English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어
xelcezeri's profile picture.

🧢

@xelcezeri

782Posts 285Followers 1KFollowing
You might like
🧢 reposted
ngosytuanbug's profile picture.
ngosytuan
 @ngosytuanbug
Sep 16

Today i found a RCE in a bug bounty platform 1. found a bypass admin role with cve confluence 2. access and upload a plugin ( webshell) 3. turn on plugin in server and can run any system command HOPY THEY FAIR #BugBounty

ngosytuanbug's tweet image. Today i found a RCE in a bug bounty platform 1. found a bypass admin role with cve confluence 2. access and upload a plugin ( webshell) 3. turn on plugin in server and can run any system command HOPY THEY FAIR #BugBounty
7
14
168
44
10K
🧢 reposted
00xalr's profile picture.
Abdalkreem
 @00xalr
Sep 6

The new writup is here: Account Takeover via Insecure Email Change — Critical Vulnerability medium.com/@3bddagg3/acco… #bugbountytips #bugbounty #hackerone

00xalr's tweet card. Introduction.
🚨 Account Takeover via Insecure Email Change — Critical Vulnerability
Source: medium.com
5
22
208
156
12K
🧢 reposted
Zeno_h2r's profile picture.
Abdulrhman
 @Zeno_h2r
Sep 8

Through a simple path manipulation in the hostName parameter, I was able to escalate the issue into a One-Click Account Takeover medium.com/@Zeno_H2r/expl…

Zeno_h2r's tweet card. My name is Abdulrahman, I work as a bug hunter Full Time
Exploiting Open Redirect & XSS in Password Reset Flow
Source: medium.com
1
8
48
28
3K
🧢 reposted
SalhiMahdi72759's profile picture.
CaptinSHArky(Mahdi🇹🇳)
 @SalhiMahdi72759
Sep 9

Tip: When testing, try injecting a null byte (\u0000) into unexpected parameters. You never know how the backend will handle it — sometimes a small injection can completely break features like the invitation system. #BugBounty #bugbountytips #Hacking #Cybersecurity

SalhiMahdi72759's tweet image. Tip: When testing, try injecting a null byte (\u0000) into unexpected parameters. You never know how the backend will handle it — sometimes a small injection can completely break features like the invitation system. #BugBounty #bugbountytips #Hacking #Cybersecurity
5
37
249
176
12K
🧢 reposted
professor_xa1's profile picture.
Professor_xA1
 @professor_xa1
Sep 10

اللهم بارك بس انا عندي استفسار واتمنى ميتفهمش غلط ليه لما بشوف سيناريوهات زي دي بشوفها ساهلة ومع ان اغلب الحاجات دي بطبقها وانا بهانت بس عمرها ما جات لان استحالة حاجة زي دي تكون متسابة ودا بيخليني احس ان الناس دي البروجرامز بتاعتها غير بتاعتنا حرفيا بحسهم حاجة زي لابات بورتسويجر

00xalr's profile picture. 20 | Cybersecurity | Bug Bounty Hunter | Sharing vulns & tips 💥 | DM = 📥 https://t.co/m5VQqNq6SB , https://t.co/PgopMw9zNY
Abdalkreem
 @00xalr
Sep 9

wirtup new : medium.com/@0xalr/sensiti… #bugbountytips #bugbounty #hackerone

00xalr's tweet image. wirtup new : medium.com/@0xalr/sensiti… #bugbountytips #bugbounty #hackerone
6
14
170
110
10K
9
2
40
15
4K
🧢 reposted
adrielsec's profile picture.
elSec
 @adrielsec
Sep 10

hardcoded credentials in javascript file xxxxxxx/static/js/main.xxxxx.chunk.js 🗣️ dp #bugbounty #bugbountytips #bugbountytip

adrielsec's tweet image. hardcoded credentials in javascript file xxxxxxx/static/js/main.xxxxx.chunk.js 🗣️ dp #bugbounty #bugbountytips #bugbountytip
11
13
209
74
10K
🧢 reposted
jatav_ravi's profile picture.
Archer
 @jatav_ravi
Jul 21

$500 for Punycode email spoofing bug. Used comilav “m” to bypass email uniqueness check: >Register with [email protected] > Use same name as legit user > Invite real user to fake team Real user joins attacker’s team - gets locked out of real one #bugbountytips #BugBounty

jatav_ravi's tweet image. $500 for Punycode email spoofing bug. Used comilav “m” to bypass email uniqueness check: >Register with comilav831@lhory.com > Use same name as legit user > Invite real user to fake team Real user joins attacker’s team - gets locked out of real one #bugbountytips #BugBounty
11
13
174
123
12K
🧢 reposted
DailyDarkWeb's profile picture.
Dark Web Intelligence
@DailyDarkWeb
Sep 9

#CryptoSecurity 🚨 - A massive supply chain attack on the NPM registry has compromised popular packages with over 2 billion weekly downloads, aiming to steal cryptocurrency from users. dailydarkweb.net/major-npm-supp…

DailyDarkWeb's tweet image. #CryptoSecurity 🚨 - A massive supply chain attack on the NPM registry has compromised popular packages with over 2 billion weekly downloads, aiming to steal cryptocurrency from users. dailydarkweb.net/major-npm-supp…
1
6
21
4
4K
🧢 reposted
zoomeye_team's profile picture.
ZoomEye
@zoomeye_team
Sep 4

🔍Discover More Exposed LLM Servers with ZoomEye ZoomEye Dork👉app="Ollama" || app="vLLM UI" || app="LLaMA Board" || app="LLaMA Factory" || app="Chat LangChain" || app="AnythingLLM" || app="Chat LangChain" ZoomEye Link: zoomeye.ai/searchResult?q…

zoomeye_team's tweet image. 🔍Discover More Exposed LLM Servers with ZoomEye ZoomEye Dork👉app="Ollama" || app="vLLM UI" || app="LLaMA Board" || app="LLaMA Factory" || app="Chat LangChain" || app="AnythingLLM" || app="Chat LangChain" ZoomEye Link: zoomeye.ai/searchResult?q…
LukeSwitzer_'s profile picture. Infosec Person of the Purple Ether
Lμke Swi☨zer 🅅
 @LukeSwitzer_
Sep 3

Exposed LLM server queries for @shodanhq port:11434 "Ollama" port:8000 "vLLM" port:8000 "llama.cpp" port:8080 "llama.cpp" port:1234 "LM Studio" port:4891 "GPT4All" port:8000 "LangChain" blogs.cisco.com/security/detec…

LukeSwitzer_'s tweet card. We uncovered 1,100+ exposed Ollama LLM servers—20% with open models—revealing critical security gaps and the need for better LLM threat monitoring.
Detecting Exposed LLM Servers: A Shodan Case Study on Ollama
Source: blogs.cisco.com
4
100
468
386
34K
0
22
72
41
6K
🧢 reposted
viehgroup's profile picture.
VIEH Group
 @viehgroup
Sep 1

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
3
86
507
365
25K
🧢 reposted
zeyad_ashraf_'s profile picture.
Zuksh
 @zeyad_ashraf_
Sep 1

Alhamdulillah I got 3 RXSS duplicates on a public Bugcrowd program. Write-up: zuksh.medium.com/how-i-discover… #BugBounty #RXSS #XSS #InfoSec #Bugcrowd

zeyad_ashraf_'s tweet image. Alhamdulillah I got 3 RXSS duplicates on a public Bugcrowd program. Write-up: zuksh.medium.com/how-i-discover… #BugBounty #RXSS #XSS #InfoSec #Bugcrowd
1
1
79
29
5K
🧢 reposted
m359ah's profile picture.
Hossam A. Mesbah 🇵🇸
@m359ah
Sep 1

1. Register an account using [email protected] 2. Navigate to change email 3. Change it to [email protected] 4. Boom 💥 become the administrator and infrastructure takeover Rewarded $$$$$ #fuckbountytips

16
21
296
190
17K
🧢 reposted
medusa_0xf's profile picture.
Medusa
 @medusa_0xf
Sep 1

New Video Out 🔥 “AWS S3 Bucket Hacking Explained (Bug Bounty Hunters Must Watch)” youtu.be/_UlHLjIQeJM?si…

medusa_0xf's tweet image. New Video Out 🔥 “AWS S3 Bucket Hacking Explained (Bug Bounty Hunters Must Watch)” youtu.be/_UlHLjIQeJM?si…
4
72
588
472
31K

United States Trends

You might like

Something went wrong.


Something went wrong.