CVE-2024-38819: Path Traversal in Spring Framework, 7.5 rating❗️
Another Path Traversal vulnerability in the Spring framework. This time there is even a PoC!
Search at Netlas.io:
👉 Link: https://nt.ls/AzCtg
👉 Dork: tag.name:"spring"
Vendor's advisory: https://spring.io/security/cve-2024-38819
Another Path Traversal vulnerability in the Spring framework. This time there is even a PoC!
Search at Netlas.io:
👉 Link: https://nt.ls/AzCtg
👉 Dork: tag.name:"spring"
Vendor's advisory: https://spring.io/security/cve-2024-38819
👍6❤3
Please open Telegram to view this post
VIEW IN TELEGRAM
🐳13🗿8👍3🤨2
🔖 IVRE - The Ultimate Network Reconnaissance Framework
✨ Key Features:
IVRE allows you to build your self-hosted, fully controlled alternatives to tools like Shodan, ZoomEye, Censys, and GreyNoise.
- Run your Passive DNS service
- Create tailor-made EASM tools
- Collect and analyze network intelligence using Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, and more!
Perfect for security researchers and network analysts.
🔗 Get the tool here: https://github.com/ivre/ivre
✨ Key Features:
IVRE allows you to build your self-hosted, fully controlled alternatives to tools like Shodan, ZoomEye, Censys, and GreyNoise.
- Run your Passive DNS service
- Create tailor-made EASM tools
- Collect and analyze network intelligence using Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, and more!
Perfect for security researchers and network analysts.
🔗 Get the tool here: https://github.com/ivre/ivre
GitHub
GitHub - ivre/ivre: Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye…
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, co...
👍4
🎄 Wrapping Up an Amazing Year Together! 🎄
Hey Brut Fam! 🚀As 2024 comes to a close, I want to thank each and every one of you for being part of this amazing journey. This year, we’ve shared 1,500+ resources, learned, grown, and built an incredible community of 8,000+ members. Your support and engagement have made Brut Security what it is today. 💪
If you’ve found value in the resources I’ve shared and want to support me in continuing this journey, you can now buy me a coffee ☕ here:
☄️ https://buymeacoffee.com/saumadip
It’s not mandatory—just a small way to show appreciation if you feel like it.
Wishing you all a early very Merry Christmas 🎅 and a Happy New Year 🎉 filled with learning, growth, and success! Here’s to an even bigger and better 2025! 🚀
Stay curious, stay secure. 🔐
Hey Brut Fam! 🚀As 2024 comes to a close, I want to thank each and every one of you for being part of this amazing journey. This year, we’ve shared 1,500+ resources, learned, grown, and built an incredible community of 8,000+ members. Your support and engagement have made Brut Security what it is today. 💪
If you’ve found value in the resources I’ve shared and want to support me in continuing this journey, you can now buy me a coffee ☕ here:
It’s not mandatory—just a small way to show appreciation if you feel like it.
Wishing you all a early very Merry Christmas 🎅 and a Happy New Year 🎉 filled with learning, growth, and success! Here’s to an even bigger and better 2025! 🚀
Stay curious, stay secure. 🔐
Please open Telegram to view this post
VIEW IN TELEGRAM
❤3👍3👨💻2🔥1🐳1
Brut Security pinned «🎄 Wrapping Up an Amazing Year Together! 🎄 Hey Brut Fam! 🚀As 2024 comes to a close, I want to thank each and every one of you for being part of this amazing journey. This year, we’ve shared 1,500+ resources, learned, grown, and built an incredible community…»
CVE-2024-50379, -54677: RCE and DoS in Apache Tomcat, 5.3 - 9.8 rating 🔥
New vulnerabilities allow attackers to upload and execute malicious files disguised as legitimate ones, as well as cause OutOfMemoryError to shut down the server.
Search at Netlas.io:
👉 Link: https://nt.ls/WHRGO
👉 Dork: http.favicon.hash_sha256:64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08 OR http.headers.server:"Apache-Coyote"
Read more: https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
New vulnerabilities allow attackers to upload and execute malicious files disguised as legitimate ones, as well as cause OutOfMemoryError to shut down the server.
Search at Netlas.io:
👉 Link: https://nt.ls/WHRGO
👉 Dork: http.favicon.hash_sha256:64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08 OR http.headers.server:"Apache-Coyote"
Read more: https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
❤2
🔖 AnalyticsRelationships - Discover related domains and subdomains through Google Analytics IDs!
✨ How it works:
- Extract Google Analytics IDs from a webpage.
- Query services like BuiltWith and HackerTarget to find domains and subdomains associated with those IDs.
- A simple yet effective tool for OSINT and reconnaissance!
🔗 Get the tool here: https://github.com/Josue87/AnalyticsRelationships
✨ How it works:
- Extract Google Analytics IDs from a webpage.
- Query services like BuiltWith and HackerTarget to find domains and subdomains associated with those IDs.
- A simple yet effective tool for OSINT and reconnaissance!
🔗 Get the tool here: https://github.com/Josue87/AnalyticsRelationships
👍1🔥1
📖 The Art of Auditing
✨ What it offers:
The first community-driven resource consolidating thousands of hours of expertise from top industry professionals. Ideal for security auditors, researchers, and enthusiasts, this comprehensive guide is a must-read.
🔗 Explore it here: https://web3-sec.gitbook.io/art-of-auditing
✨ What it offers:
The first community-driven resource consolidating thousands of hours of expertise from top industry professionals. Ideal for security auditors, researchers, and enthusiasts, this comprehensive guide is a must-read.
🔗 Explore it here: https://web3-sec.gitbook.io/art-of-auditing
web3-sec.gitbook.io
Preface | Art Of Auditing
❤5
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - 0dayhunter/Facebook-BugBounty-Writeups: Collection of Facebook Bug Bounty Writeups
Collection of Facebook Bug Bounty Writeups. Contribute to 0dayhunter/Facebook-BugBounty-Writeups development by creating an account on GitHub.
❤6👍1
🚨CVE-2024-50379: Apache Tomcat - RCE via write-enabled default servlet.
👇Dorks
HUNTER:/product.name="Apache Tomcat"
FOFA:product="APACHE-Tomcat"
SHODAN:product:"Apache Tomcat"
📰https://lnkd.in/g_nmV2MM
👇Dorks
HUNTER:/product.name="Apache Tomcat"
FOFA:product="APACHE-Tomcat"
SHODAN:product:"Apache Tomcat"
📰https://lnkd.in/g_nmV2MM
❤4
🚨 [CVE-2024-56145] Exploit released! 🚨
Details, PoC, and setup instructions:
🔗 https://github.com/Chocapikk/CVE-2024-56145
Learn more:
📖 https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms
#bugbountytips #BugBounty
Details, PoC, and setup instructions:
🔗 https://github.com/Chocapikk/CVE-2024-56145
Learn more:
📖 https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms
#bugbountytips #BugBounty
👍8
☄️ Exciting News for Aspiring Bug Hunters! ☄️
💥 Enrollments are now open for Brut Ethical Hacking and Basic to Advanced Web Penetration Testing (Bug Bounty) courses, starting January 2025!
Get ready to dive deep into the world of ethical hacking and bug bounty hunting, guided by industry professionals. Whether you are a complete beginner or looking to advance your skills, this course is tailored for you.
Course Highlights:
• Comprehensive training on Business Logic, SQL Injection, and more.
• 40 hours of live, online sessions.
• Practical, hands-on exercises to master real-world vulnerabilities.
• Pathway to becoming a skilled bug hunter and advancing your cybersecurity career.
🗓 Classes Begin: January 2025 (PAID COURSE)
📞 Contact: Whatsapp for details and enrollment.
🌐 Visit: Brut Security
💥 Enrollments are now open for Brut Ethical Hacking and Basic to Advanced Web Penetration Testing (Bug Bounty) courses, starting January 2025!
