https://soroush.me/ https://soroush.me/contact https://soroush.me/blog https://soroush.me/bug-bounty-invites https://soroush.me/advisories https://soroush.me/blog/mongodb-nosql-injection-with-aggregation-pipelines2026-09-12T21:01:22.000Z https://soroush.me/blog/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-368992026-09-12T21:01:22.000Z https://soroush.me/blog/anchor-tag-xss-exploitation-in-firefox-with-target-blank2026-09-12T21:01:22.000Z https://soroush.me/blog/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure2026-09-12T21:01:22.000Z https://soroush.me/blog/mdsec-blog-posts-so-far-in-20202020-10-31T23:54:31.000Z https://soroush.me/blog/file-upload-attack-using-xamlx-files2026-09-11T10:57:01.000Z https://soroush.me/blog/uploading-web-config-for-fun-and-profit-22026-09-12T21:01:22.000Z https://soroush.me/blog/iis-application-vs-folder-detection-during-blackbox-testing2026-09-12T21:01:22.000Z https://soroush.me/blog/danger-of-stealing-auto-generated-net-machine-keys2026-09-12T21:01:22.000Z https://soroush.me/blog/x-up-devcap-post-charset-header-in-aspnet-to-bypass-wafs-again2026-09-12T21:01:22.000Z https://soroush.me/blog/exploiting-deserialisation-in-asp-net-via-viewstate2026-09-12T21:01:22.000Z https://soroush.me/blog/yet-other-examples-of-abusing-csrf-in-logout2026-09-11T10:57:01.000Z https://soroush.me/blog/how-to-win-big-and-even-more2026-09-11T10:57:01.000Z https://soroush.me/blog/finding-and-exploiting-net-remoting-over-http-using-deserialisation2019-03-26T10:01:33.000Z https://soroush.me/blog/more-research-on-net-deserialization2018-12-19T22:29:31.000Z https://soroush.me/blog/feel-honoured-to-be-there-again-after-8-years-top-10-web-hacking-techniques-of-20172018-12-19T19:58:50.000Z https://soroush.me/blog/story-of-two-published-rces-in-sharepoint-workflows2026-09-11T10:57:01.000Z https://soroush.me/blog/asp-net-resource-files-resx-and-deserialization-issues2026-09-10T17:21:23.000Z https://soroush.me/blog/ms-2018-q4-top-5-bounty-hunter-for-2-rces-in-sharepoint-online2018-08-12T20:41:35.000Z https://soroush.me/blog/waf-bypass-techniques-using-http-standard-and-web-servers-behaviour2026-09-11T10:57:01.000Z https://soroush.me/blog/smb-hash-hijacking-user-tracking-in-ms-outlook2026-09-10T17:21:23.000Z https://soroush.me/blog/bug-bounty-vs-penetration-testing-simple-unbiased-comparison2018-02-20T21:18:24.000Z https://soroush.me/blog/rare-asp-net-request-validation-bypass-using-request-encoding2018-02-20T10:19:54.000Z https://soroush.me/blog/additional-notes-on-a-forgotten-http-invisibility-cloak-talk2026-09-11T10:57:01.000Z https://soroush.me/blog/request-encoding-to-bypass-web-application-firewalls2026-09-11T10:57:01.000Z https://soroush.me/blog/when-a-web-application-ssrf-causes-the-cloud-to-rain-credentials-more2026-09-10T17:21:23.000Z https://soroush.me/blog/cve-2017-8592-xmlhttprequest-in-ie-followed-307-redirections-with-additional-or-customised-headers2017-08-24T08:29:56.000Z https://soroush.me/blog/flash-it-baby2026-09-10T17:21:23.000Z https://soroush.me/blog/common-security-issues-in-financially-oriented-web-applications2026-09-10T17:21:23.000Z https://soroush.me/blog/interesting-xml-processing-in-copypaste-in-word-and-outlook2015-03-31T20:14:42.000Z https://soroush.me/blog/non-root-relative-path-overwrite-rpo-in-iis-and-net-applications2026-09-10T17:21:23.000Z https://soroush.me/blog/analysis-of-setting-cookies-for-third-party-websites-in-different-browsers2026-09-10T17:21:23.000Z https://soroush.me/blog/iis-short-file-name-disclosure-is-back-is-your-server-vulnerable2026-09-10T17:21:23.000Z https://soroush.me/blog/upload-a-web-config-file-for-fun-profit2026-09-10T17:21:23.000Z https://soroush.me/blog/file-upload-and-php-on-iis-wildcards2026-09-10T17:21:23.000Z https://soroush.me/blog/even-uploading-a-jpg-file-can-lead-to-cross-domain-data-hijacking-client-side-attack2026-09-11T10:57:01.000Z