Sonu K

Co-Founder @ SpareRows | Project Management 💼 | Business Development 📊 | CyberSecurity Engineer 🛡️ | FullStack Developer 👨‍💻

[Sonu K @sonuwebguardian]

@telegram As a cybersecurity trainer, I teach risk reduction, not risk elimination. you mitigate risks, you don't ban life. By this logic, since cyber fraud exists, the Indian govt should ban the internet, smartphones, UPI, banking apps, and maybe electricity too. 0 risk, 0 progress. 🤡

[Sonu K @sonuwebguardian]

@telegram As a cybersecurity trainer, I teach risk reduction, not risk elimination. you mitigate risks, you don't ban life. By this logic, since cyber fraud exists, the Indian govt should ban the internet, smartphones, UPI, banking apps, and maybe electricity too. 0 risk, 0 progress. 🤡

[TheLiverDoc™ @theliverdoc]

News now: A young 'physician' in his early 40s working as medical officer at an Ayush Primary Health Center and an executive member of one of the leading Association of Homeopathy practitioners, developed infected diabetic ulcer related complications leading to progressive leg infection and sepsis with multiple organ injury. They took him to a proper hospital where, to control the source, they even chopped his infected leg. But it was too late and even that did not help and he eventually died of septic shock and multiple organ failure. He was on Homeopathic management himself, for diabetes. The Homeopathy community is shocked. The Medical science community is not.

[Sonu K @sonuwebguardian]

Ab mujhe samajh nahi aa rha hai ki m ek #cockroach hu ya fir 2 kaudi ka teacher..

#youtubeteachers #anjanaomkashyap #cjp #dokaudikateacher

[Sonu K @sonuwebguardian]

BJP: "Sabka Saath, Sabka Vikas."
Also BJP: "Except CJP." 🪳

🚨 CJP ALERT 🚨
BJP ka naya anti-CJP hathiyaar leak ho gaya hai. 😭💀

Democracy in danger. 🪳✊🏻

@abhijeet_dipke @Cockroachisback
@Cockroach4India
#CJP #CockroachJantaParty

[Sonu K @sonuwebguardian]

CJP isn't just another "trend" or a political party. It’s the voice of millions of educated, unemployed youth fed up with a corrupt system. You called them cockroaches for asking questions? Now they've formed a community. #CJP IS the people. 🪳✊
@abhijeet_dipke
@Cockroachisback

[Sonu K @sonuwebguardian]

@ParrotSec there's a parrot living inside my laptop, now who's gonna feed him 👾

[Dirstrike @dirstrike]

💥RCE FTW! Mass ATO via Path Traversal to RCE

A file upload feature allowed arbitrary file uploads. We uploaded an HTML file with an XSS payload, achieving stored XSS. Seeking more, we found a path with full-response SSRF and LFI, accessing basic /metric endpoints from a Prometheus instance. Though unimpactful, the LFI let us read source code and review file upload sanitization. We also read the PHP configuration file. Noticing .php files couldn’t execute PHP code, and with a second-order blind XSS already taking over accounts on the main page, we overwrote the .htaccess file to execute PHP code.

Read the blog for more—spoiler: we got RCE.

Updated on 10/03/2025: https://t.co/dpO1W0Zoqu

[Sardar @sardar0x1]

Bypass file upload on xiaomi With this method
.extentions./%00.png
Example :
.php.%00.png
#bugbounty
#bugbountytips
#bug
#CYBER

[Avalon Labs @avalonfinance_]

💸 Got #BinanceWallet ? This is for you!
We're having a $300,000 campaign with Binance Wallet @BinanceWallet in anticipation for #Avalon #TGE — INSIDER INFORMATION JUST LEAKED BELOW!
1. Open your Binance Wallet
2 .Swap minimum 10 USDT to USDa
3. Complete social media tasks for additional rewards
4. Total reward pool: worth of $300,000
🟡 Don’t just sit there - You are already pre-rich.
👉 < https://t.co/SSOK7pO1oW >
₿avalon/acc

[Creator.Bid @CreatorBid]

Binance Wallet X CreatorBid campaign is live! 🪂

8,000,000 $BID token rewards await in this special campaign (ONLY VIA MOBILE) with @BinanceWallet.

-> SWAP $AGENT
-> Become a member (lock tokens in Memberships)
-> Complete social tasks

Join the link below VA MOBILE to participate:

👉 https://t.co/5fJigKNhAk

[Plume @plumenetwork]

RWAfi made simple, convenient, and secure, all through @BinanceWallet, our first official mainnet wallet partner! 🔐

Starting now, complete all season 1️⃣ tasks of the Plume x Binance Wallet RWAfi Carnival for a chance to win a part of our $100K prize pool.

Here's how 👇

[Plume Foundation @plumefndn]

Today marks a milestone in Plume’s journey with the establishment of the Plume Foundation - an independent organization dedicated to the mission of bringing the real world onchain.

