From Establishment IDOR to Account Takeover: Changing One Number Was Enough
Abdulaziz Saad
Command Palette
Search for a command to run...
Archive
8 posts published so far
The $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PII
Abdulaziz Saad
From Editor to Owner: One Writable Field Was Enough to Take Over an Organization
Abdulaziz Saad
A $2,000 API Key: Unauthorized Access to Paid Medical Transcription
Abdulaziz Saad
From Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was Enough
Abdulaziz Saad
IDOR in Government Ownership API Exposed Private Business Owner PII via CR Number Enumeration
Abdulaziz Saad
Zero-Click Stored XSS in Chat: When “Just Open the Window” Is Enough
Abdulaziz Saad
From Username Enumeration to Subscriber PII: Chaining 3 Weak Findings in a Telecom Ecosystem
Abdulaziz Saad