Jordi Alba

Bug Bounty Hunter | Penetration tester ☢

[Jordi Alba @root_expert]

@d4rk_intel @osintnewsletter And another info from me about Protonmail:
https://t.co/dAcCMAZaGq (proton mail) (change 1 to i)

Give like this: info:1:1 pub:cc0322777176da3a4a4d9916e4f32c96c55663a4:1:2048:1527584191::

Go -> https://t.co/u5PpwzntHc give 1527584191

Result: 29.05.2018 8:56:31

[Jordi Alba @root_expert]

@d4rk_intel @osintnewsletter thanks fine article. But I think now problems
in osint around Tiktok account

[Abdulkadir | Cybersec @cyber__razz]

This video contains the main methodologies attackers use to hack Wordpress websites

[Dark Web Informer @DarkWebInformer]

RDP Stealer with Windows Defender Bypass

[D4rk_Intel @d4rk_intel]

How To Investigate A Telegram Channel, User, or Bot In 2026

Educational OSINT techniques for cybersecurity professionals and threat researchers.

Focus > Public channels, metadata extraction, and ethical investigation frameworks.

#OSINT #CyberSecurity #ThreatIntelligence

[Het Mehta @hetmehtaa]

Every 3rd website you visit runs Nginx.

18,959,833 of them can be hijacked right now.

A bug from 2008 just got a working exploit.

CVE-2026-42945 (CVSS 9.2)

No login. No access. Just one HTTP request.

→ Heap overflow → Worker process → RCE

Patch ASAP to Nginx 1.31.0 or 1.30.1

PoC is already out:
https://t.co/O4556KGjqD

[Copas @samu_etc]

"Copas, como você faz pra enviar o tráfego de uma aplicação desktop pro burp?"

Se você fica me fazendo essa pergunta todo dia, aqui tá sua resposta meu querido, um tutorial completo sobre como utilizar o Proxifier que é a ferramenta que eu uso para enviar o tráfego de uma aplicação desktop pro meu burp!

O processo é bem simples:
➞ Baixa o proxifier
➞ Configura o proxy server com os valores do vídeo
➞ Configura as regras e coloca o .exe da aplicação
➞ Abre o Burp e seja feliz

RT + Like pra me incentivar a continuar trazendo conteúdo bom pra vocês

[DarkShadow @darkshadow2bd]

🔥api restriction bypass using fake parameter☠️

/api/public => unauthorized
/api/public/latest?anything=/api/public => 200ok

you can FUZZ like:
?admin=true,
?bypass=1,
debug=true,
OR add header “X-Custom-IP-Authorization: 127.0.0.1”

Join my telegram https://t.co/J6uPf8H57o

[Jordi Alba @root_expert]

@mentorAIhere Guide

[Jordi Alba @root_expert]

@Fabrikat0r IDOR

[Security Trybe @SecurityTrybe]

😂

[Adam @adamdeziri]

Yay, I was awarded a $7,500 bounty on @intigriti
Here is a great resource made by @samwcyo :
https://t.co/4SNDz6aNBc
This has completely changed the way I approach a target since I read it !
#HackWithIntigriti

[Ali @111xNagashy]

Tip:-
How to get from 10k subdomains -> 350K...

1-Subdomainer
2-chaos
3-assetfinder
4-frogy

Explanation in comments ↓

#bugbountytips #bugbountytip #bugbounty #hackerone #bugcrowd #h1

[XSS Payloads @XssPayloads]

A payload without '>', html tag and limited to 35 chars to bypass filter by @avanish46

<svg onload="alert(1)" <="" svg=""

see thread for details: https://t.co/OV9FZNiG2N

[Cengaver @cengaver]

Dün Telegram üzerinden bana @Trendyol üzerinden işe alım yaptığını söyleyen klasik bir dolandırıcı yazdı.
Mesajıma resim etiketi ekleyerek mesaj gönderdim ve resmin yüklendiğini belirten bir ping aldım. Daha sonra mesajıma Blind XSS yükümü ekleyerek dolandırıcıların paneline erişim sağladım.

..🧵

[./Mr-Dark @Mr_Dark55]

XSSGen is a Python tool designed to generate random XSS (Cross-Site Scripting) payloads. The tool can create a variety of payloads with random HTML tags, JavaScript events, and JavaScript code snippets to help security testers identify vulnerabilities in web applications

[HotCakeX ✡︎ סג��ל @CyberCakeX]

Harden Windows Security v0.5.1 release

🦄Intune Admins, verify the effective Status of your policies and Perform Compliance Checks
🧩Premade Secure Categorized Intune Policies Available - Graph API
♾️Hybrid mode

#CyberSecurity #Windows #Cyber #Intune

https://t.co/lfd3SaE3lk

[Smukx.E @5mukx]

i just wrote an keylogger using GetRawInputData().
code: https://t.co/dxugnLn3us

#keylogger #rust #maldev #redteam

[N$🌟 @__nav1n_]

Advanced SQL Injection Techniques now available in GitBook. Make a copy/ Archive / Convert to PDF before they report this too :).

#bugbountytip #BugBounty #SQLInjection #SQLi

https://t.co/APxU4CULCt

[James Kettle @albinowax]

When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦‍♂️

Awesome work! Never under-estimate the crazy.