About Us

I am Osama Mahmood ! A Security Reasearcher !
Information Security enthusiast and Penetration Tester having knowledge of the following fields:
Started to learn web application security at the age of 14.

Within 2 months I was able to report in over 30 organizations. I got acknowledged for reporting software and web application security vulnerabilities.

- Web Application Penetration Testing
- Network Security

Here is the Exploit i found in a WordPress Theme:-
-http://packetstormsecurity.com/files/131657/WordPress-Exquisite-Ultimate-Newspaper-1.3.3-Cross-Site-Scripting.html

Bugcrowd Profile : https://www.bugcrowd.com/Osama_Mahmood
HackerOne : https://www.hackerone.com/osama_mahmood

I haven't done any certifications or any courses related to information security yet. Most of my achievements were through self studying, practice and hard work.

Honors & Awards

Acknowledged in Microsoft Hall of Fame of Security Researchers

Microsoft

October 2014

Microsoft mentioned me in their hall of fame of security researchers for reporting security vulnerability in Microsoft website.

Checkout:
https://technet.microsoft.com/en-us/security/cc308575

Acknowledged By Facebook :) 2015

Facebook

April 2015

Reported Authorization bug in one of facebook acquired Oculus

One of the biggest dreams became true.. ♥
Thank you
Facebook ♥
And my all well wishers ♥♥♥
http://facebook.com/whitehat/thanks/

Acknowledged in Apple Hall of Fame of Security Researchers

Apple

November 2014

Apple mentioned me in there hall of fame of security researchers for reporting vulnerability in Apple.

Checkout:
http://support.apple.com/en-au/HT201536

$150 From Heroku

Heruku

Got $150 from Heroku for fining vulnerability in there website .

Checkout:
https://bugcrowd.com/heroku/hall-of-fame

$50 Form Dropcam

Dropcam

2014

Got $50 from dropcam for reporting vulnerability in there web application .

Checkout:
http://bugcrowd.com/dropcam/hall-of-fame

$50 From Opendrive

Opendrive

2014

Got $50 from OpenDrive for reporting Cross Site Scripting Vulnerability .

$100 ,T-shirt & Hall Of Fame From Olark

Olark

2014

Got $100 ,T-shirt & Hall Of Fame From Olark for reporting vulnerability in the API and chat site.

Checkout:
https://www.olark.com/help/security

Acknowledged By Python.org

Python.org

May 2015

Reported Stored XSS in there site. And Got HOF

https://www.python.org/humans.txt

Acknowledged By Rapid 7 & Metasploit :)

Rapid 7 & Metasploit

Got acknowledged by Rapid 7 & Metasploit :) and as a reward they send me some really cool swag :)

https://www.facebook.com/th3.m4rkm3n.007/posts/731568063626681

Acknowledged By Dropbox

Dropbox

February 2015

Reported vulnerability in Hackpad acquired by Dropbox and got acknowledged by Dropbox got 1TB Pro Account for life time and a T-shirt :)

https://hackerone.com/dropbox/thanks
http://osamamahmood.blogspot.com/2015/02/cross-site-in-hackpad-acquired-by.html

Acknowledge By CyberGhost

CyberGhost

Got 3 month Premium key for reporting a information discloser Vulnerability .

Acknowledged By Automattic

Automattic

Acknowledged by Automattic for reporting bug in wordpress

https://hackerone.com/automattic/thanks

Acknowledged By Secret.ly

Secret.ly

Reported information disclouser vulnerability in secret.ly and received T-shirt and stuffed Toy.

https://hackerone.com/secret/thanks

Acknowledged By Symantec

Symantec

For reporting Open Redirect

osamamahmood.blogspot.com/2015/05/symantec-vulnerable-to-open-redirect.html

Acknowledged By ReddAPI

ReddAPI

For reporting Login Brute Force Attack

https://hackerone.com/reddapi/thanks

Acknowledged By Bitcasa

Bitcasa

For reporting Vulnerability :)

https://support.bitcasa.com/hc/en-us/articles/202210658-How-To-Responsibly-Report-Security-Concerns

Acknowledged By Buffer

Buffer

For reporting

https://bufferapp.com/security

Acknowledged By Campaign Monitor

Campaign Monitor

For reporting Broken Authentication – Session Token bug

https://help.campaignmonitor.com/contact

Acknowledged By CodePen

CodePen

For reporting Mis-Configuration Bug

https://bugcrowd.com/codepen/hall-of-fame

Acknowledged By Parallels

Parallels

Got 2 year premium access to Parallels access for reporting Password reset Issue

Acknowledged by Freelancer

Freelancer

Reported information leakage and got a White Hat Badge and a Freelancer T-shirt

https://twitter.com/OsamaMahmood007/status/569378085511901184

https://www.facebook.com/photo.php?fbid=720789591371195&set=pb.100003204810332.-2207520000.1427616576.&type=3&theater

Acknowledged By DuckDuckGo

DuckDuckGo

Reported Authentication Issues in Duck.co and got T-shirt

https://twitter.com/OsamaMahmood007/status/537795686754828288

Acknowledged by Docker

Docker

March 2015

Reported Multiple Vulnerabilities in hub.docker.com

https://www.facebook.com/th3.m4rkm3n.007/posts/737131563070331?notif_t=like

Acknowledged By MailChimp

MailChimp

Reported vulnerabilities :)

http://mailchimp.com/about/security-response/

Acknowledged By MailGun

MailGun

Reported Authentication Bugs and got T-shirt as a reward..

