YS @YShahinzadeh

Security enthusiastic, chess player voorivex.team Istanbul, Turkey Joined September 2012

Tweets

2K
Followers

15K
Following

459
Likes

2K

YS @YShahinzadeh

5 days ago

just crossed 10k on H1

25 1 321 7K 8

Download Image

poking around with @AmirMSafari on a public program, no WAF bypass, no special payload 3x Dom XSS: javascript:alert(origin) CSPT + parameter pollution: critical CSRF HTMLi: leaking URL equipped with token Tip: read JS files curiously, do not rush for bug, enjoy the process :]

23 28 534 14K 140

Download Image

Omid Rezaei @omidxrz

2 weeks ago

after a long time, I decided to write a blog post about one of the old bugs I found in an Android app, which finally led me to achieve 0-Click Mass Account TakeOver it's now published, you can read it here : blog.voorivex.team/0-click-mass-a…

23 51 330 13K 157

YS @YShahinzadeh

3 weeks ago

Today I’m happy even though I’m dying from a damn virus :[

16 1 299 10K 26

Download Image

Omid Rezaei @omidxrz

a month ago

after many unlucky moments in bug bounty, july was fun with interesting findings, I made around $30k bounty, mostly from XSS and OAuth in august, I've planned to dive deeper into client-side stuff

67 27 636 28K 167

Download Image

Sky Desperados @jusxing

a month ago

After my first year of full-time bug hunting, I successfully completed Justin’s Challenge on @Hacker0x01 . I want to share a few things that might help beginners. The bugs I’ve earned the most from are IDOR and XSS — they’re great to focus on when you're getting started. One…

Justin Gardner @Rhynorater

2 years ago

84 1K 4K 502K 5K

Download Image

31 43 406 31K 218

Download Image

YS @YShahinzadeh

2 months ago

I've recently passed 9k on H1,

15 1 322 9K 9

Download Image

YS @YShahinzadeh

2 months ago

Has the HackerOne Mediation team's responsiveness slowed down, or am I just having bad luck? They opened a ticket (#594174) to gather my feedback on a report's status, but I haven’t received any response from them in over a month

11 0 109 10K 6

YS @YShahinzadeh

2 months ago

Q2 is over. I’ve pushed so hard in 2025, I think I’m going to slow things down for Q3. It’s summer, and I think I need some relaxation: “Shirazi Mode” activated. (Shiraz is a city in Iran where people are famously calm and laid-back)

26 9 289 14K 34

Download Image

YS @YShahinzadeh

2 months ago

95% of self-XSS vulns are exploitable. In cases of OAuth or a page containing sensitive information + login/logout CSRF -> ATO or info leak. I’ve previously tweeted a white box challenge based on a real-world example, you can practice with it :]