Ammar’s Blog

Just by clicking a link, it’s possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones.

tl;dr I found a remote code execution bug in VSCode that can be triggered from untrusted workspaces.

This is a rather large blog post consisting of multiple sections from some quick background information about the problem to an in-depth dive into the hacking process, reverse engineering and final custom application.

What are iClickers?

Problem Description Deep on the web, I discovered a secret key validation.

Problem Description Ever since their hella successful ICO, the crypto experts at VapeCoinIO have put developers first with their simple, intuitive, and, most importantly, secure API.

A lesson on data structures, networking protocols, data sanitization and disclosure Around 2 years ago, I was enthusiastically working on Spigot and Bukkit along with a couple of fairly popular plugins.

Custom API being used by a javascript web page, android and php graphing program.