Please open Telegram to view this post
VIEW IN TELEGRAM
๐ฅ41โค6๐จโ๐ป2
CVE-2024-10441: RCE in Synology products, 9.8 rating ๐ฅ
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
๐ Link: https://nt.ls/KOa1N
๐ Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
๐ Link: https://nt.ls/KOa1N
๐ Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
๐ฅ7๐3
๐ต๏ธโโ๏ธ Bug Bounty Hunters, Hereโs a Hidden Gem! ๐
๐ Grab it now : https://gowsundar.gitbook.io/book-of-bugbounty-tips
---------------------------------------------------------
๐ ๐๐๐ฏ๐๐ฅ ๐๐ฉ ๐๐จ๐ฎ๐ซ ๐๐ฒ๐๐๐ซ๐๐๐ ๐๐๐ฆ๐! ๐ฅ
๐ brutsec.com
๐ฑ ๐๐๐ฅ๐๐ ๐ซ๐๐ฆ: t.iss.one/brutsecurity
๐ผ ๐: x.com/brutsecurity
๐ ๐๐ญ๐ก๐ข๐๐๐ฅ ๐๐๐๐ค๐ข๐ง๐ ๐๐จ๐๐๐ฆ๐๐ฉ: topmate.io/saumadip/1391531
๐ ๐๐จ๐ฎ๐ซ๐ฌ๐ ๐๐ง๐ซ๐จ๐ฅ๐ฅ๐ฆ๐๐ง๐ญ: wa.link/brutsecurity
โญ ๐๐ข๐ค๐ ๐ญ๐ก๐ข๐ฌ ๐ฉ๐จ๐ฌ๐ญ? โ ๐ ๐จ๐ฅ๐ฅ๐จ๐ฐ, ๐๐จ๐ข๐ง, ๐๐ฎ๐๐ฌ๐๐ซ๐ข๐๐ & ๐๐๐ง๐ ๐๐ญ๐๐ซ๐ฌ ๐ญ๐จ ๐ฌ๐ก๐จ๐ฐ ๐ฒ๐จ๐ฎ๐ซ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ!
๐ Grab it now : https://gowsundar.gitbook.io/book-of-bugbounty-tips
---------------------------------------------------------
๐ ๐๐๐ฏ๐๐ฅ ๐๐ฉ ๐๐จ๐ฎ๐ซ ๐๐ฒ๐๐๐ซ๐๐๐ ๐๐๐ฆ๐! ๐ฅ
๐ brutsec.com
๐ฑ ๐๐๐ฅ๐๐ ๐ซ๐๐ฆ: t.iss.one/brutsecurity
๐ผ ๐: x.com/brutsecurity
๐ ๐๐ญ๐ก๐ข๐๐๐ฅ ๐๐๐๐ค๐ข๐ง๐ ๐๐จ๐๐๐ฆ๐๐ฉ: topmate.io/saumadip/1391531
๐ ๐๐จ๐ฎ๐ซ๐ฌ๐ ๐๐ง๐ซ๐จ๐ฅ๐ฅ๐ฆ๐๐ง๐ญ: wa.link/brutsecurity
โญ ๐๐ข๐ค๐ ๐ญ๐ก๐ข๐ฌ ๐ฉ๐จ๐ฌ๐ญ? โ ๐ ๐จ๐ฅ๐ฅ๐จ๐ฐ, ๐๐จ๐ข๐ง, ๐๐ฎ๐๐ฌ๐๐ซ๐ข๐๐ & ๐๐๐ง๐ ๐๐ญ๐๐ซ๐ฌ ๐ญ๐จ ๐ฌ๐ก๐จ๐ฐ ๐ฒ๐จ๐ฎ๐ซ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ!
