahmed
Abstract # Content-Security Policy (CSP) is one of the most important protection layers in client-side web security. A strict policy should not allow external communications to non-permitted hosts. This blog post demonstrates a bypass I found in Chrome and Firefox that permits backchannel communication leaks by requesting non-permitted domains. Background # I recently discussed how CSP can secure…
Background # DNS rebinding is a known attack against the same origin policy of modern browsers. The attack abuses DNS, where a request with a small TTL is set. After the TTL is reached, another query resolves to another IP address (a local or internal IP address in typical cases). This way, an unauthorized party can bypass the same origin policy by loading malicious code on browsers and executing…
I recently came across an interesting behavior in PHP. PHP permits the usage of Unicode characters as variable names. Therefore, friendly emojis can be used as a PHP variable. <? php $😶 = 'Hello World!' ; echo ($😶); Output: # >> Hello World! Which is valid. I thought about making a fancy example of a PHP webshell using emojis. This is made for entertainment purposes. No real advantage is gained…
Abstract # This is an experiment I have done to identify and utilize attribute separators in constructing XSS vectors. The crafted vectors can be used to bypass XSS filters on modern browsers. These characters can be used in bypassing WAF XSS filters. Background # An example of a common XSS vector is:
This blog post discusses a technique that can be used to bypass CSP (Content Security Policy). Background # What is CSP? # “ Content Security Policy ( CSP ) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting ( XSS ) and data injection attacks. These attacks are used for everything from data theft to site defacement or…
This blog post briefly reviews the ModSecurity Handbook - 2nd edition. I have been working in the WAF industry for quite a long time. My main interest is WAF evasions, where I worked on the popular “Evading All WAF XSS Filters” research. In 2015, the research results showed that ModSecurity (with CRS) is the most difficult to evade, according to my testing. After I finished my…
This blog post is written as a list of tips and notes on starting the field of Information Security. Question # How do you start in the field of information security? I want to become a bug bounty hunter, ethical hacker, web-app tester, or gain better knowledge in security testing. How do I start? Answer # The following are tips and points that should be followed when getting into the field of…
I have noticed a weird behavior in .DESKTOP file extensions that can be used as a malware vector. This issue is not detected as malware by any known AVs, and the way it behaves makes it a rich resource for spreading malware against Ubuntu and Linux Desktop users in general. I will focus on Ubuntu Desktop in this blog post. Introduction # File managers on Ubuntu (Nautilus, Caja, and Thunar are…
One of the things that my clients like in my work is that I always like to do my best in providing technical Proof of Concepts in findings I discover. This makes it easier for technical departments to reproduce the issues and is also an excellent way to show how bugs and issues can be exploited. I recently had an assessment where I discovered several publicly exposed Apache server-status…
In October 2016, I was pleased to speak at the Swiss Cyber Storm 2016 conference about Bug Bounty Hunting and my experience as a Bug Bounty Hunter. About the Talk # The talk discusses Bug Bounty Programs from various domains. The talk discusses the usage of Bug Bounty Programs for companies and how it can be implemented within a company to have a better security cycle. I also explained common…
Testing and Exploiting Backup-File Artifacts with BFAC # On August 13th, 2016, I talked about Backup-File Artifacts. This attack vector is not commonly known, nor tested by penetration testers, yet it can be critical to the security of the web environment. At the end of the talk, I released BFAC, an automated security tool that tests for Backup-File Artifacts missed on web servers and can disclose…
In this post, I will discuss an exciting bug affecting Google Blogger. This security bug has been left undiscovered since around 2007. The bug allows an attacker to trick the victim into revealing his email address using UI-redressing techniques. Background # We always see a header on blogs that are hosted on Google Blogger that looks like the following: For unauthenticated users:
Recently, I have been working on research that discusses various techniques for bypassing the protection of the NoScript Security Suite. In this paper, I have demonstrated techniques that can be used to bypass the NoScript Security Suite using MITM attacks. I have also provided a valid proof of concept that can be used in real-world attacks. Furthermore, I have shown how bypassing NoScript…
This post will discuss why a professional penetration tester should not use OWASP Mantra or HconSTF. I will also introduce “The Firefox Security Toolkit,” a simple tool I have built that can be an excellent replacement for these two projects and provides better security for the penetration tester. What are OWASP Mantra and HconSTF? # OWASP Mantra & HconSTF are browsers that are…
During recent months, I have been working on research showing that all web application firewalls fail to protect against attacks as expected. The research focuses on evading the XSS filters of all popular web application firewalls, such as F5 Big IP, Imperva Incapsula, AQTRONIX WebKnight, PHP-IDS, ModSecurity, Sucuri, QuickDefense, and Barracuda WAF. All of them were evaded in the research. After…
Google Password Alert has become very popular recently. It’s practical and a great defensive way to mitigate phishing damages against Google users. It has been bypassed several times as soon as it arrived, and Google has patched all the known techniques. After hearing that Google had patched all known techniques, I thought about testing it to see how long it would take me to bypass it. My…
In this post, I will demonstrate the findings of multiple interesting cross-site request forgery vulnerabilities I identified on Facebook. These vulnerabilities allow an attacker to force the victim to do various actions. In April 2015, Facebook officially launched messenger.com, a stand-alone messenger for the web. After hearing about the launch, I started to test it in my spare time. Sending…
I have recently released an article about HSTS Policy in Modern Browsers. It has been released on ProtonMail Blog. Title: Summary of HSTS Support in Modern Browsers # Date of Publish: May 28th, 2015 # Link: https://blog.protonmail.ch/summary-of-hsts-support-in-modern-browsers/ # In case there are any issues in viewing the article, you can download the article in PDF via the following links:
In January 2015, I participated in the eBay bug bounty program. At that time, bug bounty programs were not the same as now. The bug bounty program industry has increased by almost 100% compared to last year, and every week, a new bug bounty program starts on bug bounty platforms. I typically report a single issue (the first finding), and based on the bug bounty program communication, I then decide…
In this post, I will be talking about a critical vulnerability that affects W3 Total Cache, the most popular WordPress plugin in the world. Most major companies use W3 Total Cache, which provides a vital service that every WordPress website needs. Overview on W3 Total Cache # “W3 Total Cache improves your site’s user experience by increasing server performance, reducing the download…
In this post, I will share a new critical issue I identified on Instagram Mobile App. During my tests on their Android app, I set up a lab to pentest the app. Then, I started using the app on my phone and monitoring the traffic on the network using Wireshark, looking for evidence of unencrypted data that goes through the network or a technique to make this data unencrypted (if it were encrypted).…
When I was checking the Facebook WhiteHat page, I realized that they added a new target to the scope: Onavo. I downloaded their apps and started to intercept the links that I found. One of the links raised an eyebrow. I said to myself that this looks vulnerable. The link looks something like this:…
I have reported a Cross-Site Scripting vulnerability on WikiLeaks’ new search engine. WikiLeaks has fixed the vulnerability promptly. UPDATE: Read this article for more info: https://news.softpedia.com/news/XSS-Vulnerability-Found-in-WikiLeaks-Internal-Search-Engine-428166.shtml
I have identified a PHP code execution vulnerability on Bugcrowd. Bugcrowd is the premier marketplace for security testing on web, mobile, source code, and client-side applications, with over 7000 security researchers participating in their bug bounty platform.
Oracle has acknowledged me for finding a Cross-Site Scripting Vulnerability.