Na7_Bora

A smile doctor 🎭

[Na7_Bora @Na7_bora]

@KenyaWest069 Hiyo kitu ata sioni nikiitumia tena . This dream world inanibamba kabisaaa

[Na7_Bora @Na7_bora]

@dekim_Kalvino Once you start having sex with this ladies hutajipata unafkuza hutu tuschana 26 and below .
There is no going back

[Na7_Bora @Na7_bora]

@Kotsocha_ke They charge the handling and storage fee.
They can't sell blood .
Huezi lipia hiyo na mkate na soda

[Bakhita Esther @bakhita_esther]

Kwa Ground Ruto is loved and appreciated.

[Klement 🌿 @KlementGemini]

In case you didn't know.

[Na7_Bora @Na7_bora]

@itsd3nnis @RealNate08 Its called quality sound. Lound music ni ya woofer

[Harman @itsharmanjot]

Holy sht.. Hackers are going to love this.

Someone open sourced an all-in-one hacking toolkit that bundles every major pentesting tool into a Single CLI menu.

You install it once and get instant access to tools across every category from anonymity, info gathering, wireless attacks, password cracking, web scanning, exploit frameworks, payload GENERATION, and more.

It's called HackingTool.

→ One menu launches Tor, Anonsurf, Macchanger, and proxy chains in seconds
→ Bundles Nmap, Dracnmap, RED HAWK, and ReconSpider for full network recon
→ Ships SQLMap, XSStrike, WPScan, and SecretFinder for web exploitation
→ Includes John the Ripper, Hashbuster, and BruteX for password attacks

51K stars. Runs on any Linux distro.

100% open source.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

CSRF is the bug everyone "knows" and almost nobody tests properly. Here's the do-this-today playbook:

1. Find the requests that change state. Change email, change password, add a user, transfer money, update settings. POST/PUT/DELETE. The ones that matter.

2. Look at what protects each one. CSRF token? SameSite cookie? Custom header? Origin/Referer check? Nothing but a session cookie = your bug.

3. Attack the token (this is where money lives):
- Delete the token param. Still works? CSRF.
- Swap in another user's token. Accepted? Not tied to session.
- Reuse an old token. Works forever? Same problem.
A token that exists but isn't validated is worth nothing.

4. Method swap. Change POST to GET. Still works? Fire it from an img tag. No form needed.

5. The Content-Type trick. "It's JSON, it's safe." No. Try text/plain or form-encoded. Browsers send those cross-site with no preflight, and tons of JSON endpoints accept them.

6. SameSite reality check. Lax (the default) blocks cross-site POST but ALLOWS top-level GET navigation. State change on a GET? Still exploitable.

7. Build the PoC. Auto-submitting HTML form. Victim lands on your page, their email silently changes, you own the password reset, full account takeover.

The trap: hunters report "missing CSRF token" and get closed as low. Don't. Chain it to one-click account takeover and it's high/critical. Always report on IMPACT.

What should I break down next?

[Intigriti @intigriti]

Exploiting SQL injections! 🤠

More in next post! 👇

[The Forge 🍿 @TheForgexx]

No spy series can beat this one… prove me wrong 🕵️🔥

[Intigriti @intigriti]

SQLi exploitation guide for beginners!

A thread! 🧵👇

[TheOuts1derX @TheOuts1derX]

WAF Bypass Cheat Sheet

Cloudflare, Akamai, AWS WAF, ModSecurity, Imperva, F5 BIG-IP, Sucuri, Wordfence, Azure WAF, FortiWeb, Barracuda

Detection tips + XSS, SQLi, RCE, SSRF and Path Traversal bypasses for each one

Full database with 150+ payloads inside Bug Bounty Center → https://t.co/iP2Vdar8Tk

Try it free for 30 days

#BugBounty #BugBountyTips #WAF #WebSec #AppSec #Cybersecurity

[Na7_Bora @Na7_bora]

@Mghazake My mzee alikua ananipea 600 every 6 days . Ilibidi nimefoma ndo ikajump to 1000 per week .
Hapa ilikua survival tupu

[Ivory ✪ @mide_io]

Don’t say anything. Just repost if you were there 😂

[Co11ateral @co11ateral]

Timeroasting can be used to extract user hashes and it's stealtier than DCSync or NTDS shadow copies. Defenders should start monitoring this activity.

Learn how: https://t.co/JmjJnDvZc3

@three_cube @_aircorridor @DI0256
#DFIR #BlueTeam #redteam

[Na7_Bora @Na7_bora]

@chris29ke Poison damu na dawa ya mende. Works like magic . Take 2 parkets only.

[Na7_Bora @Na7_bora]

@Kibet_bull Kwanza mzae ameeka hadi foag ya Israel kwa gari . Huyu anaona dust haamini Mungu wa Israel anakulishwa dust