Egor Homakov

How I hacked Github again

This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...

"Egor, stop hacking Github"

Cookie Bomb or Let's Break the Internet

TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will keep sendin...

How github was hacked

So I commited in rails/rails repo I simply added a <input value=USER_ID name=public_key[user_id]> field to Public key update form, where U...

Did GitHub Suspend Egor Homakov account?

Hacking Github with Webkit

Previously on Github: XSS , CSRF ( My github followers are real , I gained followers using CSRF on bitbucket ), access bypass, mass assignm...

How we hacked Facebook with OAuth2 and Chrome bugs

TL;DR We (me and @isciurus ) chained several different bugs in Facebook, OAuth2 and Google Chrome to craft an interesting exploit. Mallory...

CSRF in Doorkeeper OAuth2 gem

I read a post about CSRF on DigitalOcean (in Russian) by Sergey Belove . My first reaction was, obviously, how come ? DigitalOcean is not k...

The No CAPTCHA problem

When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what? Finally it...

Two "WontFix" vulnerabilities in Facebook Connect

TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_r...

#1 CSRF Is A Vulnerability In All Browsers

Navigation: #1 CSRF Is A Vulnerability In All Browsers - You MUST Deny It ASAP. #2 top secret(will be published on April 1) #3 Another Ra...

How to send DMs on Twitter without permission

I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button. It works! Twitt...

RJS leaking vulnerability in multiple Rails applications

I wrote about this problem in May, without showcases, just a theoretical post http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techn...

OAuth1, OAuth2, OAuth..? (2013)

TL;DR OAuth2 sucks. Please don't think about OAuth2 as about the next generation of OAuth1. They are completely different like colors: O...

New Paypal gateway UI susceptible to spoofing

Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...

Account hijacking on MtGox

If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...

Achilles Heel of OAuth or Why Facebook Adds #_=_

This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounties...