Ahmed Najeh – Medium

Jul 2

How did I get 3300$ With Just FFUF!!

By searching inside one of the Bitcoin platforms I found there a place to document accounts by sending documents such as ID or passport with Selfie ) I decided to upload a picture and send a request to Burp so that I know where to upload it And as I expected, he got my picture link within the same domain like this:- https://test.com/portal/api/uploads/241241451252/content I changed the last number which is the `id` of the uploaded image And I didn’t get anything

1 min read

1 min read

Apr 9

EZ 100$ with Change the account name after authenticating it

Hello, I found out that it is possible to change the name of the account after creating it This feature is not available on the site because the profile__firstname parameter is disabled Reproduction 1- go to https://app.dev-weareblox.com/settings/profile and click on Create New Account 2- make an Account and go to settings 3- Change Country and click Save Changes send a request to burp 4- now change the parameter name firstName or lastname

1 min read

EZ 100$ with Change the account name after authenticating it

1 min read

Feb 21, 2021

Content length restriction bypass can lead to DOS

You specified while sending a message that did not specify the size of the text being sent This problem may lead to a defect Reproduce 1- go to sign at https://security.ibmviprewards.ibm.com/ 2-and now send massage at “https://security.ibmviprewards.ibm.com/inbox/" to any one I have tried it on a second account 3- send massage…

2 min read

Content length restriction bypass can lead to DOS

2 min read