Abdo

🖤🌸black is beautiful

[مصطفى المومري @MustafaalMomry]

اعلان الجهاد في السودان

مقاطعة دولة الامارات الخبيثة

[T @Talhaa10_]

I love this club with everything, it’s been a massive part of my life.

But being a City fan doesn’t mean we stay quiet about human suffering. We can love our club and still speak up for what’s right.

Reports have have linked our owner, Sheikh Mansour, and the UAE government to supporting the RSF (the ones committing horrific crimes in Sudan)

Our club’s ownership is tied to people accused of helping fuel a genocide. That’s not “politics”, that’s basic humanity.

Being silent don’t help no one. We We can be proud of what happens on the pitch, but it means nothing if we turn away from what’s happening off it.

[𝐄𝐑 @ErlingRoIe]

It’s tough but you have to take a stance when stuff like this is bigger than football. I will not be buying merchandise from the club or attending games until there’s proof they don’t have their hands in this

[Abdo @abdomx66]

@ItsRahoomey اشرق النور على كل الدناا فمتى يغمر ارض الفاشر💔

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

Leaks and hidden services search engine

List of data leaks and Tor Hidden services search engines. Part of “Awesome Hackers Search Engines” Github repo.

https://t.co/aGw8PlvgVD

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

1) subfinder -d https://t.co/DAXb48PfCx -all -silent | httpx -silent -status-code -title -tech-detect -o alive.txt — enumerate subs and keep only live, fingerprinted targets to pivot hard.
2) ffuf -u https://t.co/7zoC5kaeTf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,204,301,302,403 -fs 0 -t 150 — smash hidden dirs fast and filter noise by status/size.
3) nuclei -l alive.txt -as -severity medium,high,critical -c 100 -rl 200 -o nuclei_hits.txt — shotgun high-signal templates at scale without melting the target.
4) gau --subs https://t.co/DAXb48PfCx | grep '=' | dalfox pipe -b https://t.co/oSEYIGS5MH -o xss.txt — rip param URLs from the web and auto-probe for reflected/blind XSS like a menace.
5) waybackurls https://t.co/DAXb48PfCx | gf ssrf | qsreplace https://t.co/oSEYIGS5MH | httpx -status-code -location -mc 200,302 — convert archives into SSRF bait and catch callbacks fast.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Top 50 practical bug bounty tips:

1. Read scope twice; hunt only where you’re allowed.
2. Map the attack surface: subs, apps, APIs, cloud, mobile.
3. Track asset changes daily; diff responses and JS.
4. Prioritize forgotten assets: dev, staging, beta, legacy.
5. Build target-specific wordlists from content and JS.
6. Automate recon, validate manually; trust but verify.
7. Check robots.txt, sitemap, CSP, headers for hidden paths.
8. Scrape JS for endpoints, secrets, and feature flags.
9. Watch TLS certs, DNS history, Wayback for new hosts.
10. Look for dangling DNS and subdomain takeover candidates.
11. Probe cloud storage: S3, GCS, Azure Blob permissions.
12. Enumerate parameters; try JSON, XML, GraphQL variations.
13. Find IDORs: change IDs, org IDs, foreign keys.
14. Test vertical access: role flips, admin-only actions.
15. Break auth flows: signup, SSO, OAuth, password reset.
16. Abuse OAuth: redirect_uri, scope escalation, PKCE gaps.
17. Inspect JWTs: alg confusion, kid injection, weak secrets.
18. Check session security: HttpOnly, Secure, SameSite, fixation.
19. Try MFA bypass: step-skips, backup codes, linking flows.
20. Validate CORS: wildcard with credentials, regex mistakes.
21. Hunt XSS across contexts: DOM, stored, email, PDFs.
22. Bypass filters: encoding, case, event handlers, srcdoc/iframe.
23. Hit SSRF: metadata endpoints, gopher, DNS exfil, redirects.
24. XXE in XML/office uploads; try external entities.
25. Try SSTI: template syntax in names, emails, PDFs.
26. Command injection: separators, OAST callbacks, blind channels.
27. SQLi/NoSQLi: JSON fields, GraphQL args, time-based.
28. Path traversal/zip slip in downloads, exports, backups.
29. File upload: MIME tricks, polyglots, EXIF, path smuggling.
30. Deserialization: signed objects, type hints, gadget chains.
31. Prototype pollution (client/server) leading to RCE/XSS.
32. Race conditions: coupons, balance transfers, inventory updates.
33. Cache poisoning: vary headers, Host, X-Forwarded-* mixups.
34. Host header injection: password reset, absolute URLs.
35. Open redirects: OAuth code leak, trust boundary breaks.
36. Webhooks: SSRF, signature verification, replay attacks.
37. GraphQL: introspection, auth per field, batching abuse.
38. gRPC/Protobuf APIs: fuzz methods, reflection, auth gaps.
39. Abuse HTTP verbs: PUT, PATCH, TRACE, method override.
40. Fuzz headers: X-Original-URL, X-Rewrite-URL, X-HTTP-Method.
41. WAF evasion: case/space tricks, chunked, nested encodings.
42. Mobile apps: decompile, bypass pinning, inspect hardcoded keys.
43. CI/CD leaks: env files, build logs, artifact registries.
44. Source control blunders: .git, .svn, backups, DS_Store.
45. Secrets everywhere: JS, source maps, robots, 1px images.
46. Monitor incidents/patches; retest quickly after fixes.
47. Chain lows into highs; think multi-step impact.
48. Report clearly: minimal PoC, reproduction, impact, remediation.
49. Keep meticulous notes; timebox; rotate targets to stay fresh.
50. Be respectful: low-noise testing, disclose responsibly, learn continuously.

[جمال جابر | JAMAL JABER @jamaljabir612]

♦️ #لا تعلموا أبناءكم كلمات بذيئة مثل قوي الحرية والتغيير والدعم السريع ، تقدم ، وتأسيس ،و مليونية ، وثورة ، ولا تذكروها امامهم إطلاقاً.

[MADANi @MadaniMohmed]

ورياح الجنة هبت فهنيئاً يا باغيها

[Ahmad Deen @AhmadKhalidDeen]

مابين فقيد وشهيد
خبران أحلاهما مر

ولا نقول إلا ما يرضي الله والحمد لله على كل حال

أخزى الله الشامتين والحاقدين والمستهزئين
وأخزى الله كل من يتبسم بيده أو بفؤاده لمثل هذه الأخبار
وأخزى الله من عادى المرابطين في السر والجهار
وأخزى الله من كان في قلبه مثقال ذرة من ميل للدعم أو قحت
أخزاهم الله في كل ليل ونهار

[Abdo @abdomx66]

@Shaymaa20000 شحده بالرقراق😂

[Abdo @abdomx66]

@Algsas2020 @Zica_m97 الشرك الاامن ياا اصحااا

[Abdo @abdomx66]

تَتَجَافَىٰ جُنُوبُهُمْ عَنِ الْمَضَاجِعِ يَدْعُونَ رَبَّهُمْ خَوْفًا وَطَمَعًا وَمِمَّا رَزَقْنَاهُمْ يُنفِقُونَ

[جذور للبناء الفكري و التأصيل @Guzor000]

https://t.co/jBX64zoczS

[Abdo @abdomx66]

@Guzor000 جنود الحق هاهنا☝️

[Abdo @abdomx66]

@Guzor000 نعيش هناك للابد♥️

[Abdo @abdomx66]

@Guzor000 هجرت النور ♥️

[Abdo @abdomx66]

@Guzor000 مسلموون☝️♥️