Client-Side SSRF to Credential Theft via Exported Android Activity
How reading one exported Activity by hand, following an unvalidated URL field, and misreading the impact twice led to a one-tap session token leak any co-installed app could trigger.
// the blog
Blog
Deep dives, notes and field reports from the collective.
// latest
// more writing
Can Android Be XSSed? Account Takeover Through JavaScript Bridge
A clean reflected XSS on an auth-less subdomain that topped out at alert(1), and the investigation that turned it into a critical account...
A $3500 USD HTML Injection, Escalating a Low Bug with a CSRF-like
A reflected HTML injection my partner was about to file as low. Here is the investigation that turned it into an account takeover, includ...