Brut Security – Telegram
Brut Security
14.6K subscribers
903 photos
72 videos
287 files
956 links
Queries: @wtf_brut
🛃WhatsApp: wa.link/brutsecurity
🈴Training: brutsec.com
📨E-mail: info@brutsec.com
Download Telegram
Schlix CMS 2.2.7-2 Arbitrary File Upload - POC ---> https://news.1rj.ru/str/brutsecurity_poc/41
3👍1
Please open Telegram to view this post
VIEW IN TELEGRAM
🤣40🔥1
👻👻👻Nuclei AI Prompts for @pdnuclei

Nuclei v3.3.9 (@pdiscoveryio) has -ai option to generate and run nuclei templates on the fly in natural language.

This is a list of prompts for this option:

- sensitive data exposure
- SQLi
- XSS
- SSRF

https://github.com/reewardius/Nuclei-AI-Prompts
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥34👍6🗿2
API Security Testing📝👾
👍21🔥4
Please open Telegram to view this post
VIEW IN TELEGRAM
🤣46👍6😢1🤨1
This media is not supported in your browser
VIEW IN TELEGRAM
👻👻👻SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers.

🔥🔥🔥Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.

Writeup-
https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/

POC-
https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥43👍72🤣1
Don't forget to react guys 👀👀
Please open Telegram to view this post
VIEW IN TELEGRAM
🤝25🤣7👍5😁2
CVE-2025-26465, -26466: Two vulnerabilities in OpenSSH, 6.8 rating❗️

MitM and DoS in OpenSSH. The severity level is medium, but the vulnerabilities cover many versions: from 2013 for -26465 and from 2023 for -26466.

Search at Netlas.io:
👉 Link: https://nt.ls/1TTrj
👉 Dork: ssh.server_key_exchange.client_to_server_compression:"zlib@openssh.com"

Read more: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
👍10🔥52😱1🤣1
👻👻👻Nuclei AI Prompts is a platform that offers a collection of ready-to-use security prompts for Nuclei. It helps penetration testers and security researchers speed up their work by providing prompts for common vulnerabilities like XSS, SQLi, RCE, and more. You can easily copy these prompts and use them in your security testing, and even contribute new ones to help grow the community.

🔥🔥🔥https://nucleiprompts.com
Please open Telegram to view this post
VIEW IN TELEGRAM
10😱12👍7🔥7
CVE-2025-23209: Code Injection in CraftCMS, 8.1 rating❗️

Craft CMS contains a code injection vulnerability that allows for remote code execution as vulnerable versions have compromised user security keys.

Search at Netlas.io:
👉 Link: https://nt.ls/brxoj
👉 Dork: http.headers.x_powered_by:"Craft CMS"

Vendor's advisory: https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
🔥4👍2😱1
🔖Extracting endpoints from JavaScript bookmarklets

⬇️Usage
🔴Add a new bookmark in your browser’s toolbar
🔴Replace the bookmark’s URL with the following JavaScript code:
javanoscript:(function(){var noscripts=document.getElementsByTagName("noscript"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0–9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<noscripts.length;i++){var t=noscripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();

🔴Visit the target page and click the bookmarklet. The noscript will run in your browser, revealing previously undiscovered endpoints right on the page.
Please open Telegram to view this post
VIEW IN TELEGRAM
10👍76🔥5🤝2
👻👻👻
Please open Telegram to view this post
VIEW IN TELEGRAM
🗿19🔥5🐳4
grep-backURLs - Automated way to extract juicy info with subfinder and waybackurls

https://github.com/gigachad80/grep-backURLs
1🔥12👍4
👻👻👻Search across a half million git repos in Grep website - grep.app
Please open Telegram to view this post
VIEW IN TELEGRAM
1🔥12👍4👨‍💻3
🔥🔥You Can Connect with me on LinkedIn- https://www.linkedin.com/in/mandal-saumadip
Please open Telegram to view this post
VIEW IN TELEGRAM
111😁5👍1
🛡Add this to your wordlist and you can ended up getting a CRITICAL
templates/processed/syslog-tcp-forward.conf

templates/processed/config.ini

Credit- Suyash Sharma
Please open Telegram to view this post
VIEW IN TELEGRAM
👍18🔥92
👻👻👻LazyHunter is an automated reconnaissance tool designed for bug hunters, leveraging Shodan's InternetDB and CVEDB APIs. It retrieves open ports, hostnames, tags, and vulnerabilities for a given IP and fetches CVE details, including affected products and CVSS scores. Results are color-coded by severity for easy analysis.

https://github.com/iamunixtz/Lazy-Hunter
Please open Telegram to view this post
VIEW IN TELEGRAM
👍17🔥83🗿1
👻uro 1.0.2 is now out

https://github.com/s0md3v/uro
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥10👍5
Need an extensive SQL injection cheat sheet for bug bounty hunting and pentesting in general? 🧐

Check out @0xTib3rius' SQL Injection cheat sheet, it provides payloads for the 5 most popular databases such as MySQL, PostgreSQL, Oracle, etc.! 😎

🔗 buff.ly/3WeSO5X
👏13👍6
This media is not supported in your browser
VIEW IN TELEGRAM
urlhunter: A recon tool that allows searching on URLs that are exposed via shortener services

Link:
https://github.com/utkusen/urlhunter
🔥18👍32🤝2