k0er

[k0er @m1k0er]

@liuleineo @lidangzzz 尊重你妈也去跑一个，全校学生跟你说自愿了是吧，没脑玩意，叫上你全家也去传承一个呗

[Phith0n @phithon_xg]

try this WAF bypass trick for rsc&&next.js CVE-2025-55182
All fields can use utf16le charset
#React2Shell

[pyn3rd @pyn3rd]

#CVE-2025-55182: RSC RCE — Full Unicode encoding can bypass certain WAFs that lack proper decoding or normalization capabilities. Please verify this on your end.

[k0er @m1k0er]

@chain00x 这是什么平台，师傅

[k0er @m1k0er]

@tabaahi_ The link has expired, could you please send it again?

[k0er @m1k0er]

@changyou17 老哥，我手头有个你在挖的某超市xss，感觉危害不够，要不一起看看？

[k0er @m1k0er]

@0xSepix @Hacker0x01 hilton!

[雨苁-www.ddosi.org @gov_hack]

CVE-2024-48307 JeecgBoot 3.7.1 SQL注入
https://t.co/kGCNTv1exN

[Mohammad @m0hammad_y4ser]

1.
To exploit this, I developed a malicious Android application that was configured to intercept deep link requests for `scheme://login`.

[Medusa @medusa_0xf]

🍁In my latest YouTube video, Explore:
- Web cache poisoning
- Cache busters
- Cache hit
- Cache miss
- Cache keys
- Hunting Methodology

#infosec #hacking
https://t.co/vW55wiyrJP

[Sean Kahler @battledashdev]

Just published a new write-up - Hacking 700 Million Electronic Arts Accounts https://t.co/onGdypFxjp

[k0er @m1k0er]

@winteri3coming I found a hardcoded error in a js file of a program, but I can't exploit it. I don't know how to exploit it. Can I write a report to hackerone?

[winteri3coming @winteri3coming]

Last tip of 2023:
Often when you gather URLs of a target you find some google spreadsheet links that return 404, just copy the file KEY and change the link:
spreadsheets*google*com/feeds/list/KEY -> 404
docs*google*com/spreadsheets/u/0/d/KEY/pub -> 200
#bugbountytips #bugbounty

[Cybernetic Research @cybernetic_res]

Add /api/.env to the wordlist, and maybe you will have access to dotenv file environment that leads to exposing SMTP credentials and AWS access key , secret key

Credits : @NoRed0x

#bugbountytips #bugbountytip #cybersecurity #ethicalhacking

[Hunter @HunterMapping]

🚨Alert🚨CVE-2024-4984: XSS on Yoast SEO plugin for WordPress
⚠Any user input inside sprintf() function is vulnerable to XSS, and there is a lot, even the WordPress core itself
📰Refer:https://t.co/KaCumuiXsK
📰GitHub Advisory: https://t.co/dH2y27QvRD
👇👇👇Hunter is currently under maintenance. You can search on FOFA or SHODAN using the following search syntax.
Hunter:/web.body="wordpress/plugins/seo"
FOFA:app="yoast-SEO-Plugin"
SHODAN:http.html:"wordpress/plugins/seo"
#WordPress #XSS #infosec #infosecurity #Infosys #Vulnerability

[Intigriti @intigriti]

You came across this unusual API endpoint on one of your targets after you spent a lot of time in recon 😎

What are your next steps in trying to find a vulnerability? 🤔

[陈广 @chain00x]

好人 太棒了 这个视频

[Will Gates @WllGates]

Bypass open redirection whitelisted using chinese dots: 👀🔓🔍

%E3%80%82

Tip: Keep eyes on SSO redirects 😉🔀

credit: @adrielsec

#bugbounty #bugbountytips

[Abu Maryam Rahmat @abumaryamrahmat]

Biidznillah, I was awarded a $2,500 bounty on @Hacker0x01

1. Type "amr" in the search feature
2. GET /user/api/search?keywords=amr&q=keywords
3. Change to
4. GET /user/api/[email protected]&q=email

Sensitive information about the victim was disclosed

#bugbountytips

[Cybernetic Research @cybernetic_res]

Top 5 places to look for SSRF vulnerabilities: 😎

• Profile image loaders
• External file or data processors (like webhooks)
• PDF Generators (through HTML Injection)
• Host header injections
• File uploads (via XML for example)

By:@intigriti

#bugbountytips #bugbounty