❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🚨🚨 به زودی نت ملی میشه این کانالها را داشته باش 👇

Proxy :
https://t.me/+4-GLHdg6IpNkZWQ0

V2ray Config :
https://t.me/+E45B9TJB51wxYjQ8

Npv Spara :
https://t.me/+pZVOLjc9GHA1MmE0

⭕ OWASP Top 10 2025 Updates: Supply Chain, Secrets, And Misconfigurations Take Center Stage

🔖 Official page

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Secure Coding Practices OWASP Based #Checklist, 200+ Test Cases, 2025

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

📖 Cyber ​​Security books and sources
📚 @LibrarySecOfficial

💠 Blueteam sources:
⭕️ @BlueTeamKit

💠 Osint tools and courses:

⭕️ @OsintGit

💠 Cyber ​​Security Courses and Resources & Learn Bug bounty:

⭕ @BackupLso


💠 All Red Team resources are here!

⭕ @RedTeamVillageRtv


💠 To add to the message list:
🤖 @LibrarySecOfficialBot

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

امروز چهلمِ جاوید نام‌هاییه که تو اعتراضات دی‌ماه، جونشون رو تو راه آزادی و کرامت انسانی از دست دادن.

روحشون شاد و یادشون گرامی 🤍🕊


Today marks the fortieth day since the tragic loss of the brave souls who sacrificed their lives during the protests in December, fighting for freedom and human dignity in Iran.

May their spirits rest in peace, and may we always remember their courage and sacrifice. 🤍🕊

For Iran 🕊

pass: 311138

README (en+ru) inside, plz read it before run BS.

Happy Hacking! 🥳

Run with Java 18 or Java 22 with JDK21+

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 TIP: Automate Secret Hunting Like a Pro
Manual hunting is slow. Automation scales.

Instead of randomly browsing subdomains, pipe your recon properly:

subfinder -d target.com -silent | httpx -silent | gau | grep -Ei "\.env|config|backup"


What this really means is:

• subfinder → enumerate subdomains
• httpx → filter alive hosts
• gau → pull historical URLs
• grep → hunt for juicy patterns like .env, config, backup

You’re basically combining live assets + historical endpoints + pattern filtering in one clean chain.

This approach often reveals:

Exposed environment files
Backup endpoints
Forgotten config files
Hidden OpenID configurations
JS config leaks

Most hunters stop at subdomain enumeration. Smart hunters pivot into URL discovery and pattern extraction.

Automation doesn’t replace thinking. It multiplies it.

Test responsibly. Stay within scope. Move fast, think slow.

❤ Share & Support Us
🧩 #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 URILoot is a browser extension designed for Bug Bounty Hunters and Pentesters. Makes fetching uris easy from various sources.

https://github.com/rsingh0x/URILoot

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

✎ ASN → IP Recon Workflow (BGPView alternative)

I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo:

• as-ip-blocks: Github

It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation.

</> Bash Function for ASN → IP Enumeration

You can plug this directly into your recon pipeline or customize it for your tools

asn2ip() {
  local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as"

  fetch_asn() {
    curl -fsSL "$base/$1/aggregated.json" \
      | jq -r '.prefixes.ipv4[]?' 2>/dev/null \
      | sort -u
  }

  if [ ! -t 0 ]; then
    while IFS= read -r asn; do
      fetch_asn "$asn"
    done
  else
    fetch_asn "$1"
  fi
}

• Single ASN → IP Ranges

asn2ip 1234

• List of ASNs → IP Ranges

cat asnList | asn2ip

📰 @BackupLSO
📚 @LibrarySecOfficial

Sensitive Information Leak via api call
Severity: 9.1

From /api/contact an unauthenticated user can view all the private messages which only can show from Admin Panel.

tip:
always collect /api/ endpoints and try GET, POST etc methods.

if you guy’s really enjoy to read such methods, react ❤️

📰 @BackupLSO
📚 @LibrarySecOfficial

https://medium.com/p/ef4fbe28ceab

📰 @BackupLSO
📚 @LibrarySecOfficial

Hi everyone last week there was a wave of Telegram channel blocks in the OSINT community, and my second channel @osintgit was among those affected. Most channels have already been restored, but mine remains blocked. Please help forward the following message to Telegram support:

The @osintgit channel has been blocked. It contained links to articles, presentations from the author’s conference talks, and publicly available tools related to information security. The channel never published personal data or any other prohibited content. Please unblock this channel and remove the restrictions on.

Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.

Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport

Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.

And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org

I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.