NEW BOT Телеграм, страница - 388598629

HackerOne

11K subscribers

644 photos

31 videos

79 files

2.74K links

Community : @Sec0x01
@Bug0x

Download Telegram

About

Blog

Apps

Platform

11K subscribers

Forwarded from Valeriy Shevchenko

https://medium.com/@valeriyshevchenko/from-crlf-to-account-takeover-a94d7aa0d74e?sk=54abf996cacadfe53113700a03181bb8

From CRLF to Account Takeover

At the beginning of March,while researching one site I discovered the new functionality. The functionality allowed the user to login via…

3.88K viewsAmir Kiani, 15:13

Forwarded from Bug Bounty (Amir Kiani)

https://medium.com/@imayankraheja/tampering-encrypted-parameter-to-account-takeover-a5fec7dde360

Tampering Encrypted Parameter to Account Takeover

Hola Infosec! Thanks for showing so much love to my previous story. Just like my last writup, today also I am going to share an…

661 viewsAmir Kiani, 22:16

callstranger.com

3.54K viewsAmir Kiani, 08:21

https://securitylab.github.com/research/apache-struts-CVE-2018-11776

GitHub Security Lab

CVE-2018-11776: How to find 5 RCEs in Apache Struts with CodeQL

Semmle security researcher Man Yue Mo explains how he used CodeQL’s Data Flow library to discover multiple RCE vulnerabilities (CVE-2018-11776) in Apache Struts.

3.19K viewsAmir Kiani, 11:00

https://medium.com/@muztahidultanim/how-i-was-able-to-buy-t-shirt-for-1-payment-price-manipulation-36b4d6a30034

How I was able to buy t-shirt for €1 — Payment Price Manipulation

Today I am gonna share a simple but critical vulnerability with you guys. This vulnerability called payment price manipulation, by using…

5.63K viewsAmir Kiani, 22:55

https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-part-ii-unauthenticated-memory-read-preparing-the-ground-for-an-rce/

Jamf Threat Labs | Blog

3.49K viewsAmir Kiani, 09:35

3.56K viewsAmir Kiani, 18:36

https://blog.it-securityguard.com/how-i-made-more-than-30k-with-jolokia-cves/

3.01K viewsAmir Kiani, 15:19

https://palant.info/2020/06/22/exploiting-bitdefender-antivirus-rce-from-any-website/

Exploiting Bitdefender Antivirus: RCE from any website

A vulnerability in Bitdefender Antivirus allowed any website to run arbitrary code with user's privileges. This was caused by issues very similar to ones found in other antivirus products before.

6.15K viewsAmir Kiani, 16:31

https://ahussam.me/Medium-full-account-takeover/

Medium Full Account Takeover By One Click • Abdullah Hussam

Two days ago, I found a simple, limited XSS, so, I developed it to be a One-click full account takeover.

4.03K viewsAmir Kiani, 18:26

https://www.youtube.com/watch?v=3K1-a7dnA60

Burp Suite tutorial: IDOR vulnerability automation using Autorize and AutoRepeater (bug bounty)

Have you ever wondered how hackers find and exploit IDOR (Insecure Direct Object Reference)?
In this video STÖK get schooled by Fisher who shows him how to setup and hunt for IDORS using BURP Suite & plugins like Autorize and AutoRepeter.

Fisher:
https:…

3.73K viewsAmir, 11:01

https://cointelegraph.com/news/justin-sun-offers-1-million-bounty-in-exchange-for-twitter-hackers

Justin Sun Offers $1 Million Bounty in Exchange for Twitter Hackers

Justin Sun has offered $1 million to the person who finds those responsible for the recent Twitter hacks.

3.42K viewsAmir Kiani, 10:45

https://github.com/brandonskerritt/RustScan

GitHub - RustScan/RustScan: 🤖 The Modern Port Scanner 🤖

🤖 The Modern Port Scanner 🤖. Contribute to RustScan/RustScan development by creating an account on GitHub.

2.76K viewsAmir Kiani, 16:53

https://shivangx01b.github.io/2fa_bypass/

2FA Bypass | Shivangx01b

2fa bypass in a private program

3.17K viewsAmir Kiani, 16:53

https://www.youtube.com/watch?v=4mMPpcpVqgA

$1,000 django CSRF protection bypass - Hackerone

📧 Subscribe to BBRE Premium: https://bbre.dev/premium
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw

This time the vulnerability affected more than one website as the bugs were in django framework and in…

3.11K viewsAmir Kiani, 09:07

https://twitter.com/PortSwiggerRes/status/1289143670273462272

PortSwigger Research

Here's an updated polyglot that uses the details tag and now breaks out of template strings too. javanoscript:/*--></noscript></style></textarea></noscript></xmp><details/open/ontoggle='+/`/+/"/+/onmouseover=1/+/[*/[]/+alert(/@PortSwiggerRes/)//'>

2.94K viewsAmir Kiani, 11:22

Forwarded from Ravro

راورو با همکاری "آکادمی راوین"
برگزار می‌کند:
پنج‌شنبه شب (۱۶ مرداد) از ساعت ۲۰، به صورت زنده و رایگان شکار آسیب‌پذیری توسط «امیرکیانی» را بر روی twitch تماشا کنید.

برای کسب اطلاعات بیشتر درباره‌ی پخش زنده‌ی شکار آسیب‌پذیری، کلیک کنید.

#باگ_بانتی #شکارچی #راورو #پخش_زنده
#BugBounty #BugHunter #Ravro

@Ravro_ir

3.28K viewsAmir Kiani, 18:49

Iranian hacking group known as Fox Kitten (or Parisite) attacking F5 networking devices
https://ift.tt/3isKEAJ

Security Magazine

Iranian hacking group known as Fox Kitten (or Parisite) attacking F5 networking devices

A group of Iranian hackers have been attacking the US private and government sector, according to a security alert sent by the FBI last week.

2.88K viewsG0dfather, 15:01

https://github.com/VoidSec/CVE-2020-1337

GitHub - VoidSec/CVE-2020-1337: CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch

CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch - GitHub - VoidSec/CVE-2020-1337: CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch

2.25K viewsAmir Kiani, 20:24

Attack of the week: Voice calls in LTE

https://blog.cryptographyengineering.com/2020/08/12/attack-of-the-week-voice-calls-in-lte/

https://revolte-attack.net

https://github.com/RUB-SysSec/mobile_sentinel

https://www.usenix.org/conference/usenixsecurity20/presentation/rupprecht

A Few Thoughts on Cryptographic Engineering

Attack of the week: Voice calls in LTE

I haven’t written an “attack of the week” post in a while, and it’s been bumming me out. This is not because there’s been a lack of attacks, but mostly because there h…

2.56K viewsG0dfather, 06:04

https://blog.0xatul.me/posts/2020/02/external-xml-entity-via-file-upload-noscript/

2.16K viewsAmir Kiani, 21:34