A cybersecurity enthusiast, researcher, and CTF player.
These notes are created from my personal experiences and exploration.
For my web dev portfolio, visit portfolio.aliakber.ca.
A stupidly effective crypto stealer
A fake SimpleSwap 25% Loyalty Bonus exploit that talks you into installing a Tampermonkey userscript, then swaps the Bitcoin deposit address for the attacker’s. Full walk of the delivery chain, the Google Sheets C2, the obfuscation, and the on-chain money trail.
Reverse engineering the Terrabot worm
Full analysis of the Terrabot botnet dropper: multi-arch payloads, CVE-2026-0073 ADB exploitation, web shell attacks, and detection rules.
Account takeover on Childsmath
A CSRF vulnerability on ChildsMath’s profile update endpoint that enabled stored XSS via unsanitized name fields. The injected script persisted across every page in the application, and the same request could change the recovery email to execute a full account takeover.
Bypassing SameSite cookie protections on Chrome
How Chrome’s ‘Lax + 2 minute’ cookie intervention opened a CSRF window on ChildsMath, a math learning platform used by McMaster University students, letting an attacker silently redirect a student’s grades to an attacker-controlled email.
The dangers of No-Code
A no-code BJJ tracker built on Base44 enforced all of its authorization in the browser. Here is the chain of six issues that let anyone with a browser read every user’s data, deface the site, and take over accounts.
Account takeover on ReadWise
A critical CSRF vulnerability in a popular reading platform’s email change endpoint that required nothing more than a single click to fully hijack an account.