Happy Diwali to the Brut Security Community!
Wishing everyone a joyful and prosperous Diwali! May this festival of lights bring happiness, success, and new learning opportunities to all.
Whether you’re celebrating or just enjoying the festive spirit, let's continue to shine brightly together as a global community. Here’s to knowledge, growth, and unity!
Stay safe, stay inspired, and Happy Diwali! 🪔
Wishing everyone a joyful and prosperous Diwali! May this festival of lights bring happiness, success, and new learning opportunities to all.
Whether you’re celebrating or just enjoying the festive spirit, let's continue to shine brightly together as a global community. Here’s to knowledge, growth, and unity!
Stay safe, stay inspired, and Happy Diwali! 🪔
1❤15👍2
CVE-2024-50550: Privilege Escalation in LiteSpeed Cache WP Plugin, 8.1 rating 🔥
Weak security hash verification vulnerability allows an attacker to gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/A60iV
👉 Dork: http.body:"plugins/litespeed-cache"
Read more: https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
Weak security hash verification vulnerability allows an attacker to gain administrative privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/A60iV
👉 Dork: http.body:"plugins/litespeed-cache"
Read more: https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
👍3
CVE-2024-49768: Race Condition in Waitress Python server, 9.1 rating 🔥
Due to an error, the server can process a request even if the connection should have been closed.
Search at Netlas.io:
👉 Link: https://nt.ls/VYS9t
👉 Dork: http.headers.server:"waitress"
Vendor's advisory: https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
Due to an error, the server can process a request even if the connection should have been closed.
Search at Netlas.io:
👉 Link: https://nt.ls/VYS9t
👉 Dork: http.headers.server:"waitress"
Vendor's advisory: https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
👍2🗿2
Setup and host your own blind XSS and SSRF testing tool for free https://github.com/Rahim7X/Argus.git
2🔥9👍2
🗡️ List of Websites Giving Free RDP/VPS 🖥️
🔹 sadd.io 🌐
🔸 vpswala.org 🚀
🔹 ihor.ru 💻
🔸 gratisvps.net 🌍
🔹 ionos.com ⚙️
🔸 vultr.com ☁️
🔹 skysilk.com 🌈
🔸 yellowcircle.net 🔆
🔹 apponfly.com/en 📲
🔸 cloudsigma.com 🔒
🔹 ezywatch.com/freevps 🕹️
🔸 digitalocean.com 🐳
🔹 ctl.io/free-trial 🔗
🔸 developer.rackspace.com 🛠️
🔹 my.letscloud.io/sign-up ✨
🔸 ohosti.com/vpshosting.php 🔋
🔹 neuprime.com/l_vds3.php 🖥️
🔔 Note: Some websites may require 💳 credit card verification for trial access.
🔹 sadd.io 🌐
🔸 vpswala.org 🚀
🔹 ihor.ru 💻
🔸 gratisvps.net 🌍
🔹 ionos.com ⚙️
🔸 vultr.com ☁️
🔹 skysilk.com 🌈
🔸 yellowcircle.net 🔆
🔹 apponfly.com/en 📲
🔸 cloudsigma.com 🔒
🔹 ezywatch.com/freevps 🕹️
🔸 digitalocean.com 🐳
🔹 ctl.io/free-trial 🔗
🔸 developer.rackspace.com 🛠️
🔹 my.letscloud.io/sign-up ✨
🔸 ohosti.com/vpshosting.php 🔋
🔹 neuprime.com/l_vds3.php 🖥️
🔔 Note: Some websites may require 💳 credit card verification for trial access.
👍13
Find sensitive files using Wayback
#bugbountytip #bugbounty #bugbountytips
waybackurls 123.com | grep - -color -E "1.xls | \\.tar.gz | \\.bak | \\.xml | \\.xlsx | \\.json | \\.rar | \\.pdf | \\.sql | \\.doc | \\.docx | \\.pptx | \\.txt | \\.zip | \\.tgz | \\.7z"
#bugbountytip #bugbounty #bugbountytips
1👍13❤4🔥3
a XSS payload with Alert Obfuscation, for bypass Regex filter
#infosec #cybersec #bugbountytip
<img src="X" onerror=top[8680439..toString(30)](1337)>
<script>top[8680439..toString(30)](1337)</script>
#infosec #cybersec #bugbountytip
❤11👍6
AZURE_OPENAI_API_KEY /[a-f0-9]{32}$//ATATT3[a-zA-Z0-9_\-+=]{184,195}$/#CyberSecurity #BugBounty #infosec #BugBountyTools #pentest #bugbountytips
Please open Telegram to view this post
VIEW IN TELEGRAM
👍4❤1
Check for Subdomain Takeover Vulnerabilities
This enumerates subdomains and checks if they resolve. Subdomains that return NXDOMAIN may be vulnerable to takeover if they point to external services.
Replace nasa.gov with your target.
This enumerates subdomains and checks if they resolve. Subdomains that return NXDOMAIN may be vulnerable to takeover if they point to external services.
subfinder -d target.com -silent | while read sub; do host $sub; done | grep "NXDOMAIN"
Replace nasa.gov with your target.
👍12🗿6
Hey everyone!
- Access challenging, real-world environments to hone your skills.- Tackle new labs like Odyssey and Ascension as they roll out.
- Join a community of dedicated hackers pushing their skills to new heights.
Let’s hack and learn together!
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3❤2🔥1
1.Use Katana to scan for document URLs:
katana -u subdomainsList -em pdf,docx | tee endpointsPDF_DOC
2. Filter for potentially unredacted files:
grep -i 'redacted.*\.pdf$' endpointsPDF_DOC | sed -E 's/[-_]?redacted//gi' | sort -u | httpx -mc 200 -sc
This script finds document URLs with "redacted" in the name, strips it out, and checks if the unredacted version is accessible.
Admins often leave these unredacted files online by mistake, making them a high-medium (P3) severity finding for bug bounty programs.
Please open Telegram to view this post
VIEW IN TELEGRAM
1❤14👍5
🚨CVE-2024-51482: A 10/10 Severity Vulnerability Exposes ZoneMinder’s SQL Databases
👇Dorks
HUNTER:/product.name="ZoneMinder"
SHODAN: http.favicon.hash:-1218152116
FOFA: app="ZoneMinder"
📰Refer: https://securityonline.info/zoneminders-cve-2024-51482-a-10-10-severity-vulnerability-exposes-sql-databases/
#ZoneMinder #SQL #hunterhow #infosec #infosecurity #OSINT #Vulnerability
👇Dorks
HUNTER:/product.name="ZoneMinder"
SHODAN: http.favicon.hash:-1218152116
FOFA: app="ZoneMinder"
📰Refer: https://securityonline.info/zoneminders-cve-2024-51482-a-10-10-severity-vulnerability-exposes-sql-databases/
#ZoneMinder #SQL #hunterhow #infosec #infosecurity #OSINT #Vulnerability
2👍7❤2
If you’re new to malware development, this playlist is a solid introduction! It covers:
• Native API
• A quick refresher on processes, threads, and handles
• Syscalls
Check it out here: YouTube Playlist
• Native API
• A quick refresher on processes, threads, and handles
• Syscalls
Check it out here: YouTube Playlist
🔥9