CYPHER | 🦅🛡️

🛡️ Cybersecurity Enthusiast

💻 Aspiring Pentester

📚 Learning • Building • Growing • Web Security

⚔️ Member of The Griffin Cabal

[CYPHER | 🦅🛡️ @Cypher_484]

SQLi UNION attack — retrieved data from another table and logged in as administrator. ✅
The payload:
' UNION SELECT NULL,'yB7TTZ',NULL--
First find the column that accepts strings. Then pull whatever you want from any table.
Databases talk too much when you know how to ask.👀

[The Hacker News @TheHackersNews]

🚨 That green "Verified" badge on a #GitHub commit? The hash under it isn't unique.

New research: anyone can rewrite a signed commit into many valid "Verified" hashes, no signing key needed.

Same files. Same author. Valid signature.

Learn how 'hash chain malleability' breaks commit trust - https://t.co/PhTFGJCtTQ

[CYPHER | 🦅🛡️ @Cypher_484]

@Prime_shell fact

[CYPHER | 🦅🛡️ @Cypher_484]

@Prime_shell amazing
still on the sqli learning, but i hope i get there

[CYPHER | 🦅🛡️ @Cypher_484]

Burp Suite taught me this better than any explanation could.
Intercepted a request, modified a value the browser was "controlling" —
Server accepted it without question.
The browser is in the user's hands. Never the developer's.
Backend validates. Frontend decorates.

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

One thing I learned recently:

Front-end security is not real security.

Users control the browser, meaning JavaScript and validations can be modified or bypassed easily. Real trust enforcement must happen on the back-end.

@_DeejustDee #cybersecurity

[CYPHER | 🦅🛡️ @Cypher_484]

@Prime_shell you'll make the next one
you deserve it man

[Pɍịmẹ̄ ⚡♟️ @Prime_shell]

OSINT (Open Source Intelligence) is the most underrated skill in cybersecurity.

Before any real penetration test, professionals gather publicly available information first.

You'd be shocked what's just sitting there on the internet about any company or person.

[CYPHER | 🦅🛡️ @Cypher_484]

@Gamingtronium • localhost — a hostname, resolved via DNS or /etc/hosts. Can point anywhere.
• 127.0.0.1 — the actual loopback IP. Always points to your machine.
Why it matters in security: SSRF filters that block "127.0.0.1" can sometimes be bypassed using "localhost" instead.

[Gamingtronium @Gamingtronium]

I still see many Developers still don't know the difference between:

Localhost vs. 127.0.0.1

[CYPHER | 🦅🛡️ @Cypher_484]

@termireum I've checked it out.
This is totally a good writing bro, I'm read deep into it and make good use of it

[Chess.com @chesscom]

Chess at school
Chess on plane
Chess at work
Chess on toilet
Chess in bed
Chess in dreams

And still 600 rated

[CYPHER | 🦅🛡️ @Cypher_484]

Solved my first SQLi lab on @pwncollege 🎉
Bypassed a login by injecting into the username field.
The server literally printed the query it was running in debug mode
WHERE username = 'admin' 1=1--
Always TRUE. Authentication dead.
#Cybersecurity

[7h3h4ckv157 @7h3h4ckv157]

Nice meme! ✨

[CYPHER | 🦅🛡️ @Cypher_484]

13/51 — SQLi UNION attack. ✅
UNION lets you attach a second query to the first — pulling data from tables it was never meant to expose.
One injection. Database spilling secrets.
@PortSwiggerAcademy 🔥 #Cybersecurity #sqlinjection

[CYPHER | 🦅🛡️ @Cypher_484]

@7h3h4ckv157 Time to to try out a new tool

[CYPHER | 🦅🛡️ @Cypher_484]

@__hemophile my boss

[CYPHER | 🦅🛡️ @Cypher_484]

Started learning SQL injection on @PortSwiggerAcademy today.
First thing that broke my brain a little:
Adding '-- to a URL can comment out the rest of a SQL query.
category=Gifts'--
One vulnerable input. The entire query logic rewritten.
This is just the beginning. 🔍

[CYPHER | 🦅🛡️ @Cypher_484]

Network Enumeration With Nmap Module CheatSheet
#cybersecurity #nmap

[Oge_chee @Ogechee_]

HTTP response codes