CVE-2025-47110: Cross-site Scripting in Magento (and Adobe Commerce), 9.1 rating 🔥

An XSS vulnerability in Magento and Adobe Commerce allows an attacker to inject code into vulnerable forms and execute it in the victim's browser.

Search at Netlas.io:
👉 Link: https://nt.ls/v6wk6
👉 Dork: tag.name:"magento" AND http.headers.server:"Apache"

Vendor's advisory: https://helpx.adobe.com/security/products/magento/apsb25-50.html

CVE-2025-4798, -4799: Absolute Path Traversal in DownloadManager WordPress Plugin, 4.9 - 7.2 rating❗️

Vulnerabilities shared with us by the pen tester who found them. Allow attackers to manipulate files on the server, which can lead to RCE.

Search at Netlas.io:
👉 Link: https://nt.ls/DH8EA
👉 Dork: http.body:"plugins/wp-downloadmanager"

More information here: https://youtu.be/QTe3rf0-e7U?si=THZKoKeI1vN-arR7

Hey Hunters,
Sorry for the delay—DarkShadow here, back again dropping one of my secret methodologies 😁

🌀 AWS S3 Bucket Takeover Like a Pro — Super Simple but Highly Effective 🔥

✨Before diving in, let’s understand the whole scenario...

👀 1. Which buckets are vulnerable to takeover?
👀 2. What’s the real impact of taking over an S3 bucket?
👀 3. How do we find S3 buckets that are potentially vulnerable?
👀 4. How can we validate whether a bucket was actually used by the target?


⚡ 1. Vulnerable Buckets:
If a target previously used an S3 bucket and deleted it—but the subdomain (CNAME) is still pointing to amazonaws.com—that’s a perfect takeover opportunity.

⚡ 2. Impact:
If the bucket is still referenced anywhere in the backend or services, and the target forgot to remove it, you might even achieve RCE. In some cases, it can lead to full system compromise.

⚡ 3. Finding Buckets (Using FOFA):
Here’s how I hunt them down using FOFA:

🧠 FOFA Dork:

body="specified bucket does not exist" && (host="target.com" || host="target_domain_name_only") && port="443"

🔍 This dork gives you subdomains that point to missing or deleted buckets. FOFA indexes fingerprints across the web—even for deleted resources—so it’s a goldmine for finding exposed assets the target forgot.

⚡ 4. Validating Ownership:

🔎 Method 1: GitHub Recon
Use GitHub dorks like:

org:target_org "target.s3.amazonaws.com"

Or simply search:

"target.s3.amazonaws.com"

You might discover hardcoded links, past commits, or configuration files that prove the target was using this bucket.

🌐 Method 2: DNS History (Not Always Effective, But Worth a Shot)
Check if the bucket was ever configured for static website hosting.

Use these tools to check historical DNS records:

https://securitytrails.com
https://dnsdumpster.com
https://viewdns.info
https://www.robtex.com

If any DNS leaks or CNAME records are found, analyze them to build your proof of ownership.


🎯 So guys, I hope you enjoyed reading this little piece of my methodology.
💥 Don’t forget to follow me 👉🏼 DarkShadow

#dork #takeover #bugbountytips

🔍 Bug Bounty Tip – PDF Keyword Crawler

Hunting for sensitive info in public PDFs?

🧩 Use PDF Keyword Crawler Firefox add-on
📁 Load your urls.txt (with .pdf links)
🔑 It scans for sensitive keywords automatically!

🧠 Great for discovering leaked secrets, creds, or internal docs.

👉 Add-on: https://addons.mozilla.org/es-AR/firefox/addon/pdf-keyword-crawler/

⚡️Outdated but Helpful Some MySQL tricks to break some #WAFs out there. ⚔️ by @BRuteLogic

SELECT-1e1FROM`test`
SELECT~1.FROM`test`
SELECT\NFROM`test`
SELECT@^1.FROM`test`
SELECT-id-1.FROM`test`

#infosec #cybersec #bugbountytips

🚨 CVE-2025-0133 - medium 🚨

PAN-OS - Reflected Cross-Site Scripting

> A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway

👾 https://t.co/pk8n5FJa8K