https://twitter.com/OsamaMahmood007/status/524950700380274688

Acknowledged By PagerDuty

PagerDuty

Reported Multiple Bug in There website.

https://www.facebook.com/photo.php?fbid=666805640102924&set=pb.100003204810332.-2207520000.1427616585.&type=3&theater

Acknowledged By Keen.io

Keen.io

Reported Dir Listing and got T-shirt :)

Acknowledged By DreamHost

DreamHost

Reported security issue in Dreamhost.com and received T-shirts

https://www.facebook.com/photo.php?fbid=671226382994183&set=pb.100003204810332.-2207520000.1427616583.&type=3&theater

Acknowledged By Sony

Sony

Reported Vulnerabilities in sony.com and playstation.com

https://secure.sony.net/hallofthanks

https://www.facebook.com/photo.php?fbid=666385296811625&set=pb.100003204810332.-2207520000.1427616585.&type=3&theater

Acknowledged By Paymill

Paymill

Reported Vulnerabilities in Paymill and got HOF and t-shirt

https://developers.paymill.com/en/security/security-standards/

https://twitter.com/osamamahmood007/status/514811198412308480

Acknowledged By SchubergPhills

SchubergPhills

Got Acknowledged

https://twitter.com/osamamahmood007/status/529957864270348288
https://twitter.com/osamamahmood007/status/522436635124723712
https://www.schubergphilis.com/2014/12/15/responsible-disclosure-hall-of-fame-1/

Acknowledged By Ministry Of Interior And Kingdom Relations

Ministry Of Interior And Kingdom Relations

Reported Security vulnerabilities in there website.and got Acknowledgment Letter and t-shirt

https://twitter.com/OsamaMahmood007/status/559700381643456515

Acknowledged By Coursera

Coursera

April 2015

Reported Open Redirect and got a 100% discount on any Signature Track course!.

https://www.facebook.com/photo.php?fbid=740079062775581&set=a.190423754407784.40514.100003204810332&type=1&theater

Acknowledged by KPN

KPN

April 2015

Reported some security vulnerabilities in KPN domain and got acknowledge by KPN and got a acknowledgment Letter and T-shirt .

https://www.facebook.com/photo.php?fbid=740766792706808&set=a.190423754407784.40514.100003204810332&type=1&theater&notif_t=like

Acknowledged By Elance-oDesk

Elance-oDesk

December 2014

Reported some Session related vulnerabilities and got $100 and HOF

https://bugcrowd.com/odesk/hall-of-fame

Acknowledged by GoAnimate

GoAnimate

April 2014

Reported HTML Injection and got HOF

http://goanimate.com/video-maker-tips/security/

Acknowledged by GetPocket

GetPocket

February 2014

Reported and got HOF

http://help.getpocket.com/customer/portal/articles/1225832-pocket-security-overview

Acknowledged By SkyTV

SkyTV

June 2014

Reported security vulnerabilities XSS

https://skytv.custhelp.com/app/answers/detail/a_id/1797/~/responsible-disclosure-guidelines#e

Acknowledged By Smart Budget

Smart Budget

Reported XSS And got HOF

https://www.sbudget.com/people.pl

Acknowledge by SplashID

SplashID

Reported Multiple web vulnerabilities

https://bugcrowd.com/splashid/hall-of-fame

Acknowledged By Twilio

Twilio

Reported vulnerability

https://bugcrowd.com/twilio/hall-of-fame

Acknowledged By Founder Bliss

Founder Bliss

April 2015

reported Authentication Bug

https://www.crowdcurity.com/founder-bliss/hall-of-fame/all

Acknowledged By PonyMC

PonyMC

Reported Multiple Bugs

https://www.crowdcurity.com/ponymc/hall-of-fame/all

Acknowledged By LocalBitcoins

LocalBitcoins

reported some mis configuration bug and got $50

https://www.crowdcurity.com/localbitcoins/hall-of-fame/all

Acknowledged By Crowdcurity

Crowdcurity

February 2015

Reported Weak Password Policy . and got 0.02 BTC

https://www.crowdcurity.com/crowdcurity/hall-of-fame/all

Acknowledged By ShaderToy

ShaderToy

November 2014

Reported Reflected XSS and Stored XSS and got listed in there about page

https://www.shadertoy.com/about

May 2015

Reported Password reset le=ink issue and received T-shirt

Skills

Education

Fazaia Inter College E-9 Islamabad

FSC, Pre-Engineering

2015 – 2017

FSC Part-1 Pre-Engineering

Fazaiia Inter College Korangi Creek Karachi

High School, Metric, Computer Science, A

2012 – 2014

Doing FSC in Pre-Engineering

Activities and Societies: Computer Science Projects

Volunteer Experience & Causes

Security Researcher

Charity Program On Bugcrowd

2014Science and Technology

There was a program on Bugcrowd which was purely for charity purpose and i reported vulnerabilities in there site and a " Charity Hero " award on Bugcrowd .

https://bugcrowd.com/Osama_Mahmood