Need to quickly check for exposed backup files? Check out fuzzuli, a simple tool by @musana to quickly check for sensitive files! 🤠
🔗 github.com/musana/fuzzuli
🔗 github.com/musana/fuzzuli
❤8🔥3
Hey Hunter's,
DarkShadow here back again, just dropping a critical RCE...
🔥Jenkins Git Parameter Plugin – Command Injection💀
The Jenkins plugin “Git Parameter” (versions up to 439.vb_0e46ca_14534) allows attackers to inject arbitrary Git parameter values into shell commands.
Approximately 15,000 publicly accessible Jenkins servers have authentication disabled! And some others allow anyone to create accounts freely.
POC payload:
insert here $(YOUR OS COMMANDS)
So guy's if you like to more read latest POC's show your love's and share.
~DarkShadow
#bugbountytips #poc #Infosec #rce
DarkShadow here back again, just dropping a critical RCE...
🔥Jenkins Git Parameter Plugin – Command Injection💀
The Jenkins plugin “Git Parameter” (versions up to 439.vb_0e46ca_14534) allows attackers to inject arbitrary Git parameter values into shell commands.
Approximately 15,000 publicly accessible Jenkins servers have authentication disabled! And some others allow anyone to create accounts freely.
POC payload:
set parameter type: branch
Input the Payload in, set default value: $(sleep 80)
insert here $(YOUR OS COMMANDS)
So guy's if you like to more read latest POC's show your love's and share.
~DarkShadow
#bugbountytips #poc #Infosec #rce
❤16👏3👍2
Notes from "How to Crush Bug Bounties in the first 12 Months" by @hakluke
🔥16👨💻1🗿1
Guy's finally i made Linuxbomber.
A tool that exploit Linux environment and able to damage permanently any Linux OS even some case's it exploit hardware.
Let me know can i upload the tool in my GitHub?
Made just for educational purpose only
A tool that exploit Linux environment and able to damage permanently any Linux OS even some case's it exploit hardware.
Let me know can i upload the tool in my GitHub?
Made just for educational purpose only
🔥21😱5🙏4❤2😁2🤔1
One of my student in very 1st day of the Advanced Web Pentesing session, just performed a basic automation scan and got sensitive information disclosure.
✅If you want to enroll and learn from very beginner level then DM us on https://wa.link/brutsecurity
✅If you want to enroll and learn from very beginner level then DM us on https://wa.link/brutsecurity
👏4
🚨 CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability
🔥PoC :https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis
👇Dorks
HUNTER : https://product.name="Jenkins"
📰Refer:https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3419
https://github.com/advisories/GHSA-qcj2-99cg-mppf
🔥PoC :https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis
👇Dorks
HUNTER : https://product.name="Jenkins"
📰Refer:https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3419
https://github.com/advisories/GHSA-qcj2-99cg-mppf
❤8
DomLoggerpp by @kevin_mizu is a simple web extension that helps you identify JavaScript DOM sinks that could lead to DOM-based vulnerabilities (such as XSS)! 😎
Check it out! 👇
🔗 https://github.com/kevin-mizu/domloggerpp
Check it out! 👇
🔗 https://github.com/kevin-mizu/domloggerpp
🔥7👍1
This media is not supported in your browser
VIEW IN TELEGRAM
How to manually check for CL.TE Request Smuggling Vulnerabilities:
1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked
0
G
5️⃣ Send request twice.
If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!
Try this out for yourself in our CL.TE lab: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked
0
G
5️⃣ Send request twice.
If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!
Try this out for yourself in our CL.TE lab: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
👏19❤8👍3🐳1
CVE-2025-7384: Critical PHP Object Injection in WordPress Plugin
A critical vulnerability has been found in the Database for Contact Form 7, WPForms, and Elementor forms WordPress plugin. Since this is a backend-only plugin, it is not directly detectable through standard search dorks. Supported frontend plugins could help determine the scope. However, only about 1% of hosts identified this way are actually vulnerable.
🔍 Netlas: https://nt.ls/Be3g6
ℹ️ Advisory: https://nt.ls/RoI8t
A critical vulnerability has been found in the Database for Contact Form 7, WPForms, and Elementor forms WordPress plugin. Since this is a backend-only plugin, it is not directly detectable through standard search dorks. Supported frontend plugins could help determine the scope. However, only about 1% of hosts identified this way are actually vulnerable.
🔍 Netlas: https://nt.ls/Be3g6
ℹ️ Advisory: https://nt.ls/RoI8t
😁5
🔥 Exclusive ZoomEye Offer for Brut Security Members
✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link.
📌 How it works:
✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96
✦ Get instant 5% discount on your purchase
💡 Perfect for bug bounty hunters, pentesters, and researchers who rely on fast, deep internet asset scanning.
#bugbounty #pentesting #osint #cybersecurity #tools
✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link.
📌 How it works:
✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96
✦ Get instant 5% discount on your purchase
💡 Perfect for bug bounty hunters, pentesters, and researchers who rely on fast, deep internet asset scanning.
#bugbounty #pentesting #osint #cybersecurity #tools
ZoomEye
Search Engine of Internet-Connected Devices. Create a Free Account to Get Started.
🔥3❤1
Brut Security pinned «🔥 Exclusive ZoomEye Offer for Brut Security Members ✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link. 📌 How it works: ✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96…»
Hey Hunter's,
DarkShadow here back again, just look at this...
IP Abuse Reports for 127.0.0.1
abuseipdb.com/check/127.0.0.1
DarkShadow here back again, just look at this...
IP Abuse Reports for 127.0.0.1
abuseipdb.com/check/127.0.0.1
😁6❤1🤝1🫡1