Home on Sicksec

Hunting Account Takeovers in the Wild West of MCP OAuth Servers

Sat, 24 Jan 2026 00:00:00 +0000

TL;DR: We discovered that many MCP (Model Context Protocol) servers powering AI integrations like ChatGPT and Claude have critically misconfigured OAuth implementations. Open Dynamic Client Registration (DCR) combined with missing redirect URI validation and optional PKCE enforcement creates a perfect storm for one-click account takeover attacks.

What’s an MCP Server Anyway?#

If you’ve been following the AI ecosystem lately, you’ve probably noticed something interesting: AI assistants are getting connected. They can now deploy your code, manage your cloud infrastructure, send emails—basically act as your digital butler.

Abusing URL Shorteners for Fun and Profit

Wed, 26 Feb 2025 07:32:53 +0800

Hello Security Researchers

Have you ever encountered a bug where it’s hard to show impact due to the lack of enumeration of a certain value of a parameter ? Well if yes, In this writeup I will talk about how you can find and abuse URL shortners to ATO or Information disclosure

Many companies use URL shortners to send private invite and passwordless logins and things along those lines and it’s really difficult to guess or to brute these but there’s always a way to do things by thinking outside the box 📦

How I Scored $2K via an Easy IDOR

Wed, 26 Feb 2025 07:32:53 +0800

Hello Security Researchers

In this writeup I will talk how I was able to find an IDOR in one of the largest Russian Company nothing other than Mail.ru So approaching targets with huge scope can be frustrating sometimes since you don’t know where to start, For me I started looking in the main scope of Mail.ru Games

I fired up Burp
Created an account
Adding things in my cart
Viewing the blog
Creating a support ticket

Before testing anything the ticket link looked kind of suspicious since it had /ticket/INTEGER

Account Takeover via an Unsanitized Facebook OAuth Redirect Scheme

Fri, 01 Sep 2023 07:32:53 +0800

Deep Dive into an OAuth Exploit: A 0-Day Case Study#

Hello Everyone,

In our continuous hunt for novel attack vectors and security challenges, mainteemoforfun and I embarked on an in-depth exploration of mobile authentication mechanisms. Our efforts culminated in the discovery of a striking 0-day vulnerability back in 2023 that has since been patched.

This vulnerability enabled us to potentially hijack user sessions on websites utilizing Facebook’s “Login With Facebook” feature. By manipulating the redirect_uri parameter in the OAuth flow, an attacker could redirect authentication tokens to a host under their control.

How I RCE'd the Largest RU Company

Thu, 19 Aug 2021 07:32:53 +0800

Hello Security Researchers

In this writeup I will explain how I was able to find RCE in Mail.ru which is considered the world largest internet company, Before starting to hack I was wondering on how I should approach the target and what most people would miss in the program, they have a huge scope which means it should be something out there sitting for me to find

I started looking with the Favicon using this script Where I replace the link with the Mail.ru favicon, once generate I go to shodan.io and search for it

How I Scored 1K Bounty Using Waybackurls

Tue, 03 Aug 2021 07:32:53 +0800

Hello Security Researchers

In this write-up, I want to share with you a finding that I discovered in a public bug bounty program that ended up paying me 1K just using a single command on the terminal

I won’t be able to disclose the name of the program since the leak was huge and they are still merging all the previous algorithm they used before to a new one and the deprecated API is still reachable

Tale of XSS in Angular

Sun, 01 Aug 2021 00:00:00 +0000

Angular XSS Featured Image

Hello Security Researchers and Hackers

In this writeup I explain how I found 2 rXSS vulnerabilities in Angular using automation.

Tools Used#

Findomain for subdomain monitoring
Wappalyzer for technology detection

Discovery Process#

Received Telegram alert for new subdomains
Identified Angular 1.6 using Wappalyzer
Found reflected error parameter:

https://redacted.com/Home/Error?error=USER_NOT_AUTHORIZED

Exploitation#

Used payload from PayloadsAllTheThings: