SecList for CyberStudents

75 views10:17

⚠️

AuraAudit (AuraInspector): Salesforce Aura muhitidagi noto‘g‘ri sozlamalarni aniqlovchi ochiq manbali xavfsizlik vositasi

✅ Kiberxavfsizlik sohasida yetakchi kompaniyalardan biri bo‘lgan Mandiant Salesforce platformasida xavfsizlikni kuchaytirishga qaratilgan yangi ochiq manbali vositani taqdim etdi. AuraInspector (ko‘pincha AuraAudit deb ham ataladi) — bu buyruqlar satrida ishlovchi (CLI) audit vositasi bo‘lib, Salesforce Aura framework’idagi kirish huquqlarining noto‘g‘ri sozlanishini aniqlash va tahlil qilish uchun mo‘ljallangan.

⚠️ Mazkur vosita, ayniqsa, Salesforce Experience Cloud muhitlarida tez-tez uchraydigan va jiddiy oqibatlarga olib kelishi mumkin bo‘lgan xavfsizlik bo‘shliqlarini aniqlashga yordam beradi.

📱

Batafsil

PS : UZCERTning rasmiy kanaliga a'zo bo'lishni maslahat qilamiz.

#AuraAudit #AuraInspector #Salesforce #Aura #xavfsizlik #vosita

🚀

UZCERT xizmatining rasmiy telegram sahifasiga a’zo bo‘ling!

Please open Telegram to view this post

VIEW IN TELEGRAM

👍1🔥1

72 views11:12

SecList for CyberStudents

https://github.com/UndeadSec/SwaggerSpy

#BugBounty #Pentest #Web

89 views12:59

SecList for CyberStudents

BrowserHistoryCapturer_v1.4.5.zip

3.3 MB

🔎Browser History Capturer
📝Инструмент, позволяющий легко собирать историю веб-браузеров на компьютере с Windows. Инструмент можно запускать с USB-накопителя для сбора истории из браузеров Chrome, Edge, Firefox и Internet Explorer.

#Windows #Forensic #Browser

99 views13:03

SecList for CyberStudents

https://github.com/xaitax/SploitScan?tab=readme-ov-file

#SploitScan #Tool #Search #Public #Exploits

83 viewsedited 09:45

SecList for CyberStudents

Forwarded from Proxy Bar

CVE-2026-22812 OpenCode Unauthenticated RCE
*
OpenCode < 1.0.216
*
exploit

54 views18:24

SecList for CyberStudents

https://0xinfection.xyz/posts/

59 views04:42

SecList for CyberStudents

Sirius is an open-source comprehensive vulnerability scanner that leverages community-driven security intelligence and automated penetration testing capabilities. v0.4.0 introduces comprehensive system monitoring and observability features. Get started in minutes with our Docker-based setup.

Source: https://github.com/SiriusScan/Sirius

55 views06:02

SecList for CyberStudents

A little toolbox to play with Microsoft Kerberos in C

Source: https://github.com/gentilkiwi/kekeo

#RedTeam #Pentest #AD #kekeo

50 viewsedited 09:36

SecList for CyberStudents

https://www.youtube.com/watch?v=uW7COsIKTXM

YouTube

This Simple Vulnerability Was Worth $70,000

Signup for Snyk's CTF 👉🏼 https://snyk.co/ujxq4
LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍

📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and…

51 views05:01

SecList for CyberStudents

https://www.youtube.com/watch?v=uW7COsIKTXM

Gooooood Real Case for bypass 2FA🔥

49 viewsedited 05:01

SecList for CyberStudents

Read PostgreSQL data files without credentials - forensics, data recovery, and security research tool

Source: https://github.com/Chocapikk/pgread

#DFIR #Tool #PostgreSQL

48 views10:00

SecList for CyberStudents

Forwarded from JavaSec

Men Nvidiani buzgan birinchi o’zbekmanmi?

Bulletin

CVE - (not published yet)

30 views10:00

SecList for CyberStudents

JavaSec

Photo

Congratualtion bro I am happy for you 🔥🔥🔥🔥

❤3🔥2

48 views10:01

SecList for CyberStudents

Forwarded from Offensive Xwitter

0:10

This media is not supported in your browser

VIEW IN TELEGRAM

📞 Microsoft fixed an authenticated RCE in Windows Telephony Service (CVE-2026-20931), discovered by researcher Sergey Bliznyuk.

Read the write-up:

🔗 https://swarm.ptsecurity.com/whos-on-the-line-exploiting-rce-in-windows-telephony-service/
🔗 https://habr.com/ru/companies/pt/articles/984934/

37 views12:30

SecList for CyberStudents

40 views13:08

SecList for CyberStudents

Forwarded from SecuriXy.kz

🚨 Критическая RCE‑уязвимость в Apache bRPC (CVE‑2025‑60021)
Критичность: CVSS 9.8
Тип: RCE
Компонент: встроенный сервис heap‑профайлера (`/pprof/heap`)

В Apache bRPC параметр extra_options в эндпоинте /pprof/heap передается напрямую в командную строку jemalloc‑профайлера без какой‑либо фильтрации.

🎯 Уязвимые версии
Все версии до 1.15.0.

🔥 Эксплуатация


/pprof/heap?extra_options=<cmd>

🔗 PoC:
https://github.com/ninjazan420/CVE-2025-60021-PoC-Apache-bRPC-Heap-Profiler-Command-Injection

🛡 Рекомендации
1. Обновиться до bRPC 1.15.0
2. Либо применить патч из апстрима
3. Закрыть доступ к /pprof/* извне
4. Отключить heap‑профайлер, если он не нужен

🔍 Детекты
Искать обращения к /pprof/heap с параметрами:
`extra_options=
extra_options=% (URL‑encoded)
extra_options= внутри JSON или multipart`

23 views14:46

About

Blog

Apps

Platform