The Plume Foundation will manage the development and governance of the Plume RWA Chain and ecosystem - purpose-built to bring a trillion-dollar real-world asset market onchain, enabling Real World Asset Finance (RWAfi) for everyone.

The growing ecosystem of contributors unites builders, community members, asset issuers, private credit funds, custodians, and neobanks to create a full-stack solution for institutional-grade products accessible to anyone onchain.

The Foundation's immediate priority is establishing a robust governance model that empowers the community with true ownership and shared responsibility in advancing the Plume mission.

This is just the beginning.

[Listapie @Listapiexyz_io]

We’re excited to launch the @Listapiexyz_io x @BinanceWallet airdrop event, featuring a giveaway of 50,000 LTP tokens.🟡

10,000 lucky winners will share a total prize pool of 50,000 LTP. Be sure to complete all the tasks below and meet the eligibility requirements for a chance to win.⬇️

1⃣ Follow Listapie on X:
https://t.co/D6VjzkxxdA

2⃣ Repost the Binance Wallet Airdrop Announcement:
(RT this tweet)

3⃣ Repost the LTP Public Sale Announcement on Magpie's Launchpad:
https://t.co/nvqRXi7vsG

4⃣ Only Keyless Binance Wallet users are eligible.

▫️ Start Date: January 22, 2025, at 12:00 PM UTC
▫️ End Date: January 30, 2025, at 10:00 AM UTC

A total of 50,000 LTP tokens will be distributed to lucky winners and they can claim the rewards after campaign ends.✅

Don't miss this opportunity! Get a chance to receive an LTP airdrop and engage with Listapie.⛵️

Details:🔍
https://t.co/OzDCoy88Dw

[Listapie @Listapiexyz_io]

LTP Public Sale: The @Listapiexyz_io Dutch Auction is coming up on January 22, 2025, at 10:00 AM UTC via the @magpiexyz_io Launchpad.🔊

The LTP Dutch Auction will enable users to bid USDT for LTP, starting at a price that gradually decreases, ultimately settling on a unified purchase price for all participants.✅

As part of the LTP IDO, the event is set to run for up to 70 hours but may end sooner if the clearing price equals or exceeds the auction price.⏰

Bid USDT:⬇️
https://t.co/MgnBhDgkXA

Listapie has allocated 3% - 8% of the total LTP supply for the Dutch Auction.🧮

▫️ Starting Price: Each LTP is biddable at a price of 8 USDT
▫️ Minimum Price: Each LTP is biddable at a price of 1 USDT
▫️ Price Reduction: Linear decrease (0.10 / USDT drop per hour)

In Listapie's LTP Dutch Auction, the auction price will decrease over time toward the minimum, reflecting the real-time value. The clearing price is the final price at which all participants purchase tokens, calculated based on the ratio of total USDT bids to LTP. The auction will conclude when the clearing price matches the auction price, finalizing the price.✍️

The LTP Dutch Auction showcases Listapie's dedication to a fair and transparent token sale through a carefully structured and well-organized process.⛵️

Details:🔍
https://t.co/pOniOs7KAl

[Mayank Malik @_mostwanted002_]

Damn, that's a fancy SQLi payload. Working against almost everything.

/?query="OR 1=1;--"&amp;val1=ZGlkbnQgZXZlbiByZWFk&amp;val2=aHR0cHM6Ly95b3V0dS5iZS9kUXc0dzlXZ1hjUQ%3D%3D&amp;SLEEP(420)

[Hussein Daher @HusseiN98D]

Successfully bypassed a SSRF WAF by using a combination of IPV6 + Unicode. Payload for Metadata instances:
http://[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]:80
Check images for response difference between 169.254.169.254 and the above payload I shared 🔥

#bugbounty #infosec #waf

[BleepingComputer @BleepinComputer]

Critical Forminator plugin flaw impacts over 300k WordPress sites - @billtoulas
https://t.co/KBEnd1oZRl

https://t.co/KBEnd1oZRl

[Security BSides Ahmedabad @bsidesahmedabad]

𝗚𝗶𝘃𝗲𝗮𝘄𝗮𝘆 𝗔𝗹𝗲𝗿𝘁 📣📣

Hello Everyone,

@infosec_au has decided to giveaway 12 student passes.

Retweet this and let us know why would you want to attend Bsides Ahmedabad third edition. We will announce the lucky winners by Sunday, 21st August.

[Dr. Rohit Gautam @aslicyberguy]

Hello Everyone,
We are giving away 50 courses 🔥🎉💯😱

✅Rules: Follow 👇
@hacktifycs
@shifacyclewala
@HackerGautam
✅Apply : https://t.co/hbBSE3PD3m
✅Retweet

➡️ Results : 20 Oct 2021
#free #cybersecurity #educational #Giveaways #infosec #Course #bugbounty #infosec #security