Joseph Nimsara

Infosec| Hackfluencer |⚫⚪
#EthicalHacker |Student ||

[Joseph Nimsara @StokKid]

1. How did you got into hacking
2. Who inspired you
3. Who helped you to become a hacker
4. Who is your favourite hacker
5. What is your best advice for beginners
**Extra : Pic of your pc setup **
#infosec #cybersecurity
@johnjhacking @JacksonHHax @RealOGAnonymous

[Smukx.E @5mukx]

Exploit Development 101

https://t.co/23Y2OpDNQ4

TLDR: learn and write exploits that target specific vulnerabilities.

[Dark Web Informer @DarkWebInformer]

CVE-2024-29269: Remote Code Execution PoC

Credit: https://t.co/14fEjccrks

[Sky Desperados @skydesperados]

1- Fuzzed a JS file, found some endpoints—only one responded.
2- Tried IDOR, no response. Added ', noticed an anomaly.
3- Sent a blind SQLi payload—got 504 & 1 min timeout.
4- Used time-based SQLi to verify—yes, it worked! But the timeout made exploitation hard.
5- Tried OOB to get RCE, but it didn’t work because the current user lacked permission.
6- SQLMap didn’t work at times, but Ghauri did! ghauri -r Request.txt --technique=T --time-sec=5. Use * in Request.txt for injection points (even tricky ones)

[Lu3ky13 ⚡️⚡️ @lu3ky13]

Sql Injection #Payload Add to your List

%6c%75%33%6b%79%31%33' AND 1=CAST((SELECT version()) AS int) --

#bugbountytips #bugbounty #hackerone #SqlInjection #sqli

[LetsDefend @LetsDefendIO]

OSI Layers and Attacks

[Alex Xu @alexxubyte]

The 9 Algorithms That Dominate Our World

[Coffin @lostsec_]

this extension is amazing find some thumbnails endpoint and just one directory back and access full database including sensitive api keys of stripe,paypal,youtube etc

[huntr @huntr_ai]

Ever explored HTTP request smuggling? 🕵️‍♂️
Our huntr @1nt3rc3pt0r discovered a vuln in Gunicorn where improper validation of the 'Transfer-Encoding' header leads to request smuggling. Can you spot similar issues in other HTTP servers? 👉 https://t.co/XrUScP4euA

[Mike Takahashi @TakSec]

ChatGPT - XSS Lab:

Having trouble learning some vulnerability class?

Just have ChatGPT make you a lab!

Details in thread 🧵👇

[Lu3ky13 ⚡️⚡️ @lu3ky13]

1/1
Bypass Authorization Login into the Admin panel

1 download appe.exe and install it for windows
2 capture requests i used fiddler
3 update your profile the app sends a request to the server via the admin account i don't know why

#bugbountytips #BugBounty

[🇷🇴 cristi @CristiVlad25]

5 Unusual Qualities That Will Make You a Pro at Pentesting:

1. Creativity
2. Persistence
3. Attention to detail
4. Adaptability
5. Communication skills

(thread)

[/r/redteamsec @r_redteamsec]

Bypass Windows Defender with Embedded Python - No Install Required https://t.co/awshWRD1mM #redteamsec

[Graham Helton (too much for zblock) @GrahamHelton3]

New phishing template just dropped

[0xblackbird @0xblackbird]

XSS bypass payload:
x"><svg%250donload%3D"window%5B%27alert%27%5D(location[%27hostname%27])"

Tip: Obfuscation almost always works to bypass WAFs (this target was behind Akamai WAF)

#bugbountytip #bugbounty

[Nicky @Nickieyey]

📌Docker Images for Penetration Testing & Security
• docker pull kalilinux/kali-linux-docker official Kali Linux
• docker pull owasp/zap2docker-stable - official OWASP ZAP
• docker pull wpscanteam/wpscan - official WPScan

🧵👇

#Pentesting #infosec #cybersecuritytips

[Lozaning @lozaning]

So far the wifydra has been working great out in the field!

Screen only looks all goobered in the video, irl it's totally fine.

[Kody @KodyKinzie]

I love when a hotel that charges for Wi-Fi also has a smart TV with ethernet plugged into the back that's way faster

[Joseph Nimsara @StokKid]

@0xsudip @Hacker0x01 Congrats man

[Joseph Nimsara @StokKid]

@_slasheur @tryhackme @hackthebox_eu @rootme_org @WebSecAcademy Congratulationssss 🎉