HackerOne – Telegram
HackerOne
@HackerOne
11K subscribers
644 photos
31 videos
79 files
2.74K links
Community : @Sec0x01
@Bug0x
Download Telegram
About
Blog
Apps
Platform
Join
HackerOne
11K subscribers
HackerOne
3.56K viewsAmir Kiani, 
HackerOne
https://blog.it-securityguard.com/how-i-made-more-than-30k-with-jolokia-cves/
3.01K viewsAmir Kiani, 
HackerOne
https://palant.info/2020/06/22/exploiting-bitdefender-antivirus-rce-from-any-website/
Almost Secure
Exploiting Bitdefender Antivirus: RCE from any website
A vulnerability in Bitdefender Antivirus allowed any website to run arbitrary code with user's privileges. This was caused by issues very similar to ones found in other antivirus products before.
6.15K viewsAmir Kiani, 
HackerOne
https://ahussam.me/Medium-full-account-takeover/
ahussam.me
Medium Full Account Takeover By One Click • Abdullah Hussam
Two days ago, I found a simple, limited XSS, so, I developed it to be a One-click full account takeover.
4.03K viewsAmir Kiani, 
HackerOne
https://www.youtube.com/watch?v=3K1-a7dnA60
YouTube
Burp Suite tutorial: IDOR vulnerability automation using Autorize and AutoRepeater (bug bounty)
Have you ever wondered how hackers find and exploit IDOR (Insecure Direct Object Reference)?
In this video STÖK get schooled by Fisher who shows him how to setup and hunt for IDORS using BURP Suite & plugins like Autorize and AutoRepeter.

Fisher:
https:…
3.73K viewsAmir, 
HackerOne
https://cointelegraph.com/news/justin-sun-offers-1-million-bounty-in-exchange-for-twitter-hackers
Cointelegraph
Justin Sun Offers $1 Million Bounty in Exchange for Twitter Hackers
Justin Sun has offered $1 million to the person who finds those responsible for the recent Twitter hacks.
3.42K viewsAmir Kiani, 
HackerOne
https://github.com/brandonskerritt/RustScan
GitHub
GitHub - RustScan/RustScan: 🤖 The Modern Port Scanner 🤖
🤖 The Modern Port Scanner 🤖. Contribute to RustScan/RustScan development by creating an account on GitHub.
2.76K viewsAmir Kiani, 
HackerOne
https://shivangx01b.github.io/2fa_bypass/
Shivangx01b
2FA Bypass | Shivangx01b
2fa bypass in a private program
3.17K viewsAmir Kiani, 
HackerOne
https://www.youtube.com/watch?v=4mMPpcpVqgA
YouTube
$1,000 django CSRF protection bypass - Hackerone
📧 Subscribe to BBRE Premium: https://bbre.dev/premium
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw


This time the vulnerability affected more than one website as the bugs were in django framework and in…
3.11K viewsAmir Kiani, 
HackerOne
https://twitter.com/PortSwiggerRes/status/1289143670273462272
Twitter
PortSwigger Research
Here's an updated polyglot that uses the details tag and now breaks out of template strings too. javanoscript:/*--></noscript></style></textarea></noscript></xmp><details/open/ontoggle='+/`/+/"/+/onmouseover=1/+/[*/[]/+alert(/@PortSwiggerRes/)//'>
2.94K viewsAmir Kiani, 
HackerOne
Forwarded from Ravro
راورو با همکاری "آکادمی راوین"
برگزار می‌کند:
پنج‌شنبه شب (۱۶ مرداد) از ساعت ۲۰، به صورت زنده و رایگان شکار آسیب‌پذیری توسط «امیرکیانی» را بر روی twitch تماشا کنید.

برای کسب اطلاعات بیشتر درباره‌ی پخش زنده‌ی شکار آسیب‌پذیری، کلیک کنید.

#باگ_بانتی #شکارچی #راورو #پخش_زنده
#BugBounty #BugHunter #Ravro

@Ravro_ir
3.28K viewsAmir Kiani, 
HackerOne
Iranian hacking group known as Fox Kitten (or Parisite) attacking F5 networking devices
https://ift.tt/3isKEAJ
Security Magazine
Iranian hacking group known as Fox Kitten (or Parisite) attacking F5 networking devices
A group of Iranian hackers have been attacking the US private and government sector, according to a security alert sent by the FBI last week.
2.88K viewsG0dfather, 
HackerOne
https://github.com/VoidSec/CVE-2020-1337
GitHub
GitHub - VoidSec/CVE-2020-1337: CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch
CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch - GitHub - VoidSec/CVE-2020-1337: CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch
2.25K viewsAmir Kiani, 
HackerOne
Attack of the week: Voice calls in LTE

https://blog.cryptographyengineering.com/2020/08/12/attack-of-the-week-voice-calls-in-lte/

https://revolte-attack.net

https://github.com/RUB-SysSec/mobile_sentinel

https://www.usenix.org/conference/usenixsecurity20/presentation/rupprecht
A Few Thoughts on Cryptographic Engineering
Attack of the week: Voice calls in LTE
I haven’t written an “attack of the week” post in a while, and it’s been bumming me out. This is not because there’s been a lack of attacks, but mostly because there h…
2.56K viewsG0dfather, 
HackerOne
https://blog.0xatul.me/posts/2020/02/external-xml-entity-via-file-upload-noscript/
2.16K viewsAmir Kiani, 
HackerOne
https://www.youtube.com/watch?v=URBnM6gGODo
YouTube
Mechanizing the Methodology: by Daniel Miessler
Mechanizing the Methodology : Automating Discovery, Testing, and Alerting using Recon/Testing Tools and Amazon SES

Daniel Miessler is a recognized cybersecurity expert and writer with 20 years in Information Security. His experience ranges from technical…
2.28K viewsAmir Kiani, 
HackerOne
Get all possible href | src | url from target url or domain

https://github.com/YashGoti/gal
GitHub
GitHub - YashGoti/gal: Get all possible href | src | url from target url or domain
Get all possible href | src | url from target url or domain - YashGoti/gal
2.14K viewsG0dfather, 
HackerOne
https://github.com/kimocoder/qualcomm_android_monitor_mode
GitHub
GitHub - kimocoder/qualcomm_android_monitor_mode: Qualcomm QCACLD WiFi monitor mode for Android
Qualcomm QCACLD WiFi monitor mode for Android. Contribute to kimocoder/qualcomm_android_monitor_mode development by creating an account on GitHub.
2.3K viewsMmD, 
HackerOne
GitHub - IoT-PTv/IoT-PT: A Virtual environment for Pentesting IoT Devices
https://github.com/IoT-PTv/IoT-PT
GitHub
GitHub - IoT-PTv/IoT-PT-v1: A Virtual environment for Pentesting IoT Devices
A Virtual environment for Pentesting IoT Devices. Contribute to IoT-PTv/IoT-PT-v1 development by creating an account on GitHub.
2.4K viewsG0dfather, 
HackerOne
The #FBI and #NSAGov have released a cybersecurity advisory about a malware known as Drovorub. Russia’s military intelligence unit created Drovorub to target customers who use Linux systems. http://ow.ly/s5uJ50AYHGk
www.fbi.gov
NSA and FBI Expose Russian Previously Undisclosed Malware Drovorub in Cybersecurity Advisory — FBI
The National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a new cybersecurity advisory about previously undisclosed Russian malware.
2.22K viewsG0dfather, 
HackerOne
Windows Debugger API — The End of Versioned Structures

Some time ago I was introduced to the Windows debugger API and found it incredibly useful for projects that focus on forensics or analysis of data on a machine. This API allows us to open a dump file taken on any windows machine and read information from it using the symbols that match the specific modules contained in the dump.

https://medium.com/swlh/windows-debugger-api-the-end-of-versioned-structures-ac4acaa351bd
#windows #internals #debug
Medium
Windows Debugger API — The End of Versioned Structures
Some time ago I was introduced to the Windows debugger API and found it incredibly useful for projects that focus on forensics or analysis…
2.3K viewsG0dfather,