https://ikhaleelkhan.medium.com/targeting-hidden-api-endpoints-in-idor-exploits-269b6ae0f16e

#IDOR #Pentest

Elastic Stack

#HTB #BlueTeam

https://www.infostealers.com/article/massive-moveit-vulnerability-breach-hacker-leaks-employee-data-from-amazon-mcdonalds-hsbc-hp-and-potentially-1000-other-companies/?s=35

#News #Leak

Сканер для проверки сайта Bitrix на наличие уязвимостей - Bitrix Scanner.

Этот скрипт сканирует распространенные уязвимости в Bitrix:

- открытые страницы входа в систему;
- открытые страницы регистрации;
- страницы, содержащие ошибки;
- панели администратора;
- content spoofing;
- open redirect;
- отраженный XSS;
- сохраненный XSS с помощью загрузки файла (работает только с Apache);
- SSRF.

https://github.com/k1rurk/check_bitrix

#tools #BitrixScanner #check #vulnerabilities

🔖php-jpeg-injector - Injects php payloads into jpeg images. Related to this repo: 📱 GitHub

This script injects PHP code into a specified jpeg image. The web application will execute the payload if it interprets the image. Make sure your input jpeg is uncompressed!

❓Use Case⤵️
You have a web application that runs a jpeg image through PHP's GD graphics library.

👀 Discover additional commands and options on GitHub page 👇

📱Github: Link
#BugBounty #BugBountyTools #pentest

FFIEC IT Examination Handbook

AQShdagi banklar uchun, axborot texnologiyalari xavfsizligi auditini o‘tkazish bo‘yicha qo‘llanma.

#Audit #BlueTeam

#OSINT #Guide

Analyzing logs with Suricata

#HTB #BlueTeam #Suricata

#XSS #BugBounty

#OSINT #CT

afrog - A Security Tool for Bug Bounty, Pentest and Red Teaming.

afrog is a high-performance vulnerability scanner that is fast and stable. It supports user-defined PoC and comes with several built-in types, such as CVE, CNVD, default passwords, information disclosure, fingerprint identification, unauthorized access, arbitrary file reading, and command execution. With afrog, network security professionals can quickly validate and remediate vulnerabilities, which helps to enhance their security defense capabilities.

Installation

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Github: Link

#BugBounty #Tools

https://owasp.org/www-chapter-pune/meetups/2023/Jan/File-upload-Vulnerability-Praveen-Sutar.pptx.pdf

#Pentesing #BugBounty #FileUpload

Burp + Elastic Logging (RU only lang)

https://blog.hackinone.click/burp_and_elk

OSINT Tools Uzbekistan

- Open Data portals
- Legal Entities
- Cadastral Maps
- Vehicles
- Phones
- Public procurements

https://github.com/paulpogoda/OSINT-Tools-Uzbekistan

Contributor https://t.iss.one/pavelbannikov

#osint #geoint

urldna.io – A Free OSINT Tool for URL Analysis

urldna.io offers detailed information about any URL, including:

Screenshots
SSL certificates
IP addresses
Title/body text
Cookies
Technologies
HTTP requests
Headers
Console messages
Meta tags

#OSINT

https://github.com/streaak/keyhacks?tab=readme-ov-file

#Pentest #API_KEY

https://github.com/arainho/awesome-api-security

#Pentest #API_KEY