๐ Open-sourced DVAP (Damn Vulnerable AI Platform)
What if DVWA existed for AI Security?
Learn and test Prompt Injection, RAG Poisoning, MCP Security, Agent Attacks, and AI Red Teaming in a safe local environment.
โญ https://t.co/EQ6kx8T4SO
#OWASP#AISecurity#LLMSecurity
Reported a path traversal in CycloneDX Tool Center caused by untrusted filename handling.
Not production. Not complex.
Still impactful.
๐ Validate & normalize paths
๐ Internal tools are attack surface
๐ โNon-productionโ โ low risk
#DevSecOPs#SBOM
https://t.co/vwVZ0RCG26
You donโt need 20 tabs for recon. You just need a pipe.
Hereโs the one-liner ๐
subfinder โ httpx โ gau โ grep
Turn passive recon into real findings.
New Lines in my repo ! ๐โโฌ
Happy New Year ๐๐
#bugbounty#bugbountytips#recon
๐ My trainings [https://t.co/XCQco1Uimq]
Over 400 recon content pieces, with my tools and tricks!
Live hunting using bookmark:
>>JS Links
>>Params
>>Subdomain Only
>>Path Relative
>>Path Absolute
#recon#EthicalHacking#BugBounty#jsrecon
tell me any better XSS methodology than this ๐
Explanation:
This oneliner command starts by collecting all URLs from passive sources using gau tool, then filters them for potential XSS parameters using gf patterns. Next, httpx and grep are used to keep only URLs that return specific content types commonly involved in XSS testing. After that, Gxss identifies all reflected parameter URLs. Finally, kxss will filters out URLs where special characters remain unfiltered. prime targets for XSS execution.
Once its done, you can proceed with manual XSS testing or use your preferred automated exploitation tool.
โ๏ธ REcollapse Technique: Fuzzing the web to bypass validations and discover normalizations in web applications
Blog: https://t.co/Ps8zVgrMop
author: @0xacb