Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong

Hacked & Secured: Pentest Exploits & Mitigations

Amin Malekpour द्वारा प्रदान की गई सामग्री. एपिसोड, ग्राफिक्स और पॉडकास्ट विवरण सहित सभी पॉडकास्ट सामग्री Amin Malekpour या उनके पॉडकास्ट प्लेटफ़ॉर्म पार्टनर द्वारा सीधे अपलोड और प्रदान की जाती है। यदि आपको लगता है कि कोई आपकी अनुमति के बिना आपके कॉपीराइट किए गए कार्य का उपयोग कर रहा है, तो आप यहां बताई गई प्रक्रिया का पालन कर सकते हैं https://hi.player.fm/legal।

5M ago 17:15

MP3•एपिसोड होम

Fetch error

Hmmm there seems to be a problem fetching this series right now. Last successful fetch was on October 30, 2025 14:43 (2M ago)

What now? This series will be checked again in the next day. If you believe it should be working, please verify the publisher's feed link below is valid and includes actual episode links. You can contact support to request the feed be immediately fetched.

One flawed password reset. One shared session token. One dangerous object.

In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world vulnerabilities where trust between systems and users broke down—with serious consequences.

Account Takeover via Forgot Password – A predictable ID and exposed tokens let attackers reset passwords without access to email.
Session Hijack in OTP Login – A logic flaw in how login tokens were handled allowed full account access with just a user ID.
Remote Code Execution via Java Deserialization – A community-contributed finding where an exposed service deserialized untrusted input, leading to code execution.

These aren’t complex chains. They’re common mistakes with big impact—and important lessons for developers, security teams, and testers.

Chapters:

00:00 - INTRO

00:59 - FINDING #1 - Account Takeover via Forgot Password

06:26 - FINDING #2 - Shared Session Token in SMS Login Flow

10:39 - FINDING #3 - Java Deserialisation to Remote Code Execution

16:13 - OUTRO
Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!
🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
📧 Feedback? Email Us → [email protected]
🔗 Podcast Website → Website Link

अध्यायों

1. INTRO (00:00:00)

2. FINDING #1 - Account Takeover via Forgot Password (00:00:59)

3. FINDING #2 - Shared Session Token in SMS Login Flow (00:06:26)

4. FINDING #3 - Java Deserialisation to Remote Code Execution (00:10:39)

5. OUTRO (00:16:13)

14 एपिसोडस

#Tech #Careers #Business #Penetration Testing #Bug Bounty #Ethical Hacking #Web Security #Application Security #Offensive Security #Podcasting Education #Amin Malekpour #DevSecOps #Secure Coding #Security Hardening #Secure Software Development #Security Best Practices #Red Team

Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong

Hacked & Secured: Pentest Exploits & Mitigations

published 5M ago

साझा करें

MP3•एपिसोड होम