azot - Dogukan

[H4x0r.DZ @h4x0r_dz]

Keycloak is vulnerable to a critical unauthenticated account takeover (CVE-2026-18963)

I reproduced the bug locally; interesting one (power of LLM, I think)
https://t.co/hBuQe28aEm

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Quick and dirty way to find parameters vulnerable to LFI & Path Traversal & SSRF & Open Redirect:
Burp Search > Regex
\?.*=(\/\/?\w+|\w+\/|\w+(%3A|:)(\/|%2F)|%2F|[\.\w]+\.\w{2,4}[^\w])

And find potentially vulnerable SSRF params
- https://t.co/6cfBPVn0FM
#SSRF #cybersec

[HOW THINGS WORK @HowThingsWork_]

It surely can't be this simple! 🤔😂

[Science girl @sciencegirl]

Wisdom and technique
https://t.co/8M0q0epuCE

[Ezekiel @ezekiel_aleke]

SQL JOINs are like Set Theory:

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

🗺️Super Treasure Map Campaign🗺️

Take a screenshot during a battle of the #SuperTreasureMap and post it with the promo hashtag!

For every 100 posts, we will distribute 4 Special Rare Recruit (Sugo-Fest-Exclusive guaranteed), for a total of up to 12 Tickets!

#OPTC #ONEPIECE

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

🔥 Clashing! Burning! Super Battles! VS Super Sugo-Fest! Battle of Onigashima Celebration 🔥

Featuring Luffy VS Kaido.

Repost & Like this post 10,000 times (JP&GLB) to receive 50 Rainbow Gems ✨

Ends: August 12th 18:59 PST

#ONEPIECE #OPTC

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

Nami and Robin join the crew! 🎉

Clear the Straw Hat Pirates Sugo-Fest! Trial Quest and Share & Like this post to get these rewards!

5,000 times: Special Rare Recruit (Sugo-Fest-Exclusive guaranteed)
10,000 times: 20 Rainbow Gems✨

Ends July 1 18:59 PST

#ONEPIECE #OPTC

[Bipin Jitiya @win3zz]

CVE-2024-27348: Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph-Server. Upgrade to version 1.3.0 to mitigate.

[Mike Takahashi @TakSec]

Google Dork - Sensitive Docs 📄

ext:txt | ext:pdf | ext:xml | ext:xls | ext:xlsx | ext:ppt | ext:pptx | ext:doc | ext:docx
intext:“confidential” | intext:“Not for Public Release” | intext:”internal use only” | intext:“do not distribute”

Discover internal files 👀

[Min Choi @minchoi]

Llama 3 just changed the LLM game.

People are finding wild use cases at GPT-4 level. There is a massive movement in the open source community.

10 examples (and ways to use Llama 3):

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

Fearsome Foes! Sugo-Fest! Celebration! 🎉
Featuring Doflamingo & Sugar and Moria & Perona.

RP&Like this post 10,000 times (JP&GLB) to receive 20 Rainbow Gems and 10 Rainbow Rumble Scroll: Glory ✨

Ends March 26 18:59 PST

#ONEPIECE #OPTC

[dirty0124 @dirtycoder0124]

#BugBounty
I earned $1,125 for my submission on @bugcrowd https://t.co/Wa5nLzCe2c #ItTakesACrowd
Bug: Blind XSS
Steps:
1. Found Feedback form
2. Put HTML Inj. payload
3. Payload executed
4. Then put Bxss + Bhtml payload. Bhtml was executed but BXSS did not execute.
Cont...

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

The WORLD CRUISE has officially sailed!⛵️

Use the #OPTC_WorldCruise and #Your_Team (change "Your" with your chosen team) hashtags in the comments and recruit friends!

If we reach a total of 3,000 tweets, everyone gets useful items to use during the event 🎁

#ONEPIECE #OPTC

[Mohand Israiwi @IsrewyMohand]

Found SQL Injection in [org_id] Cookie
Payloads for Testing:
-1 OR 0=6 AND 0-0=> FALSE
-1 OR 6=6 AND 0-0=> TRUE

Injected in request like this
Cookie:organization_id=-1%20OR%200%3D6%20AND%200-0

#bugbountytip #bugbounty #SQL

[JS0N Haddix @Jhaddix]

httpx -tls-probe

vs

Cero (https://t.co/CFRV9YPqWe)

vs

httpx -> nuclei ssl-dns-names.yaml

for certificate parsing (see the previous post).

[ONE PIECE Treasure Cruise @ONE_PIECE_TC]

Worldwide Anniversary Fearsome Foes! Sugo-Fest! Blackbeard Celebration! 🎉
Featuring Blackbeard, Jesus Burgess, Catarina Devon, Vasco Shot, Doc Q and Van Ogre.

Repost & Like this post 10,000 times (JP&GLB) to receive 30 Rainbow Gems ✨

Ends Feb 25 18:59 PST

#ONEPIECE #OPTC

[H1 Disclosed - Public Disclosures @h1Disclosed]

⚡ CSP bypass on https://t.co/LL4tBvYg8F using Google script resources
👨🏻‍💻 @joaxcar ➟ PortSwigger Web Security
🟧 Medium
💰 $1,500
🔗 https://t.co/ybE4jzqAk6
#bugbounty #bugbountytips #cybersecurity #infosec

[Divyansh Sharma @divyansh2401]

1/ Yay, I was awarded a $2,000 bounty on @Hacker0x01! https://t.co/uWCJApjUKc #TogetherWeHitHarder #bugbountytips #bugbountytip #pentest #pentesting #CyberSecurity #appsec

How did I find this Zero Day? > 2/

[payloadartist @payloadartist]

⚙ Dorky

Came across a recon tool I made a few years back for generating Google dorks, and automatically open the dorks in new tabs.

https://t.co/czAunrZtoQ

1/n

#infosec #cybersecurity #bugbountytips #bugbounty