Ninjasworkout:-- Vulnerable NodeJS Web Application.
ADDED BUGS:-
Prototype Pollution ✅1
No SQL Injection ✅2
Cross site Scripting ✅3
Broken Access Control ✅4
Broken Session Management ✅5
Weak Regex Implementation ✅ 6
Race Condition ✅7
CSRF -Cross Site Request Forgery ✅8
Weak Bruteforce Protection ✅9
User Enumeration ✅10
Reset Password token leaking in Referrer ✅11
Reset Password bugs ✅12
Sensitive Data Exposure ✅13
Unicode Case Mapping Collision ✅14
File Upload ✅ 15
SSRF ✅ 16
XXE
Open Redirection ✅ 17
Directory Traversal ✅ 18
Insecure Deserilization => Remote Code Execution ✅ 19
https://github.com/effortlessdevsec/ninjasworkout
ADDED BUGS:-
Prototype Pollution ✅1
No SQL Injection ✅2
Cross site Scripting ✅3
Broken Access Control ✅4
Broken Session Management ✅5
Weak Regex Implementation ✅ 6
Race Condition ✅7
CSRF -Cross Site Request Forgery ✅8
Weak Bruteforce Protection ✅9
User Enumeration ✅10
Reset Password token leaking in Referrer ✅11
Reset Password bugs ✅12
Sensitive Data Exposure ✅13
Unicode Case Mapping Collision ✅14
File Upload ✅ 15
SSRF ✅ 16
XXE
Open Redirection ✅ 17
Directory Traversal ✅ 18
Insecure Deserilization => Remote Code Execution ✅ 19
https://github.com/effortlessdevsec/ninjasworkout
❤17👍3
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - akr3ch/BugBountyBooks: A collection of PDF/books about the modern web application security and bug bounty.
A collection of PDF/books about the modern web application security and bug bounty. - akr3ch/BugBountyBooks
🔥8❤5👏2
Github subdomain takeover
Reward: $200
Program: Public
dev[.]to: https://dev.to/c4ng4c31r0/github-subdomain-takeover-3j6k
Reward: $200
Program: Public
dev[.]to: https://dev.to/c4ng4c31r0/github-subdomain-takeover-3j6k
DEV Community
Github subdomain takeover
reward: 200$ Description A subdomain takeover is when a misconfigured Domain Name...
🔥9👍1
Price Tampering & Store XSS Bug poc _ Price Manipulation _ CodePrefer ---> https://t.iss.one/brutsecurity_poc/24
🔥8🤨3🗿2🙏1
Please open Telegram to view this post
VIEW IN TELEGRAM
1🔥6👍3
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥8❤4
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥14👍2
⚡Awesome Cyber Security University
✅https://brootware.github.io/awesome-cyber-security-university/
✅https://brootware.github.io/awesome-cyber-security-university/
🔥21❤6👍4
CVE-2024-11187, -12705: Vulnerabilities in BIND DNS Software, 7.5 rating❗️
Two vulnerabilities in BIND allow DoS against DNS servers, which can be a preparatory step before the main attacks.
Search at Netlas.io:
👉 Link: https://nt.ls/bGSFv
👉 Dork: dns.banner:"BIND" OR dns_tcp.banner:"BIND"
Read more: https://kb.isc.org/docs/cve-2024-12705
Two vulnerabilities in BIND allow DoS against DNS servers, which can be a preparatory step before the main attacks.
Search at Netlas.io:
👉 Link: https://nt.ls/bGSFv
👉 Dork: dns.banner:"BIND" OR dns_tcp.banner:"BIND"
Read more: https://kb.isc.org/docs/cve-2024-12705
❤7
This media is not supported in your browser
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥19👍6❤1
At the time of publication, none of the scripts were flagged by antivirus systems. However, typically within 2-3 weeks after publication, some vendors begin to detect and flag the malicious files.
Please open Telegram to view this post
VIEW IN TELEGRAM
❤10🔥5👍3
Please open Telegram to view this post
VIEW IN TELEGRAM
👍5🔥2
https://t.iss.one/brutsecurity_poc/33
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥6