Brut Security – Telegram
Brut Security
14.6K subscribers
904 photos
72 videos
287 files
957 links
Queries: @wtf_brut
🛃WhatsApp: wa.link/brutsecurity
🈴Training: brutsec.com
📨E-mail: info@brutsec.com
Download Telegram
🔖Extracting endpoints from JavaScript bookmarklets

⬇️Usage
🔴Add a new bookmark in your browser’s toolbar
🔴Replace the bookmark’s URL with the following JavaScript code:
javanoscript:(function(){var noscripts=document.getElementsByTagName("noscript"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0–9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<noscripts.length;i++){var t=noscripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();

🔴Visit the target page and click the bookmarklet. The noscript will run in your browser, revealing previously undiscovered endpoints right on the page.
Please open Telegram to view this post
VIEW IN TELEGRAM
10👍76🔥5🤝2
👻👻👻
Please open Telegram to view this post
VIEW IN TELEGRAM
🗿19🔥5🐳4
grep-backURLs - Automated way to extract juicy info with subfinder and waybackurls

https://github.com/gigachad80/grep-backURLs
1🔥12👍4
👻👻👻Search across a half million git repos in Grep website - grep.app
Please open Telegram to view this post
VIEW IN TELEGRAM
1🔥12👍4👨‍💻3
🔥🔥You Can Connect with me on LinkedIn- https://www.linkedin.com/in/mandal-saumadip
Please open Telegram to view this post
VIEW IN TELEGRAM
111😁5👍1
🛡Add this to your wordlist and you can ended up getting a CRITICAL
templates/processed/syslog-tcp-forward.conf

templates/processed/config.ini

Credit- Suyash Sharma
Please open Telegram to view this post
VIEW IN TELEGRAM
👍18🔥92
👻👻👻LazyHunter is an automated reconnaissance tool designed for bug hunters, leveraging Shodan's InternetDB and CVEDB APIs. It retrieves open ports, hostnames, tags, and vulnerabilities for a given IP and fetches CVE details, including affected products and CVSS scores. Results are color-coded by severity for easy analysis.

https://github.com/iamunixtz/Lazy-Hunter
Please open Telegram to view this post
VIEW IN TELEGRAM
👍17🔥83🗿1
👻uro 1.0.2 is now out

https://github.com/s0md3v/uro
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥10👍5
Need an extensive SQL injection cheat sheet for bug bounty hunting and pentesting in general? 🧐

Check out @0xTib3rius' SQL Injection cheat sheet, it provides payloads for the 5 most popular databases such as MySQL, PostgreSQL, Oracle, etc.! 😎

🔗 buff.ly/3WeSO5X
👏13👍6
This media is not supported in your browser
VIEW IN TELEGRAM
urlhunter: A recon tool that allows searching on URLs that are exposed via shortener services

Link:
https://github.com/utkusen/urlhunter
🔥18👍32🤝2
CVE-2025-26794: SQL Injection in Exim 4.98, 7.5 rating❗️

A vulnerability in the Exim mail transfer agent could allow a remote attacker to perform SQL injection.

Search at Netlas.io:
👉 Link: https://nt.ls/ge4Iy
👉 Dork: smtp.banner:"Exim 4.98"

Vendor's advisory: https://www.exim.org/static/doc/security/CVE-2025-26794.txt
🔥35👍10🐳1
Don't forget to react guys 😢
🔥45👍7🗿4😁3🤣3
👻👻URL's Manipulation 4 Reconnaissance

🔥30 ways to gather information about the target domain just by adding different words to URL.

🛡https://osintteam.blog/urls-osint-bf5c9b087455
Please open Telegram to view this post
VIEW IN TELEGRAM
👍14🔥3🐳1🗿1
CVE-2025-1128: RCE in Everest Forms WordPress Plugin, 9.8 rating 🔥

The vulnerability allows an unauthenticated attacker to perform a wide range of actions with the site: upload arbitrary files, RCE, delete config files.

Search at Netlas.io:
👉 Link: https://nt.ls/q6pgJ
👉 Dork: http.body:"plugins/everest-forms"

Read more: https://www.wordfence.com/blog/2025/02/100000-wordpress-sites-affected-by-arbitrary-file-upload-read-and-deletion-vulnerability-in-everest-forms-wordpress-plugin/
🔥11👍1
👻👻👻Lenovo XSS via Unrestricted File Upload PoC---> https://news.1rj.ru/str/brutsecurity_poc/42
Please open Telegram to view this post
VIEW IN TELEGRAM
🗿3
👻👻 A search engine for CTF writeups
🛡https://ctfsearch.hackmap.win/
Please open Telegram to view this post
VIEW IN TELEGRAM
1028👍6
𝗚𝗮𝗺𝗲 𝗼𝗳 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆

👻👻GOAD is a pentest active directory LAB project. This lab aims to give pentesters a vulnerable AD environment ready to use to practice usual attack techniques.

🔥https://github.com/Orange-Cyberdefense/GOAD
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥17👍72
👻👻SpoofProof helps security professionals detect email domain spoofing vulnerabilities and validate DMARC, SPF, and DKIM configurations, making email security assessments seamless and efficient.

Extension Name: SpoofProof - Domain Spoofing Validation

🔗 BApp Store:
https://portswigger.net/bappstore/a321360c6e114b3dab6f2c67d68c241a
💻 Source Code:
https://github.com/portswigger/spoofproof
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥206👍4🤨2