Best Amin Malekpour Podcasts (2025)

1
Ep. 12 – Timing Attacks & Mobile OAuth Hijack: When Microseconds and Misflows Betray You 14:09

Play Pause

27d ago14:09

14:09

A few microseconds. One silent browser session. That’s all it took for attackers to break into systems without tripping a single alert. In this episode of Hacked & Secured: Pentest Exploits & Mitigations, we explore two subtle but devastating flaws: 🔹 Timing Attacks for Token Leaks – By measuring microsecond delays, attackers were able to recover s…

1
Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong 17:15

2M ago17:15

17:15

One flawed password reset. One shared session token. One dangerous object. In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world vulnerabilities where trust between systems and users broke down—with serious consequences. Account Takeover via Forgot Password – A predictable ID and exposed tokens let attack…

1
Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control 20:12

3M ago20:12

20:12

One cookie set on a subdomain triggered XSS and stole session tokens. One fake image upload gave the attacker a reverse shell. This episode breaks down two powerful exploits—a cookie-based XSS that bypassed frontend protections, and an RCE through Ghostscript triggered by a disguised PostScript file. Learn how subtle misconfigurations turned everyd…

1
Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash 25:05

4M ago25:05

25:05

One markdown link copied server files. One poisoned log triggered remote code execution. One LFI crashed the entire server. In this episode, we unpack three real-world exploits—directory traversal and local file inclusion flaws that went far beyond file reads. From silent data leaks to full server compromise, these attacks all started with a single…

1
Ep. 8 – OTP Flaw & Remote Code Execution: When Small Flaws Go Critical 15:45

5M ago15:45

15:45

A broken logout flow let attackers hijack accounts using just a user ID. A self-XSS and an IDOR exposed stored data. And a forgotten internal tool—running outdated software—ended in full Remote Code Execution. This episode is all about how small bugs, missed checks, and overlooked services can lead to serious consequences. Chapters: 00:00 - INTRO 0…

1
Ep. 7 – IDOR & SSTI: From File Theft to Server-Side Secrets 19:35

6M ago19:35

19:35

A predictable ID exposed private documents. A crafted name leaked backend files. In this episode, we break down two high-impact flaws—an IDOR that let attackers clone confidential attachments, and an SSTI hidden in an email template that revealed server-side files. Simple inputs, big consequences. Learn how they worked, why they were missed, and ho…

1
Ep. 6 – 403 Bypass & Request Smuggling: Tiny Tricks, Total Takeover 17:14

6M ago17:14

17:14

A single uppercase letter unlocked an admin panel. One malformed request hijacked user sessions. In this episode, we break down two real-world exploits—a 403 bypass and a request smuggling attack—that turned small oversights into full system compromise. Learn how they worked, why they were missed, and what should have been done differently. Chapter…

1
Ep. 5 – Stored XSS & SQL Injection: Small Flaws, Big Breaches 16:08

7M ago16:08

16:08

A simple filename triggered stored XSS, hijacking accounts and stealing API keys. A SQL injection bypassed a web firewall, dumping an entire database in one request. Both attacks exploited basic security flaws—flaws that should have been caught. Learn how these exploits worked, why they were missed, and what should have been done differently. Chapt…

1
Ep. 4 – Exposed Secrets & Silent Takeovers: How Misconfigurations Open the Door to Attackers 21:15

7M ago21:15

21:15

Exposed secrets, overlooked permissions, and credentials hiding in plain sight—each one leading to a critical breach. In this episode, we break down three real-world pentest findings where a forgotten file, a misconfigured setting, and a leaked credential gave attackers full control. How did they happen? How can you find similar issues? And what ca…

1
Ep. 3 – One Request, One URL, One Bluetooth Hack: Three Takeovers That Shouldn’t Have Happened 21:30

7M ago21:30

21:30

How can attackers take over accounts, networks, and devices—without credentials? In this episode, we break down three real-world security flaws that prove authentication alone isn’t enough: Account Takeover – A single request bypassed email verification, locking out store owners. Internal Network Compromise – A hidden admin URL and hardcoded access…

1
Ep. 2 – Chaining IDORs, CSRF Account Takeovers & Token Manipulation for Privilege Escalation 19:16

8M ago19:16

19:16

What if you could take over an account—not by cracking a password, but by chaining two overlooked vulnerabilities? What if a single CSRF exploit let attackers reset security questions and hijack accounts? And what if manipulating an authorization token could escalate privileges? In this episode of Hacked & Secured: Pentest Exploits & Mitigations, w…

1
Ep. 1 – Breaking OTP Security, Exploiting Static Domains & Privilege Escalation via Role Misconfigurations 19:12

8M ago19:12

19:12

What if your OTP security wasn’t secure at all? What if a static domain—something most people ignore—could lead to full account takeover? And what if flawed role management allowed admins to escalate privileges? In this episode of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world security failures that turned minor ov…

1
Intro to Hacked & Secured: Pentest Exploits & Mitigations – What to Expect! 2:28

8M ago2:28

2:28

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer. Welcome to Hacked & Secured: Pentest Exploits & Mitigations—the podcast that breaks down real-world pentest findings and exposes critical security flaws before attackers do. Red team tactics – How vulnerabil…