MR404NTF

Linux Sysadmin | I can solve the mystery in Scooby-Doo before it is revealed! |

[KeepSec Technologies @keep_sec]

We have been nominated by @openinfradev for the Superuser Awards, vote for us with the link in replies!

[Trickest @trick3st]

Introducingggggg... 🥁

Generate thousands of URL path combos in seconds, perfect for generating brute force wordlists!

mkpath! This tool is similar to mksub, but it works for URL path combinations instead of subdomains.

https://t.co/HTmcA16jbS

[Stephan Berger @malmoeb]

1/ #Linux #Forensics: pssst... I will now reveal my favorite interview question for candidates who want to work in our IR team ;) "In the process list, I see a (running) binary, but the binary is no longer present on disc. How can I restore the original binary? (screenshot 👇)"

[JS0N Haddix @Jhaddix]

🧵Another hacker story thread! 🧵

== The Medical Alert Hack ==

Not too long ago I put a whole city on high alert during a security assessment. A tale of caution. 💀

Read along to learn my approach & mistakes!

🚨Retweet, follow, & like for more hacker stories! 🚨

1/x

👇🏼

[👑 OFJAAAH → ofjaaah.com @ofjaaah]

uncover -q 'org:"DoD Network Information Center"' | httpx -silent | nuclei -silent -severity low,medium,high,critical

#bugbounty #reputation #hackerone

[Het Mehta @hetmehtaa]

Awesome Basic Linux Privilege Escalation:
😎

https://t.co/nBv5AibMjU

#infosec #cybersecurity #cyber #bugbounty #tech #linux #dfir #hacking #code #redteam #thesecureedge

[Corben Leo @hacker_]

Hacking CAN be easy.

But, often it's not.

Let's develop your technical skills, they obviously matter.

A roadmap:

[Hussein Daher @HusseiN98D]

Recent Local File Read WAF bypass. Null byte %00 in between two dots .. ➡️ .%00./file.php

#bugbounty #bugbountytips #bugbountytip #infosec #pentest #waf #bypass

[Binni Shah @binitamshah]

nrich: a new tool to quickly find open ports and vulnerabilities via Shodan : https://t.co/220CYX3Mcn

[Chevy Phillip @chevonphillip]

Recent P1 bug I found:

1. App allowed admin to create GitHub profile with access token.
2. User is only allowed to call to external url based on admin config.
3. App uses graphql
4. Found endpoint to generate a user jwt
5. Used query to dump graphql data.

[/r/netsec @_r_netsec]

I made a tool to cover your tracks post-exploitation on Linux machines for Red Teamers https://t.co/98Vu5r03oY

[charan @0xcharan]

@ADITYASHENDE17 Use this python script loop in bash for scanning multiple domains https://t.co/YrA8mvxfKX

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

I am honestly impressed by the new reports @wallarm have been able to give #GoTestWaf in the new version!

Visually, I can see everything i need in 1 quick overview and I can zoom in ...

And apparently I need to up my security 👹👹
https://t.co/LnR1D8voRL

[Nagli @galnagli]

Expand your attack surface by grabbing SSL certificates from ip addresses, match these with your Bug Bounty targets.

I'd recommend running this technique on cloud providers such as AWS/Azure/GCP ranges

using https://t.co/uvvFVrKTXC

cero [CIDR] (cero 0.0.0.0/0)

#bugbountytips

[Kamil Vavra @vavkamil]

WordPress Plugin Update Confusion
https://t.co/KD5Ozloi9b

[PortSwigger Research @PortSwiggerRes]

The comprehensive list of today's emerging threats, nOtWASP bottom 10: vulnerabilities that make you cry by @albinowax, @artsploit and @garethheyes

https://t.co/ZrXcqHC2bM

[Alex Birsan @alxbrsn]

bypassing this WAF like

[Nicolas Krassas @Dinosn]

Remote Code Execution via Exif Data . https://t.co/Z2QW8mseID

[shubs @infosec_au]

The Assetnote security research team discovered a full-read SSRF vulnerability in Jamf Pro (post-authentication) a few months ago. https://t.co/mOaKcJHVUe (CVE-2021-39303 & CVE-2021-40809). Tracing sinks to sources is always a valid strategy.