Ibrahim Radi, Security Engineer and technical co-founder of Flawtrack. Attack Surface Management, threat intelligence, DevSecOps, penetration testing, and CTF.https://ibraradi.me/https://ibraradi.me/blog/defeating-a-flutter-rasp/https://ibraradi.me/blog/defeating-a-flutter-rasp/Defeating a four-layer Flutter RASP across Java, native C, and compiled Dart - and why, for a Frida-aware app, Frida is the wrong tool (use Magisk's Zygisk DenyList instead).Wed, 24 Jun 2026 00:00:00 GMThttps://ibraradi.me/blog/intercepting-firestore/https://ibraradi.me/blog/intercepting-firestore/How a small observation ("the app works, the proxy's running and traffic is flowing, yet I never capture a thing") turned into a reusable tool for intercepting, editing, and replaying Google Cloud Firestore traffic from a mobile app.Wed, 17 Jun 2026 00:00:00 GMThttps://ibraradi.me/blog/attachment-handling-lfi-ssrf-takeover/https://ibraradi.me/blog/attachment-handling-lfi-ssrf-takeover/An email feature fetched attachments by URL, but it also resolved a bare local path. No protocol, no metadata trick, just a filename: reading /proc/self/environ returned the process environment and its secrets (AWS, Twilio, SendGrid, Stripe, DB strings) straight into my inbox.Sun, 17 May 2026 00:00:00 GMThttps://ibraradi.me/blog/cross-subdomain-jwt-account-takeover/https://ibraradi.me/blog/cross-subdomain-jwt-account-takeover/A red-team case study: weak JWT validation (keyed on email), no email verification, and a spoofable Source header let one token cross tenants and escalate to full admin across a multi-tenant SaaS.Tue, 05 Mar 2024 00:00:00 GMThttps://ibraradi.me/blog/manipulating-email-trust/https://ibraradi.me/blog/manipulating-email-trust/Accounting tools that import receipts by email decide who owns an incoming message by its sender. Set that source to noreply@github.com and GitHub's verification code lands in your portal; bridge Slack through an Apple OAuth account, and one invoice feature becomes account takeover of a company's GitHub and Slack.Sun, 03 Mar 2024 00:00:00 GMThttps://ibraradi.me/blog/automated-discovery-to-manual-exploitation/https://ibraradi.me/blog/automated-discovery-to-manual-exploitation/Wayback recon surfaced an appointment platform that carried session tokens in GET parameters and leaked PII in archived URLs. From there: a space-free XSS in the phone field a prior hunter missed, and a stored XSS through a file-upload URL reflected unsanitised into the admin panel.Wed, 14 Jun 2023 00:00:00 GMThttps://ibraradi.me/blog/xss-in-soql-console/https://ibraradi.me/blog/xss-in-soql-console/A management dashboard let admins run SOQL queries and rendered the results as HTML. By seeding XSS into user records on the managed site and hitting the raw QueryConsole endpoint, which returned HTML instead of JSON, the payload fired in any console user's browser.Thu, 18 May 2023 00:00:00 GMThttps://ibraradi.me/blog/free-to-paid-response-manipulation/https://ibraradi.me/blog/free-to-paid-response-manipulation/A hosting product gated its paid themes and features entirely in the client. By diffing a free response against a paid one and rewriting the bytes the browser trusts, a free account got the full paid experience, then I packaged it as a browser extension.Fri, 03 Mar 2023 00:00:00 GMThttps://ibraradi.me/blog/ml-model-pickle-rce/https://ibraradi.me/blog/ml-model-pickle-rce/Loading a shared model file can be remote code execution, because Python's pickle format is not data, it is a program. A crafted phishing-detection model runs the attacker's command the moment an engineer calls pickle.load().Sat, 20 Aug 2022 00:00:00 GMThttps://ibraradi.me/blog/came-looking-for-ssrf-and-found-xss/https://ibraradi.me/blog/came-looking-for-ssrf-and-found-xss/A bookmark importer fetched a URL and previewed its title and link tags. Every SSRF payload failed, but the title tag was not sanitized (self-XSS), and an audio/onerror trick slipped past the save-time event-handler filter into a stored XSS.Thu, 04 Aug 2022 00:00:00 GMT