Skip to main content
CPEBuddy
Puny-Code, 0-Click Account Takeover | @YShahinzadeh & @AmirMSafari | #NahamCon2025

Puny-Code, 0-Click Account Takeover | @YShahinzadeh & @AmirMSafari | #NahamCon2025

Source: YouTube · NahamSec · published Jun 9, 2025 · 16:32

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

BLUF: Security researchers Yasha Shangada and Amir demonstrate how identifying parsing inconsistencies between mail servers and databases can lead to profitable zero-day discoveries and bug bounty earnings.

Key Takeaways:
• The speakers, Yasha Shangada and Amir, collaborate on security research, automation tools, and CTF challenges, often turning focused topic exploration into practical hunting methodologies 0:06.
• Their process involves selecting a specific technical topic to investigate deeply, which may result in a zero-day vulnerability or a reusable checklist for daily bug hunting 0:23.
• A significant case study involved discovering an inconsistency between mail servers and databases regarding character parsing, which they quickly validated with a test bed 0:36.
• By applying this parsing disagreement to real-world targets, they successfully exploited the vulnerability, earning approximately $50k despite the issue having been previously discovered 0:51.

This approach highlights the value of systematic technical exploration and rapid validation in turning theoretical findings into tangible financial rewards.

Sources:

  • 0:06 Introduction of speakers and their collaborative workflow
  • 0:23 Methodology of focusing on specific security topics
  • 0:36 Discovery of mail server/database parsing inconsistencies
  • 0:51 Exploitation of the finding and resulting $50k bounty

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Hi everyone, I hope you're doing well. Let's get started with their presentation. I'm Yasha Shangada, a security researcher and bug hunter. Amir, my teammate used to be my menty. Now we work together to explore cool new ideas, build automation tools, design CTF challenges and just have a fun digging into all kind of security stuff. We usually pick a topic to focus on it, spending time on it. it might turn into a zero day or just a simple checklist. Then we apply those findings to our daily hunting. Last year we found an interesting inconsistency between mail servers and databases. There was a parsing disagreement on some characters. Uh we immediately set up a test bed to see what's going on here and it ended up discovering a neat attack. Uh actually it been discovered before us. We just pu…