Had a really fun time hacking @amazon in Goa 🌴
Teamed up with @H4cktus, @Jayesh25 and @itz_mg_ and we ended up 1st on the leaderboard 😅
Picked up a bunch of bonuses too:
🏆 Pwnership: Eventwide Most Impactful Report
🧠 Dive Deep: Most Creative Bug
💥 Most Impactful Issue on a
Found a 1-click account takeover via postMessage. No phishing, no fake login page, just one click and a full-access token.
Wrote up the full breakdown and also gave the whole site a little revamp while I was at it.
naaaash.github.io/posts/oauth-re…
Linus Tech Tips praised YouTube for adding parental controls that let families block YouTube Shorts
"I don't mind my kids using YouTube at all. I do mind a lot them doom scrolling shorts ... they'll rot your brain"
