Blacksolo , Sp00f3dByt3

Security Researcher , Bughunter, Student.

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@zhero___ 🔥🔥🔥🔥

[ʞʞıdɐɔoɥƆ @Chocapikk_]

3 new CVEs published today:

CVE-2026-28515 - Missing Authorization
CVE-2026-28516 - SQL Injection
CVE-2026-28517 - OS Command Injection

Chained together: unauthenticated RCE on openDCIM Docker deployments.

https://t.co/yu3vq1jRzd
Exploit built on @VulnCheckAI's go-exploit: https://t.co/bWGEw3cyB8

[Ziad Salah @Zierax_x]

new tool: grafana scanner with 10 CVE checks from 2018-2025
made it cause existing ones give too many false positives.

https://t.co/l9K3DyJw27

#Pentesting #InfoSec #BugBounty #bugbountytips #Hacking #EthicalHacking

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

🚨 NEW TOOL: RegistryGuard Pro is live! 🛡️
Stop OCI/Docker supply-chain attacks before they start. 📂 Full Inventory Mapping 🏷️ Deep Tag Enumeration 💉 Image Poisoning PoC 📊 Pro JSON Reports
For the #BugBounty family. 💎 ⭐ https://t.co/n6n0Rdwz9h
#Infosec #Recon #Docker

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@Bugcrowd Idor

[X @TheMsterDoctor1]

# Default Credentials

1. Cisco
```
User: cisco
Password: cisco
```
2. Citrix
```
User: nsroot
Password: nsroot
```
3. Dell iDRAC
```
User: root
Password: calvin
```
4. Juniper
```
User: super
Password: juniper123
```
5. pfSense
```
User: admin
Password: pfsense
```
6. SAP
```
User: SAP*
Password: 06071992
```
7. Tomcat
```
User: tomcat
Password: tomcat
```
8. UniFi
```
User: ubnt
Password: ubnt
```
9. Weblogic
```
User: weblogic
Password: weblogic1
```
10. Zabbix
```
User: Admin
Password: zabbix
```
11. Windows
```
User: Administrator
Password: P@ssw0rd
```

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@Rhiachnash HOPE

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@Chocapikk_ @watchtowrcyber Yeah boy 😁

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@akramcodez Always linux

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

💥🔥🔥🔥🔥⚡💥

[ʞʞıdɐɔoɥƆ @Chocapikk_]

CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit

Unauthenticated to Root RCE:
- LFI via Content-Type confusion
- Read /proc/self/environ to find HOME
- Steal encryption key + database
- Forge admin JWT token
- Expression injection sandbox bypass
- RCE as root

CVSS 10.0

https://t.co/ztHv10BRLw

[ʞʞıdɐɔoɥƆ @Chocapikk_]

900+ WordPress plugins just casually leak their presence.
No bruteforce, no guessing, just a simple request. Wild.
Haven't seen anyone using this for recon yet. 🤔
Soon.

cc: @leak_ix

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

zimbramail-CVE-2025-68645-poc

https://t.co/jh0ylYqySN

[🇷🇴 cristi @CristiVlad25]

For heavy recon bug bounty hunters:
- if you go wide, connect the dots.

(Bálint Magyar, @bsidesbud)

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@hunter0x7 @Bugcrowd @Hacker0x01 Agreed 👍

[Ahsan Khan @hunter0x7]

@Bugcrowd @Hacker0x01

Why not hire people like who have seen the struggle of real hunting? Why not hire people who are working day/night for years, These people are Gems, They know what are the real problems and how to overcome them.

Hire bug hunters instead of Pentesters,
Hire talent instead of certs,
Hire those who would love to build the platform.

90% reports goes to N/A because Triagers (Pentesters) couldn't understand it.
5% goes to invalid priorities.
4% goes to no response.
1% goes to accepted because ur lucky that time.

There were times when triagers (Bug hunters) help hunters to exploit their submissions to escalate the priority (Bug hunters).

vs

We don't have time to check your report, Kindly create a video because it takes time to create a new user (Pentesters).

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@arth_bajpai 🔥🔥🔥🔥🔥

[Justin Gardner @Rhynorater]

We launched the Full-Time Hunters' Guild this week via the @ctbbpodcast community.

Accountability, collaboration, data, and support staff for full-time hunters (or part-time w/ 100k+/year).

Very excited to see how this boosts my BB performance in 2025.

https://t.co/pJbqatY1NB

[HackGit @hack_git]

Pyscan

Python dependency vulnerability scanner, written in Rust.

https://t.co/orQkFGM8we

#infosec #pentesting #redteam
https://t.co/enmbN7RxFq

[celesian @c3l3si4n]

In the past few months, I've been making a subdomains database containing 1.6 billion subdomains scrapped from multiple public (and private) sources.
This database is now public and FREE and can be queried on the following website.

https://t.co/C2cXn3sUOD

Enjoy!

[Blacksolo , Sp00f3dByt3 @MBlacksolo]

@techycodec08 @Rhynorater Congratulations brother. 🎉