Grab all the GF Patterns from different Repositories at one shot !! 🔥
*Link* : https://github.com/thecybertix/GF-Patterns
*Link* : https://github.com/thecybertix/GF-Patterns
GitHub
GitHub - thecybertix/GF-Patterns: This repository contains all the GF-Patterns Repositories. All we have to do is just to run the…
This repository contains all the GF-Patterns Repositories. All we have to do is just to run the given Shell File and it's Done !! - thecybertix/GF-Patterns
👍7🔥2❤1
⚙️ Nuclei forge: free tool that helps you visually create Nuclei YAML templates !🔥
created by @payloadartist ! 👏
https://forge.bugbountyhunting.com
created by @payloadartist ! 👏
https://forge.bugbountyhunting.com
👍16❤7
🔍 Wayback Subdomain Enumeration via Bash
Want to uncover hidden subdomains archived over time? This handy Bash function pulls subdomains from the Wayback Machine and helps with deep reconnaissance.
➕ Add this to your ~/.bashrc:
🧪 Usage:
It filters subdomains from archived URLs and sorts them uniquely.
Want to uncover hidden subdomains archived over time? This handy Bash function pulls subdomains from the Wayback Machine and helps with deep reconnaissance.
➕ Add this to your ~/.bashrc:
function wayback() {
curl -sk "https://web.archive.org/cdx/search/cdx?url=*.$1&output=txt&fl=original&collapse=urlkey&page=" | awk -F/ '{gsub(/:.*/, "", $3); print $3}' | sort -u
}🧪 Usage:
wayback target.comIt filters subdomains from archived URLs and sorts them uniquely.
🔥18❤11👍8
✅shosubgo - Small tool to Grab subdomains using Shodan API
⚡https://github.com/incogbyte/shosubgo
⚡https://github.com/incogbyte/shosubgo
❤12🗿5👍1
✅MapperPlus facilitates the extraction of source code from a collection of targets that have publicly exposed .js.map files.
⚡https://github.com/midoxnet/mapperplus
⚡https://github.com/midoxnet/mapperplus
❤15👍2🔥1
🚨 New Batch Starting – August 2025 🚨
Brut Practical Web Penetration Testing (bPWP)
We’re back with a fresh batch of our most in-demand training – Brut Practical Web Penetration Testing – starting this August!
🔍 Learn the art of Web Hacking with:
✅ 100% Practical Sessions
✅ Bug Bounty Approach
✅ Real-World Lab Scenarios
✅ Lifetime Community Access
✅ Beginner-Friendly with Advanced Techniques
💻 Ideal for aspiring bug bounty hunters, cybersecurity students, and VAPT professionals.
📆 Limited Seats – Enroll Now
🌐 https://brutsec.com/bPWP
📩 For Queries:
Telegram: @wtf_brut
WhatsApp: https://wa.link/brutsecurity |
Email: [email protected]
Brut Practical Web Penetration Testing (bPWP)
We’re back with a fresh batch of our most in-demand training – Brut Practical Web Penetration Testing – starting this August!
🔍 Learn the art of Web Hacking with:
✅ 100% Practical Sessions
✅ Bug Bounty Approach
✅ Real-World Lab Scenarios
✅ Lifetime Community Access
✅ Beginner-Friendly with Advanced Techniques
💻 Ideal for aspiring bug bounty hunters, cybersecurity students, and VAPT professionals.
📆 Limited Seats – Enroll Now
🌐 https://brutsec.com/bPWP
📩 For Queries:
Telegram: @wtf_brut
WhatsApp: https://wa.link/brutsecurity |
+918945971332Email: [email protected]
❤11🤝2
APKDeepLens is a Python based tool designed to scan Android applications (APK files) for security vulnerabilities.
✅https://github.com/d78ui98/APKDeepLens/
✅https://github.com/d78ui98/APKDeepLens/
❤12👍2
🚨 CVE-2025-41646 -
Critical Auth Bypass in RevPi Webstatus (≤ v2.4.5) 🚨
⚠️ Impacts ICS/OT environments – high risk!
🛠️ Root Cause:
Backend uses weak equality comparison, accepting a JSON boolean true instead of a password hash.
🧪 PoC:
Send this in a login request:
✅ Result: You get full access without valid credentials!
🔒 Fix: Upgrade to v2.4.6 – patch removes weak comparison logic.
🎯 Bug bounty takeaway:
Always test for type juggling and loose equality bugs in login flows, especially in OT/ICS systems where patch cycles are slower.
Critical Auth Bypass in RevPi Webstatus (≤ v2.4.5) 🚨
⚠️ Impacts ICS/OT environments – high risk!
🛠️ Root Cause:
Backend uses weak equality comparison, accepting a JSON boolean true instead of a password hash.
🧪 PoC:
Send this in a login request:
{ "hashcode": true }✅ Result: You get full access without valid credentials!
🔒 Fix: Upgrade to v2.4.6 – patch removes weak comparison logic.
🎯 Bug bounty takeaway:
Always test for type juggling and loose equality bugs in login flows, especially in OT/ICS systems where patch cycles are slower.
🗿12👍4❤2
CVE-2025-49826: DoS in Next.js, 7.5 rating❗️
A vulnerability in some versions of the Next.js framework allows attackers to perform cache poisoning, leading to a denial of service.
Search at Netlas.io:
👉 Link: https://nt.ls/raJ1k
👉 Dork: http.headers.x_powered_by:"Next.js"
Read more: https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
A vulnerability in some versions of the Next.js framework allows attackers to perform cache poisoning, leading to a denial of service.
Search at Netlas.io:
👉 Link: https://nt.ls/raJ1k
👉 Dork: http.headers.x_powered_by:"Next.js"
Read more: https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r
😁9❤4
Show Some Love Guyss 👀😅https://brutsecurity.medium.com/brutdroid-the-ultimate-beginners-tool-to-set-up-an-android-pentesting-lab-15d2e92e2d67
Medium
🚀 BrutDroid: The Ultimate Beginner’s Tool to Set Up an Android Pentesting Lab
✨ Build your own Android Pentesting playground with zero headaches.
❤13🔥6👍1
Brut Security pinned «Show Some Love Guyss 👀😅https://brutsecurity.medium.com/brutdroid-the-ultimate-beginners-tool-to-set-up-an-android-pentesting-lab-15d2e92e2d67»
⚡Detects sensitive files on the web server.
cat allurls.txt | grep -E "\.xls|\.xml|\.xlsx|\.json|\.pdf|\.sql|\.doc|\.docx|\.pptx|\.txt|\.zip|\.tar\.gz|\.tgz|\.bak|\.7z|\.rar|\.log|\.cache|\.secret|\.db|\.backup|\.yml|\.gz|\.config|\.csv|\.yaml|\.md|\.md5"
❤21👍5😁2
a free online tool designed to generate dorks for precise, professional search. Built for the #OSINT community, ready to use. Better queries lead to better intelligence.🧠
🔗 syntax.goldenowl.ai
🔗 syntax.goldenowl.ai
🤝9🔥7❤5👏1