๐ฅ7โค3๐ฟ1
๐The ultimate 403 Bypass wordlists and tester notes by JHaddix
๐ฑ Github: ๐ Link
---------------------------------------------------------
๐ ๐๐๐ฏ๐๐ฅ ๐๐ฉ ๐๐จ๐ฎ๐ซ ๐๐ฒ๐๐๐ซ๐๐๐ ๐๐๐ฆ๐! ๐ฅ
๐ brutsec.com
๐ฑ ๐๐๐ฅ๐๐ ๐ซ๐๐ฆ: t.iss.one/brutsecurity
๐ผ ๐: x.com/brutsecurity
๐ ๐๐ญ๐ก๐ข๐๐๐ฅ ๐๐๐๐ค๐ข๐ง๐ ๐๐จ๐๐๐ฆ๐๐ฉ: topmate.io/saumadip/1391531
๐ ๐๐จ๐ฎ๐ซ๐ฌ๐ ๐๐ง๐ซ๐จ๐ฅ๐ฅ๐ฆ๐๐ง๐ญ: wa.link/brutsecurity
โญ ๐๐ข๐ค๐ ๐ญ๐ก๐ข๐ฌ ๐ฉ๐จ๐ฌ๐ญ? โ ๐ ๐จ๐ฅ๐ฅ๐จ๐ฐ, ๐๐จ๐ข๐ง, ๐๐ฎ๐๐ฌ๐๐ซ๐ข๐๐ & ๐๐๐ง๐ ๐๐ญ๐๐ซ๐ฌ ๐ญ๐จ ๐ฌ๐ก๐จ๐ฐ ๐ฒ๐จ๐ฎ๐ซ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ!
#bugbounty #bugbountytips #cybersecurity #infosec #brutsecurity
๐ฑ Github: ๐ Link
---------------------------------------------------------
๐ ๐๐๐ฏ๐๐ฅ ๐๐ฉ ๐๐จ๐ฎ๐ซ ๐๐ฒ๐๐๐ซ๐๐๐ ๐๐๐ฆ๐! ๐ฅ
๐ brutsec.com
๐ฑ ๐๐๐ฅ๐๐ ๐ซ๐๐ฆ: t.iss.one/brutsecurity
๐ผ ๐: x.com/brutsecurity
๐ ๐๐ญ๐ก๐ข๐๐๐ฅ ๐๐๐๐ค๐ข๐ง๐ ๐๐จ๐๐๐ฆ๐๐ฉ: topmate.io/saumadip/1391531
๐ ๐๐จ๐ฎ๐ซ๐ฌ๐ ๐๐ง๐ซ๐จ๐ฅ๐ฅ๐ฆ๐๐ง๐ญ: wa.link/brutsecurity
โญ ๐๐ข๐ค๐ ๐ญ๐ก๐ข๐ฌ ๐ฉ๐จ๐ฌ๐ญ? โ ๐ ๐จ๐ฅ๐ฅ๐จ๐ฐ, ๐๐จ๐ข๐ง, ๐๐ฎ๐๐ฌ๐๐ซ๐ข๐๐ & ๐๐๐ง๐ ๐๐ญ๐๐ซ๐ฌ ๐ญ๐จ ๐ฌ๐ก๐จ๐ฐ ๐ฒ๐จ๐ฎ๐ซ ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ!
#bugbounty #bugbountytips #cybersecurity #infosec #brutsecurity
๐ฅ8โค2
Please open Telegram to view this post
VIEW IN TELEGRAM
HackerOne
HackerOne disclosed on HackerOne: Domain highlighting on External...
There have been multiple issues with External Link Warning in the past. Sometimes it's Homograph, sometimes more than 2 slashes in link, sometimes domain highlighting and/or weird markdown. And...
๐คฃ9๐ซก1
Please open Telegram to view this post
VIEW IN TELEGRAM
1๐ฅ17๐ฑ4โค3
โกThe Ultimate PNPT Study Guide โ Master Pentesting & Crush the Exam!
๐Link: https://github.com/TrshPuppy/PNPT-study-guide
๐Link: https://github.com/TrshPuppy/PNPT-study-guide
โค10๐ฅ4๐3
https://medium.com/me/stats/post/f6ae24cdcdfa
https://medium.com/securing/exploring-25k-aws-s3-buckets-f22ec87c3f2a
https://suleyman-celik8.medium.com/enumerate-s3-buckets-using-lazys3-d2f5de14d31
Please open Telegram to view this post
VIEW IN TELEGRAM
๐10โค3๐ฅ3
โกSubDomain Grabber - A bug bounty tool to download, unzip, and clean subdomains from Chaos ProjectDiscovery.
๐จConverts *.abc.com to https://abc.com, organizes into directories, and removes ZIPs. Offers a colorful CLI, filters (BugCrowd, HackerOne, etc.), sorting, and pagination.
โ https://github.com/MuhammadWaseem29/SubDomain-Grabber
๐จConverts *.abc.com to https://abc.com, organizes into directories, and removes ZIPs. Offers a colorful CLI, filters (BugCrowd, HackerOne, etc.), sorting, and pagination.
โ https://github.com/MuhammadWaseem29/SubDomain-Grabber
๐ฅ10๐6
Subdominator - Unleash the Power of Subdomain Enumeration
https://github.com/RevoltSecurities/Subdominator
https://github.com/RevoltSecurities/Subdominator
โค19๐3
Please open Telegram to view this post
VIEW IN TELEGRAM
Discord
Join the Brut Security Discord Server!
Check out the Brut Security community on Discord - hang out with 950 other members and enjoy free voice and text chat.
๐4
Brut Security pinned ยซ๐ป Looking for a Discord Moderator!๐ป โ ๏ธ We need an active mod to help manage the Brut Security server. Based on performance, youโll be rewarded with swags, gift cards, or TryHackMe vouchers! ๐ฅ Join & Apply Now: https://discord.gg/u7uMFV833hยป
Please open Telegram to view this post
VIEW IN TELEGRAM
๐ฅ14โค4
โบ๏ธYour support keeps me motivated to share more valuable content! If you found this helpful, drop a like & send stars โญ to help me keep going.
๐ฌ For queries, message me on Telegram: @wtf_brut
๐ For course enrollment, reach out on WhatsApp: wa.link/brutsecurity
๐ฌ For queries, message me on Telegram: @wtf_brut
๐ For course enrollment, reach out on WhatsApp: wa.link/brutsecurity
4๐31๐ฅ9โค3๐จโ๐ป1๐ซก1
๐ Want to find exploitable CVEs for cybersecurity testing?
Use CVEmap to spot vulnerabilities with public proof-of-concept, marked exploitable by CISA, remotely exploitable, and without Nuclei templates yet!
Flags to use: -k (CISA exploitable), -t=false (no template), -poc (has proof-of-concept), -re (remote).
Happy hunting! ๐ ๏ธ
Use CVEmap to spot vulnerabilities with public proof-of-concept, marked exploitable by CISA, remotely exploitable, and without Nuclei templates yet!
Flags to use: -k (CISA exploitable), -t=false (no template), -poc (has proof-of-concept), -re (remote).
Happy hunting! ๐ ๏ธ
๐18โค9
If you found a file upload function for an image, try introducing an image with XSS in the filename like so:
<img src=x onerror=alert('XSS')>.png
"><img src=x onerror=alert('XSS')>.png
"><svg onmouseover=alert(1)>.svg
<<script>alert('xss')<!--a-->a.png
โค13๐6
Use Vulhub to reproduce Next.js Middleware Authorization Bypass (CVE-2025-29927)
https://github.com/vulhub/vulhub/tree/master/next.js/CVE-2025-29927
https://github.com/vulhub/vulhub/tree/master/next.js/CVE-2025-29927
๐ฅ7โค3๐2๐จโ๐ป2
๐จ 0day Hunters, Pay Attention! ๐จ
CVE-2025-29927 โ Next.js Middleware Auth Bypass [EXPLOIT]
Ever wondered what happens when middleware security checks fail silently? This vuln lets you slip past authentication like a ghost.
๐ฅ Reproduce it with Vulhub. Exploit it with Nuclei.
Itโs waiting in our Discord.
๐ [Exploit Download]
CVE-2025-29927 โ Next.js Middleware Auth Bypass [EXPLOIT]
Ever wondered what happens when middleware security checks fail silently? This vuln lets you slip past authentication like a ghost.
๐ฅ Reproduce it with Vulhub. Exploit it with Nuclei.
Itโs waiting in our Discord.
๐ [Exploit Download]
๐ฅ13๐3