Delmar Yap

[Delmar Yap @delmar_yap]

@Diego_exits EDIT

[Delmar Yap @delmar_yap]

@0x_fokki Viral

[Delmar Yap @delmar_yap]

@underwoodxie96

[Delmar Yap @delmar_yap]

@theSebastianSM GROW

[Delmar Yap @delmar_yap]

@FacelessChems COURSE

[Mohammed Aldoub م.محمد الدوب @Voulnet]

Here's a command injection WAF bypass that works:

using empty shell variables, like ${something} and ${thisdoesntexist}.

example: cat /e${hahaha}tc/${heywaf}pas${catchthis}swd

It works, currently bypasses Cloudflare and probably others. I don't want a bounty.

Enjoy!

Proof:

[Delmar Yap @delmar_yap]

@riebisco Thanks @riebisco 😊

[Intigriti @intigriti]

Want to master 2FA bypassing? 🤑

Let's look at several possible ways to bypass this 2FA screen! 👇

[Simone Margaritelli @evilsocket]

bettercap can now read CAN frames from a candump log, replay them to the /dev/can interface, decode them with any given DBC definition (which includes OBD-II PIDs) and generate new ones from the DBC for fuzzing 🥷🚘🛻

[trish @TrisH0x2A]

🧵1/2 Socket Programming in C: Server-Side Basics

- Set up a server using socket(), bind(), and listen().
- Accept client connections with accept().
- Send and receive data over TCP.

Video 1: Server-Side in C!
Video 2: Client-Side Programming will be uploaded soon—stay tuned! 🖥️

[집돌이 @_silgen_name]

Apple Watch에서 Hermès Watch Face 활성화하기
- MobileGestalt fuKL2rMywRgQF1wowOA/cg (DeviceBrand) -> 0x1
- 또는 `-[CLKDevice _loadDeviceInfo]`의 <+2012>에서 w0에 0x1 기록

[Coffin @lostsec_]

you can also use Httpx for finding LFI use this command it will show you all lfi vulnerable urls on screen.

[Denis Laskov 🇮🇱 @it4sec]

Rooting an Android POS "Smart Terminal" to steal credit card information:✅

Paper "Exploring and Exploiting an Android 'Smart POS' Payment Terminal", by Jacopo Jannone.Paying with a POS will never feel the same for me.

PDF: https://t.co/mZqbgoZZyh
Video: https://t.co/V98uJ4MH0m

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚀 Simple ffuf bash one-liner helper
By @naglinagli

Here’s a useful bash function one-liner made by @naglinagli to sort out all your directory searching needs. Simply add this into your

~/.bashrc:
ffufr() {
ffuf -c -w "/path/to/SecLists/Discovery/Web-Content/\" -u "$2/FUZZ" -recursion
}

Also make sure you have the latest https://t.co/M2GrWlB9GU and the correct path in the function above.

Now you can perform recursive directory searching (dirbusting) of your target domain easily like this:

ffufr WORDLISTNAME.txt https://t.co/TVpmPEXl2W

Use this with any of the wordlist that is in the ‘SecLists/Discovery/Web-Content/’ directory. Here’s an example using the ‘tomcat.txt’ wordlist:

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[Moritz Kremb @moritzkremb]

Holy shit guys...

I think we've created a monster.

1. screenshot anything
2. generate prompt
3. paste into bolt
4. deploy a clone

comment 'waitlist' and I'll DM u

[Sam Curry @samwcyo]

New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate.

Full disclosure:
https://t.co/e2EwvUMgqw

[Lupin @0xLupin]

The article is out !

https://t.co/K5vo4M1Rap

Let me know what you think ;)

[Mohit Mishra @chessMan786]

https://t.co/Y1e4krsbUj

[Mobile Hacker @androidmalware2]

Frida Script Runner

Hook Android and iOS apps using default or your custom #Frida scripts conveniently from a browser
https://t.co/jgo3105xfT by @zenalarifin_

[Coffin @lostsec_]

Some famous country Electricity board govt official site payment system Bypassed by uri method https://t.co/x9BSUPtcYL