https://soroush.me/blog/how-did-i-bypass-everything-in-modsecurity-evasion-challenge2014-04-13T20:48:46.000Z https://soroush.me/blog/catch-up-on-flash-xss-exploitation-part-3-xss-by-embedding-a-flash-file2026-09-10T17:21:23.000Z https://soroush.me/blog/yahoo-bug-bounty-program-lfi-reported-and-patched2026-09-11T10:57:01.000Z https://soroush.me/blog/catch-up-on-flash-xss-exploitation-part-2-navigatetourl-and-jar-protocol2026-09-10T17:21:23.000Z https://soroush.me/blog/catch-up-on-flash-xss-exploitation-bypassing-the-guardians-part-12026-09-10T17:21:23.000Z https://soroush.me/blog/simple-security-tip-window-location-window-location-pathname-can-cause-open-redirect-issue2013-09-27T21:15:04.000Z https://soroush.me/blog/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages2013-04-25T22:22:33.000Z https://soroush.me/blog/iefirefox-redirection-issue-fb-oauth2-bypass-bugcrowd2013-03-18T21:23:17.000Z https://soroush.me/blog/file-in-the-hole2026-09-10T17:21:23.000Z https://soroush.me/blog/xss-by-uploadingincluding-a-swf-file2026-09-11T10:57:01.000Z https://soroush.me/blog/dont-trust-a-string-based-on-tryparse-or-isnumeric-result-netvbscript2012-10-17T23:42:39.000Z https://soroush.me/blog/ie9-self-xss-blackbox-protection-bypass2026-09-11T10:57:01.000Z https://soroush.me/blog/microsoft-iis-tilde-character-vulnerabilityfeature-short-filefolder-name-disclosure2026-09-10T17:21:23.000Z https://soroush.me/blog/browsers-anti-xss-methods-in-asp-classic-have-been-defeated2026-09-10T17:21:23.000Z https://soroush.me/blog/aspxerrorpath-in-url-technique-in-scanning-a-net-web-application2012-06-11T23:29:38.000Z https://soroush.me/blog/challenge-series-1-result-and-conclusion2026-09-11T10:57:01.000Z https://soroush.me/blog/secproject-web-appsec-challenge-series-12026-09-10T17:21:23.000Z https://soroush.me/blog/sometimes-no-ninja-skill-is-required-to-receive-money-from-security-bug-bounty-programs2012-04-09T23:33:34.000Z https://soroush.me/blog/drag-and-drop-xss-in-firefox-by-html5-cross-domain-in-frames2011-12-31T03:23:24.000Z https://soroush.me/blog/flash-externalinterface-call-javascript-injection-e2-80-93-can-make-the-websites-vulnerable-to-xss2011-03-08T22:11:10.000Z https://soroush.me/blog/unrestricted-file-download-v1-02026-09-11T10:57:01.000Z https://soroush.me/blog/facebook-redirect-link-new-bypass-method-e2-80-93-e2-80-9c-e2-80-9d-after-the-domain-name2026-09-11T10:57:01.000Z https://soroush.me/blog/jsreg-bypasses-old2010-12-18T23:11:48.000Z https://soroush.me/blog/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files2010-12-17T23:36:54.000Z https://soroush.me/blog/skype-privacy-concern-it-sends-detected-numbers-urls-to-its-server2026-09-11T10:57:01.000Z https://soroush.me/blog/download-excel-advanced-search2026-09-10T17:21:23.000Z https://soroush.me/blog/noscript-new-bypass-method-by-unicode-in-asp2010-08-08T23:30:49.000Z https://soroush.me/blog/new-update-july-20102010-08-08T22:10:12.000Z https://soroush.me/blog/iis5-1-directory-authentication-bypass-by-using-i30index-allocation2026-09-10T17:21:23.000Z https://soroush.me/blog/opera-browser-scroll-information-leakage2010-06-30T00:10:35.000Z https://soroush.me/blog/cross-site-url-hijacking-by-using-error-object-in-mozilla-firefox2026-09-10T17:21:23.000Z https://soroush.me/blog/new-method-role-of-the-character-in-mapping-the-website-directories2026-09-11T10:57:01.000Z https://soroush.me/blog/improve-file-uploaders-protections-rev-1-02010-03-04T23:59:35.000Z https://soroush.me/blog/ie7-8-drive-list-enumeration2010-03-04T23:48:53.000Z https://soroush.me/blog/microsoft-iis-semi-colon-vulnerability2026-09-10T17:21:23.000Z https://soroush.me/blog/finding-vulnerabilities-of-yaftp-1-0-14-a-client-side-ftp-application2026-09-10T17:21:23.000Z https://soroush.me/blog/why-using-include-techniques-are-dangerous-for-novice-developers2009-01-05T06:29:12.000Z https://soroush.me/blog/incorrect-solution-to-disable-script-execution-by-htaccess2009-01-02T05:17:08.000Z