Get ready to dive deep into the world of ethical hacking and bug bounty hunting, guided by industry professionals. Whether you are a complete beginner or looking to advance your skills, this course is tailored for you.
Course Highlights:
• Comprehensive training on Business Logic, SQL Injection, and more.
• 40 hours of live, online sessions.
• Practical, hands-on exercises to master real-world vulnerabilities.
• Pathway to becoming a skilled bug hunter and advancing your cybersecurity career.
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3
Extract all endpoints from a JS File and take your bug 🐞
✅Method one
✅Method two
#infosec #cybersec #bugbountytips
✅Method one
waybackurls HOSTS | tac | sed "s#\\\/#\/#g" | egrep -o "src['\"]?
15*[=: 1\5*[ '\"]?[^'\"]+.js[^'|"> ]*" | awk -F '/'
'{if(length($2))print "https://"$2}' | sort -fu | xargs -I '%' sh
-c "curl -k -s \"%)" | sed \"s/[;}\)>]/\n/g\" | grep -Po \" (L'1|\"](https?: )?[/1{1,2}[^'||l"> 1{5,3)|(\.
(get|post|ajax|load)\s*\(\5*['||\"](https?:)?[/1{1,2}[^'||\"> ]
{5,})\"" | awk -F "['|"]" '{print $2}' sort -fu
✅Method two
cat JS.txt | grep -aop "(?<=(\"|\'|' ))\/[a-zA-Z0-9?&=\/-#.](?= (\"||'|'))" | sort -u | tee JS.txt
#infosec #cybersec #bugbountytips
1👍32❤11🔥10🤨3🐳2
Don’t forget the reactions and stars!
They fuel my energy to post such contents🔋 ✨ .
They fuel my energy to post such contents
Please open Telegram to view this post
VIEW IN TELEGRAM
👍17
⚡️A list of companies that accept Responsible Disclosure
✅bug-bounties.as93.net
#bugbountytips #bugbounty
✅bug-bounties.as93.net
#bugbountytips #bugbounty
👍7🤨4❤1🔥1👨💻1
Using TLDFinder with the Netlas Module 🔍
Check out our latest article, where we walk you through setting up ProjectDiscovery TLDFinder and using it alongside Netlas data for top-level domains and subdomains searching.
👉 Read now: https://netlas.io/blog/tldfinder_and_netlas/
Check out our latest article, where we walk you through setting up ProjectDiscovery TLDFinder and using it alongside Netlas data for top-level domains and subdomains searching.
👉 Read now: https://netlas.io/blog/tldfinder_and_netlas/
netlas.io
Using TLDFinder with Netlas - Netlas Blog
This article will look at using the TLDFinder tool to find top level domains and subdomains using the Netlas integration.
👍5❤4
⚡️CVE-2024-50379/CVE-2024-56337 : Apache Tomcat Patches Critical RCE Vulnerability
🔥Exploit : https://github.com/SleepingBag945/CVE-2024-50379
👇Dorks:
HUNTER :/product.name="Apache Tomcat"
FOFA : product="Apache-Tomcat"
SHODAN : product:"Apache-Tomcat"
🔥Exploit : https://github.com/SleepingBag945/CVE-2024-50379
👇Dorks:
HUNTER :/product.name="Apache Tomcat"
FOFA : product="Apache-Tomcat"
SHODAN : product:"Apache-Tomcat"
❤7👍2
🎄 Merry Christmas from Brut Security! 🎅
Wishing you and your loved ones a season filled with joy, peace, and happiness. May this festive time bring warmth to your heart and cherished moments with your loved ones.
Thank you for being a part of our community!
Happy Holidays! 🎉
#MerryChristmas #Cybersecurity #BrutSecurity
Wishing you and your loved ones a season filled with joy, peace, and happiness. May this festive time bring warmth to your heart and cherished moments with your loved ones.
Thank you for being a part of our community!
Happy Holidays! 🎉
#MerryChristmas #Cybersecurity #BrutSecurity
1❤14👍2🔥2