Notes from "How to Crush Bug Bounties in the first 12 Months" by @hakluke
🔥16👨💻1🗿1
Guy's finally i made Linuxbomber.
A tool that exploit Linux environment and able to damage permanently any Linux OS even some case's it exploit hardware.
Let me know can i upload the tool in my GitHub?
Made just for educational purpose only
A tool that exploit Linux environment and able to damage permanently any Linux OS even some case's it exploit hardware.
Let me know can i upload the tool in my GitHub?
Made just for educational purpose only
🔥21😱5🙏4❤2😁2🤔1
One of my student in very 1st day of the Advanced Web Pentesing session, just performed a basic automation scan and got sensitive information disclosure.
✅If you want to enroll and learn from very beginner level then DM us on https://wa.link/brutsecurity
✅If you want to enroll and learn from very beginner level then DM us on https://wa.link/brutsecurity
👏4
🚨 CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability
🔥PoC :https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis
👇Dorks
HUNTER : https://product.name="Jenkins"
📰Refer:https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3419
https://github.com/advisories/GHSA-qcj2-99cg-mppf
🔥PoC :https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis
👇Dorks
HUNTER : https://product.name="Jenkins"
📰Refer:https://jenkins.io/security/advisory/2025-07-09/#SECURITY-3419
https://github.com/advisories/GHSA-qcj2-99cg-mppf
❤8
DomLoggerpp by @kevin_mizu is a simple web extension that helps you identify JavaScript DOM sinks that could lead to DOM-based vulnerabilities (such as XSS)! 😎
Check it out! 👇
🔗 https://github.com/kevin-mizu/domloggerpp
Check it out! 👇
🔗 https://github.com/kevin-mizu/domloggerpp
🔥7👍1
This media is not supported in your browser
VIEW IN TELEGRAM
How to manually check for CL.TE Request Smuggling Vulnerabilities:
1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked
0
G
5️⃣ Send request twice.
If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!
Try this out for yourself in our CL.TE lab: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked
0
G
5️⃣ Send request twice.
If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!
Try this out for yourself in our CL.TE lab: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
👏19❤8👍3🐳1
CVE-2025-7384: Critical PHP Object Injection in WordPress Plugin
A critical vulnerability has been found in the Database for Contact Form 7, WPForms, and Elementor forms WordPress plugin. Since this is a backend-only plugin, it is not directly detectable through standard search dorks. Supported frontend plugins could help determine the scope. However, only about 1% of hosts identified this way are actually vulnerable.
🔍 Netlas: https://nt.ls/Be3g6
ℹ️ Advisory: https://nt.ls/RoI8t
A critical vulnerability has been found in the Database for Contact Form 7, WPForms, and Elementor forms WordPress plugin. Since this is a backend-only plugin, it is not directly detectable through standard search dorks. Supported frontend plugins could help determine the scope. However, only about 1% of hosts identified this way are actually vulnerable.
🔍 Netlas: https://nt.ls/Be3g6
ℹ️ Advisory: https://nt.ls/RoI8t
😁5
🔥 Exclusive ZoomEye Offer for Brut Security Members
✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link.
📌 How it works:
✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96
✦ Get instant 5% discount on your purchase
💡 Perfect for bug bounty hunters, pentesters, and researchers who rely on fast, deep internet asset scanning.
#bugbounty #pentesting #osint #cybersecurity #tools
✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link.
📌 How it works:
✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96
✦ Get instant 5% discount on your purchase
💡 Perfect for bug bounty hunters, pentesters, and researchers who rely on fast, deep internet asset scanning.
#bugbounty #pentesting #osint #cybersecurity #tools
ZoomEye
Search Engine of Internet-Connected Devices. Create a Free Account to Get Started.
🔥3❤1
Brut Security pinned «🔥 Exclusive ZoomEye Offer for Brut Security Members ✅ZoomEye is giving Brut Security members 5% off any membership plan — monthly or yearly — through our special link. 📌 How it works: ✦ Click our link: https://www.zoomeye.ai/pricing?aff=INVITE-2SW2-FC96…»
Hey Hunter's,
DarkShadow here back again, just look at this...
IP Abuse Reports for 127.0.0.1
abuseipdb.com/check/127.0.0.1
DarkShadow here back again, just look at this...
IP Abuse Reports for 127.0.0.1
abuseipdb.com/check/127.0.0.1
😁6❤1🤝1🫡1
✅To detect Credit & Debit Card Number Leakage use this Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/miscellaneous/credit-card-number-detect.yaml
1👍9👏4❤1
Hey Hunter's,
DarkShadow here back again, just dropping a unique XSS method which execute in response header.
XSS in Facebook Response header💥
show your love Guy's ❤️🔥
#bugbountytips #xss
DarkShadow here back again, just dropping a unique XSS method which execute in response header.
XSS in Facebook Response header💥
Tip: Always check XSS in redirection parameters.
show your love Guy's ❤️🔥
#bugbountytips #xss
❤18🔥6👍5🗿3