Mazin Ahmed

I’ve been working with agentic AI for the past two years, and I kept hitting the same wall: managing the tasks and to-dos it generates.

If you haven’t heard the news, GitHub confirmed unauthorized access to internal repositories through a malicious VS Code extension.

Introduction # VS Code and AI-powered IDEs could lead to the largest security breaches in the industry in the near future.

Prompt injection attacks are one of the most common LLM security threats we have all seen while reviewing LLM implementations, integrations, and AI-powered systems.

Large Language Models have completely changed how we automate, create, and solve problems.

What Happened?

Ensuring the security of your organization’s sensitive information is critical for any security team, and detecting secrets is a key part of that.

Riyadh, Saudi Arabia, recently hosted BlackHat MEA (Middle East & Africa), the largest security conference in the Middle East and Africa region.

I recently spoke at BlackHat MEA 2022, the largest security conference in the Middle East and Africa region.

In 2019, Khaled Farah and I participated in a security competition for developing offensive security tools.

New Release: tfquery now supports SQL queries for Terraform Plan Scanning In case you’re an infrastructure security engineer and have not tried tfquery yet, this will be a great blog post for you.

# How was Twitch hacked?

I have given a talk about my latest research, “Attack Vectors on Terraform Environments”.

I interviewed with the AppSec Podcast to talk about IaC and Terraform.

Have you ever tried analyzing a Terraform environment with thousands of cloud resources for security and DevOps?

Abstract # I’m releasing my latest project, Stressful.io, an advanced DDoS framework for testing DDoS defenses at scale.

I did an interview with Milad Aslaner about how I started in cyber security, what I have been building at FullHunt, the concept of asset discovery and continuous security, and how I started one of the first cyber security startups in the GCC region.

Hacking Zoom # Uncovering Tales of Security Vulnerabilities in Zoom # This blog post discusses my experiments in testing and hacking Zoom.

Cyber Security, as well as many industries, is trying to use COVID-19 for marketing purposes.

I have noticed an odd behavior in the requests module in Python, which uses urllib3.

Abstract # OhMyZsh was vulnerable to an RCE (Remote Code Execution) vulnerability due to arbitrarily trusting ENV files in the dotenv plugin.

This blog post reviews the WASEC (Web Application Security for the Everyday Software Engineer) book by Alessandro Nadalin.

Introduction # JWT (JSON Web Token) is a popular authentication/authorization protocol.

This is a blog post by Mazin Ahmed and Khaled Farah.

I’m publishing my security research on the overview of the application-level security of the Swiss E-voting system.

Abstract # Content-Security Policy (CSP) is one of the most important protection layers in client-side web security.

Background # DNS rebinding is a known attack against the same origin policy of modern browsers.

I recently came across an interesting behavior in PHP.

Abstract # This is an experiment I have done to identify and utilize attribute separators in constructing XSS vectors.

This blog post discusses a technique that can be used to bypass CSP (Content Security Policy).

This blog post briefly reviews the ModSecurity Handbook - 2nd edition.

This blog post is written as a list of tips and notes on starting the field of Information Security.

I have noticed a weird behavior in .DESKTOP file extensions that can be used as a malware vector.

One of the things that my clients like in my work is that I always like to do my best in providing technical Proof of Concepts in findings I discover.

In October 2016, I was pleased to speak at the Swiss Cyber Storm 2016 conference about Bug Bounty Hunting and my experience as a Bug Bounty Hunter.

Testing and Exploiting Backup-File Artifacts with BFAC # On August 13th, 2016, I talked about Backup-File Artifacts.

In this post, I will discuss an exciting bug affecting Google Blogger.

Recently, I have been working on research that discusses various techniques for bypassing the protection of the NoScript Security Suite.

This post will discuss why a professional penetration tester should not use OWASP Mantra or HconSTF.

During recent months, I have been working on research showing that all web application firewalls fail to protect against attacks as expected.

Google Password Alert has become very popular recently.

In this post, I will demonstrate the findings of multiple interesting cross-site request forgery vulnerabilities I identified on Facebook.

I have recently released an article about HSTS Policy in Modern Browsers.

In January 2015, I participated in the eBay bug bounty program.

In this post, I will be talking about a critical vulnerability that affects W3 Total Cache, the most popular WordPress plugin in the world.

In this post, I will share a new critical issue I identified on Instagram Mobile App.

When I was checking the Facebook WhiteHat page, I realized that they added a new target to the scope: Onavo.

I have reported a Cross-Site Scripting vulnerability on WikiLeaks’ new search engine.

I have identified a PHP code execution vulnerability on Bugcrowd.

I have reported several critical vulnerabilities, such as SQL Injection and Cross-site Scripting, to the IT support center of the University of Calgary.