Want to find the origin IP?
1-Hunt for a subdomain with no WAF
2-extract the ASN
2-check it on bgp.he.net
3- grab the IP range, and verify a live IP.
Welcome to their world!

#bugbountytips #BugBounty

CVE-2025-1661: Path Traversal in The HUSKY WordPress Plugin, 9.8 rating 🔥

The vulnerability allows an attacker to execute arbitrary files on the server, including PHP code.

Search at Netlas.io:
👉 Link: https://nt.ls/OEg7k
👉 Dork: http.body:"plugins/woocommerce-products-filter"

Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-products-filter/husky-products-filter-professional-for-woocommerce-1365-unauthenticated-local-file-inclusion

CVE-2025-25291, -25292 and other: Multiple vulnerabilitites in GitLab, 8.8 rating❗️

Traditionally, GitLab publishes information about several vulnerabilities at once. These include Interpretation Conflict, DoS, Credentials Disclose, etc.

Search at Netlas.io:
👉 Link: https://nt.ls/PDxYA
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"

Vendor's advisory: https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/

Disclosing YouTube Creator Emails for a $20k Bounty
From creator privacy to phishing paradise: How a secret parameter could have exposed the private email addresses of monetized YouTube channels

Nightmare
Nightmare is an intro to binary exploitation / reverse engineering course based around ctf challenges.

Account Takeover using SSO Logins

https://rikeshbaniya.medium.com/account-takeover-using-sso-logins-fa35f28a358b

CVE-2024-13918, -13919: XSS in Laravel Framework, 8.0 rating❗️

The vulnerabilities allow an attacker to execute code in the victim's browser via Reflected XSS if the victim clicks on a decoy link.

More then 770k instances at Netlas.io:
👉 Link: https://nt.ls/95OAY
👉 Dork: http.headers.set_cookie:"laravel_session="

Read more: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page

Get Windows Domain Information:

C:\> nltest /DCLIST:DomainName
C:\> nltest /DCNAME:DomainName
C:\> nltest /DSGETDC:DomainName

These commands utilize nltest, a command-line tool included with Windows Server and some client versions (when Remote Server Administration Tools, RSAT, are installed).

Below is a detailed breakdown:

1. nltest /DCLIST:DomainName

Purpose: Lists all domain controllers for the specified domain (DomainName).

Output: Displays a list of domain controllers with their names, IP addresses, and site information.

Example:
C:\> nltest /DCLIST:EXAMPLE
DC: \\https://DC01.example.com [192.168.1.10] Site: Default-First-Site-Name
DC: \\https://DC02.example.com [192.168.1.11] Site: Default-First-Site-Name
The command completed successfully

2. nltest /DCNAME:DomainName

Purpose: Retrieves the name of a domain controller for the specified domain.

Output: Returns a single DC name, often the one the workstation is communicating with.

Example:
C:\> nltest /DCNAME:EXAMPLE
DC: \\https://DC01.example.com
The command completed successfully

3. nltest /DSGETDC:DomainName

Purpose: Queries and returns detailed information about a domain controller for the specified domain, including its name, IP, site, and more.

Output: Provides a verbose output with attributes like DC name, IP address, domain GUID, and forest details.

Example:
C:\> nltest /DSGETDC:EXAMPLE
DC: \\https://DC01.example.com
Address: 192.168.1.10
Dom Guid: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
Site: Default-First-Site-Name
Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE
The command completed successfully

#promo Join for BB Tips - @pythagorex