sniss

🫥

[sniss @SNISS8]

@KenjiXsS_ @ninjaaexe @1Iucas @lilavonsuirs Caralho se garantiu

[sniss @SNISS8]

@0xPira Tomou doxx do g1

[sniss @SNISS8]

@ijdfkkk É a bugpay, uma brasileira

[sniss @SNISS8]

2 vulns que eu peguei caçando nessa plataforma nova, gostei dela ( não faço bug bounty, isso foi mais pq eu nao estava com muita coisa para fazer XD )

[sniss @SNISS8]

@metasploit https://t.co/rXfYOjz366

[sniss @SNISS8]

https://t.co/rXfYOjz366

[sniss @SNISS8]

@gkpacker @0xVasconcelos A preocupação do cara é tão grande de não ter o “nome dele atrelada essa parada” que ele publica no X e ainda cria uma caralhada de grupo para falar sobre o tal feito incrível dele

[sniss @SNISS8]

@bountywriteups There is no shell, just a regular RXSS

[Intigriti @intigriti]

Testing for postMessage vulnerabilities? 🤠

Your web console includes this useful breakpoint feature that allows you to intercept postMessage calls! Here's how:

1. Navigate to your target that uses postMessages
2. Open the Sources tab in your web console
3. Check the message property under Event Listener Breakpoints
4. Whenever a new postMessage call is received, you'll be able to fully inspect it, including the code!

More in next post! 👇

[sniss @SNISS8]

Normal oauth dirty dance would work

[Intigriti @intigriti]

how would you fetch the OAuth code? 🧐

[sniss @SNISS8]

@bbwriteups Is the CVE-2025-69516! Not the CVE-2025-69517

[BBWriteup @bbwriteup]

"CVE-2025-69517 — Critical Remote Code Execution, TacticalRMM" by Rony Das

#BugBounty #Cybersecurity #Hacking #InfoSec

https://t.co/R6yIzuz4XD

[sniss @SNISS8]

My 2 new CVES!!

https://t.co/uHCraWAffE

https://t.co/9lPt2z61I7

The first one allows RCE using SSTI and the second one is a html injection storage! Both on TacticalRMM

Thanks for my teammates: m0unt ( Ntgabriel) and 0xL1zard

[CVE @CVEnew]

CVE-2025-69516 A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier … https://t.co/TPbkUJCH7h

[CVE @CVEnew]

CVE-2025-45160 A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects th… https://t.co/AmfuGs3Vb0

[sniss @SNISS8]

@0ops_ctf @malta_ctf @r3kapig looking forward to the writeups xd

[sniss @SNISS8]

@_godiego__ @BugBountyBr @Bugcrowd Do you will share the slides??

[sniss @SNISS8]

https://t.co/55m90AbdzO

[sniss @SNISS8]

@felipepayao Pessoal disse q foi por causa de uma vuln no sisgcorp

[sniss @SNISS8]

@felipepayao

Alguma notícia de onde tá circulando o vazamento do CACs?