Ep. 12 – Timing Attacks & Mobile OAuth Hijack: When Microseconds and Misflows Betray You

Hacked & Secured: Pentest Exploits & Mitigations

Contenuto fornito da Amin Malekpour. Tutti i contenuti dei podcast, inclusi episodi, grafica e descrizioni dei podcast, vengono caricati e forniti direttamente da Amin Malekpour o dal partner della piattaforma podcast. Se ritieni che qualcuno stia utilizzando la tua opera protetta da copyright senza la tua autorizzazione, puoi seguire la procedura descritta qui https://it.player.fm/legal.

4M ago 14:09

MP3•Pagina principale dell'episodio

Fetch error

Hmmm there seems to be a problem fetching this series right now. Last successful fetch was on October 30, 2025 14:43 (2M ago)

What now? This series will be checked again in the next day. If you believe it should be working, please verify the publisher's feed link below is valid and includes actual episode links. You can contact support to request the feed be immediately fetched.

A few microseconds. One silent browser session. That’s all it took for attackers to break into systems without tripping a single alert.

In this episode of Hacked & Secured: Pentest Exploits & Mitigations, we explore two subtle but devastating flaws:

🔹 Timing Attacks for Token Leaks – By measuring microsecond delays, attackers were able to recover secrets, without seeing them in responses.

🔹 OAuth Hijack via Mobile App Flows – A crafted app abused in-app browser sessions and custom URL schemes to silently steal valid login tokens from users on iOS.

These aren’t theoretical bugs—they were found in the wild and affect real apps. If you build or test auth systems, this episode is for you.

Chapters:

00:00 - INTRO

01:11 - FINDING #1 - Timing Leaks That Speak Volumes

06:56 - FINDING #2 - Hijacking Mobile OAuth with One Silent Redirect

13:06 - OUTRO
Want your pentest discovery featured? Submit your creative findings through the Google Form in the episode description, and we might showcase your finding in an upcoming episode!
🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram
📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A
📧 Feedback? Email Us → [email protected]
🔗 Podcast Website → Website Link

Capitoli

1. INTRO (00:00:00)

2. FINDING #1 - Timing Leaks That Speak Volumes (00:01:11)

3. FINDING #2 - Hijacking Mobile OAuth with One Silent Redirect (00:06:56)

4. OUTRO (00:13:06)

14 episodi

#Tech #Careers #Business #Penetration Testing #Bug Bounty #Ethical Hacking #Web Security #Application Security #Offensive Security #Podcasting Education #Amin Malekpour #DevSecOps #Secure Coding #Security Hardening #Secure Software Development #Security Best Practices #Red Team

Ep. 12 – Timing Attacks & Mobile OAuth Hijack: When Microseconds and Misflows Betray You

Hacked & Secured: Pentest Exploits & Mitigations

published 4M ago

MP3•Pagina principale dell'episodio