Viewing profile — 0xcrypto

A question, how are you or anyone else doing this is registering bundle identifiers without opening xcode?

Fewer CVEs do not necessarily mean safety.

My only concern with such articles is the use of "god" and "religion" which only gives the majority of humanity a reason to pray more and kill anyone who disagrees. Conscious or no…

Agree with this. I tried to create objective C files in xcode 15.2 many times, spent days thinking I must have messed up somewhere and finally I found this https://forums.developer…

You are right that redirect_uri must match the exact registered redirect_uri. But some providers allow query parameters. For Microsoft, it was possible in 2020 when I reported the …

Well mistakes happen. One thing that is still not explained is that I contacted Hackerone many times in the timespan of 3 years but they couldn't get in contact with you either. Al…

Author of the blog post here. Yes, I agree that it wasn't Hackerone's fault and they tried their best to help. As for the violation of agreement with hackerone, I have read the pol…

Oh yes, that sounds better. I am changing the title now. Updated to "Stealing OAuth tokens of connected Microsoft accounts via open redirect in Harvest App"

Hi, author of the blog post here. Yes I understand your concern and I tried keeping Microsoft's name out of the title but couldn't think of anything else. Since the vulnerability o…

Looks pretty neat.