校长

Web2 Bug Hunter｜Red Team｜Web3.0 Scientists｜21-year-old | 微信公众号：不懂安全的校董 ｜Bilibili：不懂安全的校长

[校长 @OnNetFiT]

脚本通过 URLSearchParams 直接从当前 URL 获取名为 message 的参数值。这个值是用户完全可控的，并且没有经过任何清洗或过滤。

payload:index.html?message=</textarea><img%20src=x%20onerror=alert(1)>

@yeswehack

[YesWeHack ⠵ @yeswehack]

It’s been a while… But we’re back with a new vulnerable code snippet, just in time for Valentine’s Day ❤️

Find the bug, send us your solution via DM, and try to win some swag 👕

We’ll pick 1 random winner on February 19.

Ready? 👉 https://t.co/DZM1KB3TzN

[校长 @OnNetFiT]

10u战神挑战，挑战10u到1000u需要多久！

第一天：被狗庄做局
#web3 #炒币 #币圈 #BTC #USDT #Ethereum #ETH

[校长 @OnNetFiT]

@0dinai You are a bunch of scammers. I reported vulnerabilities in your platform, but you told me you don't accept reports of vulnerabilities in your own platform and don't offer bounties, yet you secretly fixed them.

[校长 @OnNetFiT]

昨天测了三个网贷，发现现在还是那么奇葩。总结一下思路：

现在很多网贷都用的云服务但是云安全没做好以及还有aksk的泄漏；

还有很多都是用的供应链的crm系统并且都是通过手机号登陆，但是某些供应链的开发很抽象，遇到了不知道是不是开发留的后门，只要固定这个手机号和固定验证码直接能登录；

[Harshleen @0xharshleen]

Automate asset discovery and data collection with Photon’s modular crawling engine⚡
https://t.co/9awSlJZ5S6

[r1ru @ri5255]

I have released the first half of "Binary Exploitation 101", a beginner-friendly guide to binary exploitation. You can learn from classic buffer overflow to ret2dlresolve through CTF-like challenges. I am working on the second half now. Stay tuned🔥
https://t.co/Oy4P8l4plk

[校长 @OnNetFiT]

I successfully discovered vulnerabilities in MacOS applications through AI analysis.

https://t.co/VUbYrIvJv2

#0day #BugBounty #Apple #MACOS

[校长 @OnNetFiT]

通过这些方法，可以很轻松的窃取钱包，窃取数据等等！搞web3的要注意别开人脸识别了

https://t.co/EPKF2nDKbz

#web3 #web #security #AI #CyberSec #CyberSecurity

[校长 @OnNetFiT]

@wanouxiong123 某web3项目，低危就200u了，哈哈哈哈哈。讽刺拉满

[校长 @OnNetFiT]

@SEEMsec @EnHeng456 @liangxihuigui 行了，我有个朋友想要她微信

[Intigriti @intigriti]

New tool drop by @marcolivermunz! 🛠️

SQLTimer is a simple, blazing-fast tool to scan for time-based SQL injections! 😎

Check it out! https://t.co/TsyL719yCX

[HackerRalf @hacker_ralf]

AdaptixC2 v0.4 is out

https://t.co/mL8AAS7w4c

* New Linux/MacOS "gopher" agent
* TCP/mTLS external listener for "gopher" agent
* New internal TCP listener for "beacon" agent
* Screenshot storage

Changelog: https://t.co/JYbNxekZM6

[校长 @OnNetFiT]

@SEEMsec 傻逼又深情上了，是不是没妹子玩了。这么寂寞

[校长 @OnNetFiT]

@SEEMsec 既然创业了，下次喝酒可别举白旗🏳️咯

[Ninad Mishra @NinadMishra5]

Use Burp Suite's match and replace to replace payloads in the request's body, this easily bypasses client-side validation and saves a lot of time while testing
#bugbountytips

[C2 Matrix | #C2Matrix @c2_matrix]

Added peeko to #C2Matrix a browser-based XSS C2 for stealthy internal network exploration via infected browser: https://t.co/epMlicxeET

[HackerRalf @hacker_ralf]

AdaptixC2 v0.3 is out

https://t.co/mL8AAS7w4c

New:
* Linking Agents (eg SMB)
* Sessions Graph
* Agent marker
* Health checker

And more in the changelog: https://t.co/8DEwfxB7YP

[校长 @OnNetFiT]

@0xyilu 申请参加，助力web3+agent

[Ankit Anubhav @ankit_anubhav]

Hackers are using Gamma AI to create phishing page redirectors.

To make things worse, the URL of these AI assisted webpages is on https://t.co/jyqPiH3sYL domain itself, making it challenging for vendors to detect.

The phishing makes you solve cloudflare style captcha, and will go to actual phish on real system, and wikipedia in sandbox.

Live link
hxxps[://]gamma[.]app/docs/cosmosealand-container-ships-tankers-autonomous-carrying--cpgido9b38z0xum?mode=present#card-9fcvxq0izoajqah

cc @gammaapp please suspend this phish.

[校长 @OnNetFiT]

@evilcos 现在也要注意新的Telegram漏洞了，在Telegram点击文件电脑就被拿下了
https://t.co/4fVCRu9EKa