Brut Security
15.1K subscribers
964 photos
76 videos
292 files
1.01K links
βœ…DM: @wtf_brut
πŸ›ƒWhatsApp: https://wa.link/brutsecurity
🈴Training: https://brutsecurity.com
πŸ“¨Mail: [email protected]
Download Telegram
CVE-2025-26465, -26466: Two vulnerabilities in OpenSSH, 6.8 rating❗️

MitM and DoS in OpenSSH. The severity level is medium, but the vulnerabilities cover many versions: from 2013 for -26465 and from 2023 for -26466.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/1TTrj
πŸ‘‰ Dork: ssh.server_key_exchange.client_to_server_compression:"[email protected]"

Read more: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
πŸ‘10πŸ”₯5❀2😱1🀣1
πŸ‘»πŸ‘»πŸ‘»Nuclei AI Prompts is a platform that offers a collection of ready-to-use security prompts for Nuclei. It helps penetration testers and security researchers speed up their work by providing prompts for common vulnerabilities like XSS, SQLi, RCE, and more. You can easily copy these prompts and use them in your security testing, and even contribute new ones to help grow the community.

πŸ”₯πŸ”₯πŸ”₯https://nucleiprompts.com
Please open Telegram to view this post
VIEW IN TELEGRAM
10😱12πŸ‘7πŸ”₯7
CVE-2025-23209: Code Injection in CraftCMS, 8.1 rating❗️

Craft CMS contains a code injection vulnerability that allows for remote code execution as vulnerable versions have compromised user security keys.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/brxoj
πŸ‘‰ Dork: http.headers.x_powered_by:"Craft CMS"

Vendor's advisory: https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
πŸ”₯4πŸ‘2😱1
πŸ”–Extracting endpoints from JavaScript bookmarklets

⬇️Usage
πŸ”΄Add a new bookmark in your browser’s toolbar
πŸ”΄Replace the bookmark’s URL with the following JavaScript code:
javascript:(function(){var scripts=document.getElementsByTagName("script"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0–9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<scripts.length;i++){var t=scripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();

πŸ”΄Visit the target page and click the bookmarklet. The script will run in your browser, revealing previously undiscovered endpoints right on the page.
Please open Telegram to view this post
VIEW IN TELEGRAM
10πŸ‘7❀6πŸ”₯5🀝2
πŸ‘»πŸ‘»πŸ‘»
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ—Ώ19πŸ”₯5🐳4
grep-backURLs - Automated way to extract juicy info with subfinder and waybackurls

https://github.com/gigachad80/grep-backURLs
1πŸ”₯12πŸ‘4
πŸ‘»πŸ‘»πŸ‘»Search across a half million git repos in Grep website - grep.app
Please open Telegram to view this post
VIEW IN TELEGRAM
1πŸ”₯12πŸ‘4πŸ‘¨β€πŸ’»3
πŸ”₯πŸ”₯You Can Connect with me on LinkedIn- https://www.linkedin.com/in/mandal-saumadip
Please open Telegram to view this post
VIEW IN TELEGRAM
1❀11😁5πŸ‘1
πŸ›‘Add this to your wordlist and you can ended up getting a CRITICAL
templates/processed/syslog-tcp-forward.conf

templates/processed/config.ini

Credit- Suyash Sharma
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘18πŸ”₯9❀2
πŸ‘»πŸ‘»πŸ‘»LazyHunter is an automated reconnaissance tool designed for bug hunters, leveraging Shodan's InternetDB and CVEDB APIs. It retrieves open ports, hostnames, tags, and vulnerabilities for a given IP and fetches CVE details, including affected products and CVSS scores. Results are color-coded by severity for easy analysis.

https://github.com/iamunixtz/Lazy-Hunter
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘17πŸ”₯8❀3πŸ—Ώ1
πŸ‘»uro 1.0.2 is now out ✨

βœ…https://github.com/s0md3v/uro
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯10πŸ‘5
Need an extensive SQL injection cheat sheet for bug bounty hunting and pentesting in general? 🧐

Check out @0xTib3rius' SQL Injection cheat sheet, it provides payloads for the 5 most popular databases such as MySQL, PostgreSQL, Oracle, etc.! 😎

πŸ”— buff.ly/3WeSO5X
πŸ‘13πŸ‘6
This media is not supported in your browser
VIEW IN TELEGRAM
urlhunter: A recon tool that allows searching on URLs that are exposed via shortener services

Link:
https://github.com/utkusen/urlhunter
πŸ”₯18πŸ‘3❀2🀝2
CVE-2025-26794: SQL Injection in Exim 4.98, 7.5 rating❗️

A vulnerability in the Exim mail transfer agent could allow a remote attacker to perform SQL injection.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/ge4Iy
πŸ‘‰ Dork: smtp.banner:"Exim 4.98"

Vendor's advisory: https://www.exim.org/static/doc/security/CVE-2025-26794.txt
πŸ”₯35πŸ‘10🐳1
Don't forget to react guys 😒
πŸ”₯45πŸ‘7πŸ—Ώ4😁3🀣3
πŸ‘»πŸ‘»URL's Manipulation 4 Reconnaissance

πŸ”₯30 ways to gather information about the target domain just by adding different words to URL.

πŸ›‘https://osintteam.blog/urls-osint-bf5c9b087455
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘14πŸ”₯3🐳1πŸ—Ώ1
CVE-2025-1128: RCE in Everest Forms WordPress Plugin, 9.8 rating πŸ”₯

The vulnerability allows an unauthenticated attacker to perform a wide range of actions with the site: upload arbitrary files, RCE, delete config files.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/q6pgJ
πŸ‘‰ Dork: http.body:"plugins/everest-forms"

Read more: https://www.wordfence.com/blog/2025/02/100000-wordpress-sites-affected-by-arbitrary-file-upload-read-and-deletion-vulnerability-in-everest-forms-wordpress-plugin/
πŸ”₯11πŸ‘1
πŸ‘»πŸ‘»πŸ‘»Lenovo XSS via Unrestricted File Upload PoC---> https://t.iss.one/brutsecurity_poc/42
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ—Ώ3
πŸ‘»πŸ‘» A search engine for CTF writeups
πŸ›‘https://ctfsearch.hackmap.win/
Please open Telegram to view this post
VIEW IN TELEGRAM
10❀28πŸ‘6