Author Archive

5,000 USD XSS Issue at Avast Desktop AntiVirus for Windows (Yes, Desktop!)

Author: | Categories: Bug Report, Write-Up No comments
Mirroring from my Medium: https://medium.com/@YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968 CVE-2019–18653 & CVE-2019–18654: The story when Reflected XSS was triggering from SSID Name (It also affected AVG AntiVirus since basically the code of the those products was mostly “merged”). In the name of Allah, the Most Gracious, the Most Merciful. So, this article will be

Illegal Rendered at Download Feature in Several Apps (including Opera Mini) that Lead to Extension Manipulation (with RTLO)

Author: | Categories: Bug Report, Mobile Apps, Write-Up No comments
The story while you download a file that looks “legitimate” with its extension, but it changes when you execute the file. As a little note, we also add few simples bug hunting tips related this RTLO things at the end of article. In the name of Allah, the Most

Race Condition that could Result to RCE – (A story with an App that temporary stored an uploaded file within 2 seconds before moving it to Amazon S3)

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
In the name of Allah, the Most Gracious, the Most Merciful. – Part I from (hopefully) IV Parts – Update I: Added a “Reference” Section. Update II: “We” at this series of article will refer to Faisal Yudo Hernawan, Tomi, and Me. Update III: The way to exploiting the “upload.php” function has been released at

IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
  In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple: [English Version] IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks I. PRE-INTRODUCTION Few months ago, I got an invitation

Ribose – IDOR with Simple CSRF Bypass – Unrestricted Changes and Deletion to other Photo Profile

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple: [English Version] Ribose – IDOR with Simple CSRF Bypass – Unrestricted Deletion to other Photo Profile I. ABSTRACT Introducing ourselves in the use of social

[Bahasa] Multiple Parameter Pollution Bugs at “Battle Camp” Game that could Leads to Several Illegal Action

Author: | Categories: Mobile Apps, Write-Up in Bahasa No comments
In the name of Allah, the Most Gracious, the Most Merciful. Silahkan langsung mengunduh paper sederhana pada tautan berikut ini untuk dapat melihat tulisan ini lebih nyaman: [Bahasa] Multiple Parameter Pollution Bug at “Battle Camp” Game that could Leads to Several Illegal Actions I. SELINGAN INSTAN YANG TIDAK TERLALU

Lack of Binary Protection at Asus “Vivo Baby” and “HiVivo” for Android that could Result of Several Security Issues (CVE-2017-17944 & CVE-2017-17945)

Author: | Categories: Bug Report, Mobile Apps, Write-Up No comments
In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release (for a simple look): [English Version] Asus – Lack of Binary Protection at Asus “Vivo Baby” and “HiVivo” for Android that could Result of Several Security Issues

Bypassing the Current Password Protection at PayPal Tech-Support

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release: [English Version] PayPal – Bypassing the Current Password Protection at PayPal Tech-Support For completing the explanation, we upload the unlisted video at Youtube: https://youtu.be/QGBpjDDs9pY

Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Search Engine

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release: [English Version] PayPal – Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Search Engine For completing the explanation, we upload the unlisted video at Youtube for

Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal”

Author: | Categories: Bug Report, Web Apps, Write-Up No comments
Please kindly visit this simple paper directly to looking this release (for a simple look): [English Version] PayPal – Turning Self-XSS into non-Self Stored-XSS via Authorization Issue For completing the explanation, we upload the unlisted video at Youtube for both of scenario: Stored XSS (via Malicious SVG File) at