Ali Khan

6 days ago | medium.com | Ali Khan

For the past three years, an unusual morning ritual has been a constant in my life. While many start their day by reaching for their phone, scrolling through social media, or sipping coffee, my routine was different: I opened arXiv.org — the open-access repository for academic research — and navigated to the Computer Science section. There, I would meticulously scan the titles and abstracts of newly submitted research papers.

1 week ago | medium.com | Ali Khan

OverviewDuring security testing of a private bug bounty program, I discovered a serious flaw in the way OAuth sessions were handled after an account’s email address was changed. Surprisingly, both the old and new Google accounts remained valid SSO connections – meaning an attacker could log in using the previously linked Google account even after the user changed their email.

1 week ago | medium.com | Ali Khan

While testing a private program on a bug bounty platform, I discovered a critical vulnerability that allowed me to bypass two-factor authentication (2FA) and link my attacker-controlled Facebook account to a victim’s 2FA-enabled account – ultimately achieving full account takeover. This post walks through how I identified the issue, exploited it, and responsibly disclosed it.

1 week ago | medium.com | Ali Khan

IntroductionWhile hunting on a private program on HackerOne, I encountered a subdomain where the server-status endpoint returned a 403 Forbidden response. But with a simple trick, I was able to bypass this restriction and access sensitive Apache server stats – leading to a valid triaged report. This article shares the exact method I used and how you can test for similar issues.

1 week ago | medium.com | Ali Khan

DiscoveryWhile probing a 403-restricted Microsoft subdomain, I came across a quietly exposed diagnostic endpoint – Trace.axd. What seemed like a harmless debug route turned out to offer unrestricted access to clear server logs with a single click – and no login required. Here’s how I found it, why it mattered, and what security lesson it reinforces.