Ali Kabeel
Security and Privacy Engineering Lead
Bending Spoons
Ali Kabeel is a Security & Privacy Engineering Lead at Bending Spoons, where he leads security efforts across major products including WeTransfer, Brightcove, and Vimeo.With over a decade of bug hunting experience, Ali has uncovered critical vulnerabilities across some of the world’s leading technology platforms. His work focuses heavily on business logic vulnerabilities: high-impact flaws that emerge from real-world misuse, flawed assumptions, and broken trust boundaries rather than obvious code defects. These are the kinds of issues automated scanners often miss, but attackers can weaponize with serious consequences.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Rewritten Origins and Leaky APIs: The Phishing Techniques That Actually Work
Classic tabnapping has been discussed for 15 years. Browsers have added mitigations. It mostly doesn't work anymore � except when it does. This talk introduces a live variant: cross-site origin rewriting, which lets an attacker substitute a trusted origin in an open tab without triggering standard browser defenses. We'll show exactly how it works, which companies are vulnerable today, and why the usual guidance misses it.The second technique reframes a class of bugs that rarely makes it into severity calculations: small API information leaks. On their own, exposing a last-login timestamp or account creation date seems low-impact. Chained into a phishing campaign, it's the detail that makes a victim believe. We'll use Snapchat's last-login date exposure as a concrete case study � how the leak is found, how it feeds a phishing vector, and what that attack looks like from the victim's perspective.Together, these form a practical, underdefended phishing playbook: control the page via origin rewriting, personalize the lure via leaked metadata.**Outline**Why phishing is still winning � briefly, why technical controls keep failing at the social layerTechnique 1: Cross-Site Origin Rewriting- Tabnapping recap and why classic variants are largely dead- The origin rewriting mechanism: how it works, what the browser sees- Real company examples: who's vulnerable and whyTechnique 2: API Leak Amplification- Information leakage as a phishing primitive, not just a privacy bug- Snapchat case study: finding the last-login leak, building the lure, running the campaign- Generalizing: what other leak classes enable this pattern
- 17:00
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote