Mian - Security Researcher

Socials

Twitter

Just a curious mind, exploring the web.

Lets catchup, my Discord is open.

LinkedIn here too.

The Art of Account Lockouts

A deep dive into account lockout vulnerabilities and creative exploitation techniques.

Headless Parser

A headless browser tool for dynamic parsing of JavaScript-rendered pages.

The Redirect Any App Could Catch leading to ATO

From a decompiled APK to minting my own OAuth tokens, and the custom scheme that let any app on the phone catch them to Account Takeover.

When a Send Button Becomes a Trusted Mail Relay

A business-logic bug that turned a fresh account with no company context into a fully functional phishing relay using the platform's own mail infrastructure.