Brut Security
14.7K subscribers
910 photos
73 videos
287 files
967 links
βœ…Queries: @wtf_brut
πŸ›ƒWhatsApp: wa.link/brutsecurity
🈴Training: brutsec.com
πŸ“¨E-mail: [email protected]
Download Telegram
Reactions Please πŸ‘€
Please open Telegram to view this post
VIEW IN TELEGRAM
❀18🀝2πŸ‘1
Please open Telegram to view this post
VIEW IN TELEGRAM
❀12πŸ—Ώ4πŸ€”2🐳1
πŸ“š Good collection of cheat sheets, guides and resources on #Pentesting, reverse engineering and exploit dev πŸ›‘οΈ

- https://x0rb3l.github.io/Cyber-Bookmarks/bookmarks.html
πŸ”₯15❀5πŸ‘3πŸ—Ώ2
Advanced Web Hacking.pdf
10.2 MB
NotSoSecure Advanced Web Hacking
πŸ‘13πŸ”₯6
⚑️Misconfig Mapper - A fast tool to help you uncover security misconfigurations on popular third-party services used by your company and/or bug bounty targets.

β˜„οΈhttps://github.com/intigriti/misconfig-mapper
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯17πŸ‘5
β˜„οΈSubCerts is an automated tool designed to extract subdomains from certificate transparency logs using the crt.sh API. This tool is able to identify subdomains of a target domain by leveraging publicly available certificates.

⚠️https://github.com/0xJin/SubCerts
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘27πŸ”₯11🫑8❀2
πŸ“ˆπŸ“‰Your one Reaction is my reason to post such contents.
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘55🫑18πŸ”₯10πŸ—Ώ4❀2πŸ‘¨β€πŸ’»1
πŸ”’Bug Bounty Tip: Algolia API Key Exposure Can Lead to Web Log Access with CRUD Permissions

⭐️If an Algolia API key is exposed, it may allow access to search logs with Create, Read, Update, and Delete (CRUD) privileges. This can reveal user queries and other sensitive data.

πŸ” Tip: Always inspect main.js files for exposed keys.

#bugbountytip #bugbounty #infosec #hacking #hacker
Please open Telegram to view this post
VIEW IN TELEGRAM
❀13πŸ‘7πŸ”₯3
CTF Search with 24k+ CTF writeups, covering everything from web exploitation to reverse engineering. Check it out!

- ctfsearch.hackmap.win

#infosec #cybersec #bugbountytips
20πŸ”₯22❀6πŸ‘2
Bleach's Bug Bounty Blues
<unknown>
🫑6❀3🀣2πŸ‘1
❀11πŸ—Ώ7
β˜„οΈwappalyzer-next - wappalyzer alternative based on wappalyzer browser extension.

⚑️⚑️⚑️⚑️170+ new technologies added in the latest update of wappalyzer, grab it!

⌨️https://github.com/s0md3v/wappalyzer-next
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘12❀4πŸ”₯3πŸ€”1
⚑️Exclusive Collection of Private Nuclei Templates

1. Akokonunes
2. Emadshanab
3.
BoobooHQ
4. SirBugs
5. Linuxadi
6. 0xKayala
7. Bhataasim1
8. H0tak88r
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯28πŸ‘3🐳2πŸ—Ώ2
Want to learn more about Oauth bugs?

Here's a detailed writeup by @Doyensec on Oauth vulns like:

- Redirect Scheme Hijacking
- Scope Upgrade
- Client Confusion
- Mutable Claims

https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html

#bugbounty #bugbountytips
πŸ‘12❀3
Bypassing File Upload Restrictions on Xiaomi Using
.extensions./%00.png

Method _BUG BOUNTY POC_
https://t.iss.one/brutsecurity_poc/40
πŸ‘7🐳2πŸ—Ώ2
Morgan is a powerful tool designed to help security researchers, developers, and security auditors identify sensitive information, vulnerabilities, and potential risks within JavaScript files on websites.
-> GitHub.com/VFA250/Morgan
πŸ”₯11❀4πŸ‘3
β˜„οΈSearch Engine for Bug Bounty Hunters
- https://nitinyadav00.github.io/Bug-Bounty-Search-Engine/
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘16πŸ”₯5πŸ€”3
Please open Telegram to view this post
VIEW IN TELEGRAM
🀣6πŸ‘2
πŸ“ŠVulnerable Bank - An intentionally vulnerable application built for learning secure code reviews and to test api pentesting skills.

πŸ–₯https://github.com/Commando-X/vuln-bank
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯14πŸ‘5😱3
Start solving and share your writeup with our community members in discussions group. https://t.iss.one/brutsec