Amine

Opinions are my own. Appsec Pentester. OSCP, OSEP, OSWE and GCPN certified.

[Phith0n @phithon_xg]

Use Vulhub to reproduce Next.js Middleware Authorization Bypass (CVE-2025-29927)
https://t.co/JytCIYSx7C

First screenshot 👉 Unauthorized and direct to login page
Second screenshot 👉 Bypass

[Sergey Bobrov @Black2Fan]

I have published a tool based on jadx that helps analyze Java applications.

https://t.co/jVTKEM9fIc

BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations.
It also searches strings that look like URIs, paths, or secrets.

[Rich Warren @buffaloverflow]

Normalization strikes again 🎯

Delinea Secret Server Protocol Handler RCE:

https://t.co/vNZcopJhqj

By @johnnyspandex

[Amine @aminei_]

@RoDoddler Couldn't you make a parser that parses existing scripts and convert them to your format

[ʞʞıdɐɔoɥƆ @Chocapikk_]

Reproduced CVE-2024-8672: Authenticated RCE in Widget Options Plugin (WordPress).
PoC and details: https://t.co/ZVUOmqCQHU

[d4d @zakfedotkin]

You can bypass path-based WAF restrictions by appending raw/unencoded non-printable and extended-ASCII characters like \x09 (Spring), \xA0 (Express), and \x1C-1F (Flask):

[Dhiyaneshwaran @DhiyaneshDK]

🚀Detect Apache Solr Authentication Bypass
(CVE-2024-45216) with @pdnuclei

Template: https://t.co/0vO0wA7gja

Research by https://t.co/SwKLQBnnGW

#hackwithautomation #bugbounty #cybersecurity

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

CVE-2024-50550: Rare Case of Privilege Escalation Patched in LiteSpeed Cache Plugin
https://t.co/B3njOEvvc9

[The Bug Bounty Hunter @tbbhunter]

New crazy payloads in the URL Validation Bypass Cheat Sheet

https://t.co/vWr149Qmzo

@PortSwiggerRes

[Ambionics Security @ambionics]

At long last: Iconv, set the charset to RCE (part 3): in this final part of the iconv series, @cfreal_ demonstrates how you can use CVE-2024-2961 to convert BLIND file reads to RCE. https://t.co/NipFAehQXY

[PT SWARM @ptswarm]

🤠 A notorious RCE in Zimbra, CVE-2024-45519 – here’s our expert breakdown ⬇️

[Nicolas Krassas @Dinosn]

CVE-2024-8698: Keycloak Vulnerability Puts SAML Authentication at Risk https://t.co/u1CyxFYDpj

[Nicolas Krassas @Dinosn]

CVE-2024-8986 (CVSS 9.1): Critical Grafana Plugin SDK Flaw Exposes Sensitive Information https://t.co/R66oLGEya5

[Nuclei by ProjectDiscovery @pdnuclei]

Take your XSS detection to the next level with Nuclei’s headless mode! Detect script execution in real-time with JavaScript dialog handling—no complex matchers needed.

Learn more: https://t.co/PSM9Hn3iTt

#hackwithautomation #xss #headless #bugbounty #security

[Sean Wright @SeanWrightSec]

An interesting take, and while there are some elements I can see I don’t quite agree with it. It’s a really simplistic take and not so quite simple in reality. https://t.co/IBfRfDJ7j1

[Rebane @rebane2001]

new blogpost time!!

this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty

lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:

have fun!
https://t.co/64ZAIVHoSO

[Sean Pesce @SeanPesce]

Exploiting Android Client WebViews with Help from HSTS

https://t.co/3gP6pVV8rM

[Synacktiv @Synacktiv]

Have you ever wondered how your PC communicates with an Android device when using adb? Check out our new blogpost!
https://t.co/qSEct1kq6P

[Laluka@OffenSkill @TheLaluka]

New Release: bypass-url-parser==0.4.3 !

- Json mode & @orange_8361 new work added by @jtop_fap 🍊
- Regression & Install tests, packages, releases by @DugnyG & I ! 🌹

Happy scans! 😘

https://t.co/NRtfyzjrFm

[The Bug Bounty Hunter @tbbhunter]

How I Discovered an HTTP Request Smuggling Vulnerability in a Major Web Console

https://t.co/oCzipJqa87