Mian - Security Researcher

Socials

Twitter

Just a curious mind, exploring the web.

Lets catchup, my Discord is open.

LinkedIn here too.

The Art of Account Lockouts

A deep dive into account lockout vulnerabilities and creative exploitation techniques.

Headless Parser

A headless browser tool for dynamic parsing of JavaScript-rendered pages.

Six Misconfigurations, One Click, Full Account Takeover

How I chained CSRF token bypass, SameSite=None cookies, HTTP method override, and text/plain Content-Type abuse into a single-click account takeover on a hardened production platform.

The Redirect Any App Could Catch leading to ATO

From a decompiled APK to minting my own OAuth tokens, and the custom scheme that let any app on the phone catch them to Account Takeover.