Prawiro Dikromo

its time to #NFTs

#opensea

[Nicolas Krassas @Dinosn]

AI-Powered Penetration Testing with Metasploit https://t.co/e5Myp64fUT

[Prawiro Dikromo @rsaptanta]

@shodanhq Big thankyou...

☕️

[Coffin @lostsec_]

@GodfatherOrwa i added all top extension mostly used by bughunters in this article: https://t.co/FTH3F3zDtF

[Prawiro Dikromo @rsaptanta]

@Bugcrowd For testing some sensitive case, it's best to avoid using --batch to monitor every step.

[Prawiro Dikromo @rsaptanta]

@wgujjer11 CVE-2025-1661.

Relevant...

[Prawiro Dikromo @rsaptanta]

@intigriti Outdated or unpatched plugins and themes are dangerous...
critical... 🚩

[Prawiro Dikromo @rsaptanta]

@coffinxp7 Nice...

Using sed 's|https\?://||g' >finalsubs.txt to remove unnecessary http and https protocols FFUF and save with a new file.

[Prawiro Dikromo @rsaptanta]

@taha_marzak20 @696e746c6f6c configured your server to accept requests without a Content-Length header ...

[Prawiro Dikromo @rsaptanta]

@intigriti SQL injection :
SELECT * FROM posts WHERE title LIKE '{query}'"

XSS :
return render_template_string(f""" <h2>Results for query "{query}":</h2>
<p>{results}</p> """)

https://t.co/Wea4tLPMvL(debug=True) --> running on debug mode isn't recommended..

[Harshleen @0xharshleen]

Account takeover techniques👾

[Prawiro Dikromo @rsaptanta]

@h4x0r_dz You need to limit the query..
/api/users?limit=100&page=1

[Prawiro Dikromo @rsaptanta]

@S1r1u5_ this is confirmed by @Dinosn..

https://t.co/wfx97A988R

[Prawiro Dikromo @rsaptanta]

@hackthebox_eu .env file is accessible

fastcgi_param ENV_FILE $document_root/.env

This is critical security...

[Nicolas Krassas @Dinosn]

Intel Owl: analyze files, domains, IPs in multiple ways https://t.co/WALJGfdQPS

[Prawiro Dikromo @rsaptanta]

@yanzero_ Mitigasi jika Relayer gagal mengelola wallet voter gmna Mas ?

[Rithwik Jayasimha @thel3l]

Last month, a number sent me malware via an APK titled 'Union Bank Aadhar Update' on Whatsapp.

These typically just lamely forward all SMSes received to steal OTPs, but this one turned out to be a significantly more sophisticated op.

Some notes from taking down a scam network:

[Dark Web Informer @DarkWebInformer]

💡Search Engines for Pentesters

[Prawiro Dikromo @rsaptanta]

@0xGreed_ changeOwner function has two require statements...

modify the changeOwner function...

changeOwner(address newOwner)
owner = newOwner;

[Prawiro Dikromo @rsaptanta]

We can found a zero address vulnerability.

This may result in loss of tokens , security exploits or other.

constructor(address _stETHAddress, address _lidoContractAddress) { stETH = IERC20(_stETHAddress); lidoContractAddress = _lidoContractAddress; }

The vulnerability is that there's no check to ensure _stETHAddress or _lidoContractAddress aren't zero address (address(0))

[Prawiro Dikromo @rsaptanta]

@H4ckManac Still thinking about how they work in infecting users' computers via websites..

just changing the "inspection code" or indeed they can infect Windows via the website without any execution.