Don't forget to react guys 😔
Please open Telegram to view this post
VIEW IN TELEGRAM
🗿21🔥10👍6👏4🐳2🤣1🫡1
CVE-2025-20029: Command Injection in F5 BIG-IP, 8.8 rating❗️
The vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!
Search at Netlas.io:
👉 Link: https://nt.ls/e17gN
👉 Dork: http.headers.server:"BigIP"
Vendor's advisory: https://my.f5.com/manage/s/article/K000148587
The vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!
Search at Netlas.io:
👉 Link: https://nt.ls/e17gN
👉 Dork: http.headers.server:"BigIP"
Vendor's advisory: https://my.f5.com/manage/s/article/K000148587
👍7❤3😱2
CVE-2025-24752: XSS in Elementor Page Builder, 7.1 rating❗️
Reflected XSS in a large number of sites. Thanks to our friend Chirag Artani for suggesting the query!
Search at Netlas.io:
👉 Link: https://nt.ls/8wpei
👉 Dork: http.body:"plugins/elementor" AND host_type:domain
Read more: https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
Reflected XSS in a large number of sites. Thanks to our friend Chirag Artani for suggesting the query!
Search at Netlas.io:
👉 Link: https://nt.ls/8wpei
👉 Dork: http.body:"plugins/elementor" AND host_type:domain
Read more: https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
❤4👍3
Please open Telegram to view this post
VIEW IN TELEGRAM
app.netlas.io
Discover, Research and Monitor any Assets Available Online
Internet intelligence apps that provide accurate technical information on IP addresses, domain names, websites, web applications, IoT devices, and other online assets.
🔥4
This media is not supported in your browser
VIEW IN TELEGRAM
Active link finding with xnLinkFinder! 🚀
Command breakdown:
-i https://bugcrowd.com → Target domain
-sp https://bugcrowd.com → Scope prefix
-sf "bugcrowd.*" → Scope filter
-d 2 → Crawl depth
-v → Verbose output
Command breakdown:
-i https://bugcrowd.com → Target domain
-sp https://bugcrowd.com → Scope prefix
-sf "bugcrowd.*" → Scope filter
-d 2 → Crawl depth
-v → Verbose output
👍10❤9
This media is not supported in your browser
VIEW IN TELEGRAM
Popping alert(1) doesn't show REAL impact.
Escalate your XSS by stealing cookies instead👇
Escalate your XSS by stealing cookies instead👇
🗿15🔥4❤2
Is your open URL redirect payload getting blocked? 🧐
Try one of these payloads to bypass it! 🤑
https://www.intigriti.com/researchers/blog/hacking-tools/open-url-redirects-a-complete-guide-to-exploiting-open-url-redirect-vulnerabilities
Try one of these payloads to bypass it! 🤑
https://www.intigriti.com/researchers/blog/hacking-tools/open-url-redirects-a-complete-guide-to-exploiting-open-url-redirect-vulnerabilities
❤7👍3🔥2
Crazy Aliyun WAF Bypass:
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙♂️
Credit: @galnagli
#bugbountytips #bugbounty
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙♂️
Credit: @galnagli
#bugbountytips #bugbounty
🔥5🤨3❤2👍2🗿2
Some will find their first bug in a week, while others might take months. Some will excel in recon, others in web exploitation. It’s not about how fast you get there—it’s about persistence, learning, and adapting. Every failed attempt is a step forward, every mistake a lesson.
So, don’t compare your journey to others. Focus on your progress. Keep hacking, keep improving, and most importantly, keep walking your own path. Success will follow.
Please open Telegram to view this post
VIEW IN TELEGRAM
❤25👍5
Brut Security pinned «💭 Everyone’s journey in bug bounty is unique. What worked for one hacker may not work for you, and that’s okay. Your growth isn’t defined by someone else’s timeline. You have your own challenges to face, your own lessons to learn, and your own way of mastering…»
⚡Linkook - An OSINT tool for discovering linked social accounts and associated emails across multiple platforms using a single username.
✅https://github.com/JackJuly/linkook
✅https://github.com/JackJuly/linkook
👍13🫡3❤2
CVE-2024-47051: RCE in Mautic, 9.1 rating 🔥
The vulnerability allows an attacker to conduct RCE through asset loading, as well as manipulate the file deletion process to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/odIOX
👉 Dork: http.favicon.hash_sha256:67a5904d731636c114513a7df90d4d6bff7a3f690f305ef3487ac84844a5874e
Vendor's advisory: https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
The vulnerability allows an attacker to conduct RCE through asset loading, as well as manipulate the file deletion process to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/odIOX
👉 Dork: http.favicon.hash_sha256:67a5904d731636c114513a7df90d4d6bff7a3f690f305ef3487ac84844a5874e
Vendor's advisory: https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
👍7😱3
Please open Telegram to view this post
VIEW IN TELEGRAM
👍15🔥5