Mas™

S░A░L░A░M░S░A░T░U░J░I░W░A░

[Idris @7signxx]

Protect your children...

[Dark Web Informer @DarkWebInformer]

ZoomEye Dork: app="FortiWeb WAF"

[NullSecurityX @NullSecurityX]

Broken Authentication in Samsung Account Portal
Vulnerability Alert: Broken Authentication discovered on Samsung’s account portal (samsung(.)com).

📌 Attackers can access other users’ accounts without valid credentials.

🎥 PoC video:

#BugBounty #CyberSecurity #Samsung

[0b1d1 @_0b1d1]

🚨 Ever seen a “404 Not Found” or “500 Internal Server Error”? Let’s break them down.

Knowing what these HTTP status codes mean isn’t just for devs it’s key for hackers, sysadmins, and anyone who wants to understand how the web really works.⤵️

[0b1d1 @_0b1d1]

🕷️ OWASP Nettacker : Your Lightweight Automated Recon & Vuln Scanner 🔍

If you’re tired of bloated tools and slow scans. Nettacker is your open-source weapon for automated recon, vulnerability hunting, and ethical exploits straight from the OWASP forge 🧪⤵️

[Intigriti @intigriti]

Automating CORS vulnerabilities can sometimes be quite easy: 😎
1. Discover subdomains using OWASP Amass/Subfinder
2. Run list with Corsy: $ corsy -i ./targets.txt
3. Look for authenticated endpoints on the host that disclose sensitive data to craft a proof of concept

🔗 https://t.co/9BAMbM9nAC

[ghostlulz @ghostlulz1337]

🏴 Exploiting PDF Generators 🏴

If a web application can generate PDFs make sure you look for LFI and SSRF. Its an easy HIGH severity finding.

🧠 Learn more on my blog:
https://t.co/HCBIRjOmiW

#bugbountytip #bugbountytips #hackerone #bugcrowd #bugbounty #infosec #redteam

[Gospel @4osp3l]

JWT None Bypass → Auth Bypass

- Server accepts JWTs with alg: none
- Attacker crafts unsigned token with { "admin": true }
- No signature → still accepted
- Gained access to protected routes
- JWT misconfig = Full Auth bypass

[NullSecurityX @NullSecurityX]

🧠 File Upload → RCE
1️⃣ App accepts image uploads but lacks MIME/type validation
2️⃣ Attacker uploads shell.php with .jpg extension
3️⃣ Server stores file in web root
4️⃣ Accessing file triggers remote code execution
🎯 One upload = full server pwn
#bugbounty #rce #CyberSecurity

[Muqsit 𝕏 @mqst_]

📋 Detailed Checklist: Android APK Pentesting Checklist

Checklist: https://t.co/QoSljusi0g

#infosec

[MangGarux @mipteh_198]

Singkat cerita, kita sudah terbang dan sudah masuk sekitaran jambi. Ad penguman dr pilot, kalo pesawat mengalami trouble dan harus mendarat darurat di bandara jambi. Yup.... JAMBI. KITA SUDAH KENA DELAY BERKALI" DARI PAGI & TETIBA HARUS MENDARAT DARURAT??!! WAT DE HELL??

[Ndoro Kakung @ndorokakung]

Tiga serangkai: Sjahrir, Soekarno, Hatta.

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2025-24813:Flaw in Apache Tomcat Exposes Servers to RCE, Data Leaks
📊 10.7M+ Services are found on the https://t.co/g3tSyh1Boc yearly.
🔗Hunter Link:https://t.co/dmKLpDH0v8
👇Query
HUNTER : https://t.co/yFFcJwegJK="Apache Tomcat"
FOFA : product="APACHE-Tomcat"
SHODAN : product:"Apache Tomcat"
📰Refer:https://t.co/uvIqqZGZoi
https://t.co/NstPIlpgMh
#Tomcat#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[UK OSINT Community @OSINT_Community]

Telegram OSINT Tools | #OSINT Tips

These Telegram tools and bots streamline OSINT tasks—helping you uncover insights in public channels and groups. Some are Russian-owned, so research and assess any risks before using them.

✍️ This post was written by @AaronCTI, follow him for more OSINT insights.

❗Join the UK OSINT Community free: https://t.co/Vrl6nXLcRO

🌐 Telegram OSINT Tools

Telegago (@telegago)
🔗 https://t.co/RDhJo7JFxK
Specialised Google Custom Search Engine (CSE) for OSINT on public Telegram content. It lets you search open channels and groups without a Telegram account.

TelegramDB (@telegramdb)
🔗 https://t.co/avR9zXALC9
Search engine for Telegram channels, groups, bots, and user memberships. Its bot lets you filter results, resolve IDs, and export data through free or premium queries.

TGStat (@tgstat)
🔗 https://t.co/04glJic0u4
Telegram analytics platform tracking subscriber growth, reach, and citations, helping you analyse engagement and find related content.

Teleplus (@Adtargetin59974)
🔗 https://t.co/CqCTyxTPfL
TG Sender is a Chrome extension that scrapes Telegram group members and bulk-sends messages or invites, all locally without needing your password.

@Bellingcat (telegram-phone-number-checker)
🔗 https://t.co/oOUK7OO5Ac
Python script that checks if phone numbers are linked to Telegram accounts, retrieving usernames, names, and IDs.

🔜 Follow for more #OSINT tips and tools in future posts!

[Sardar @sardar0x1]

Bypass file upload on xiaomi With this method
.extentions./%00.png
Example :
.php.%00.png
#bugbounty
#bugbountytips
#bug
#CYBER

[Daniella Onyinyechi | AI Marketing @daniella_aibiz]

Day 3: OSINT Training – Creating a Fake Identity for Research

Today’s focus was on creating a realistic fake identity for OSINT investigations. Here’s what I did: