🔥 WORDGEN - Backup File Discovery Tool | Complete Guide 🔥

📹 New Video Alert from The Exploit Lab!

Master the art of finding hidden backup files during bug bounty hunting with Wordgen - a powerful Go-based wordlist generator.

🎯 What You'll Learn:
- Complete installation methods
- Command breakdowns & usage
- Real-world bug bounty integration
- Automation scripts

━━━━━━━━━━━━━━━━━━━━

📦 INSTALLATION METHODS:

Method 1: Go Install (Recommended)
go install github.com/rix4uni/wordgen@latest

Method 2: Prebuilt Binary
wget https://github.com/rix4uni/wordgen/releases/download/v0.0.2/wordgen-linux-amd64-0.0.2.tgz
tar -xvzf wordgen-linux-amd64-0.0.2.tgz
rm -rf wordgen-linux-amd64-0.0.2.tgz
mv wordgen ~/go/bin/wordgen

Method 3: Compile from Source
git clone --depth 1 https://github.com/rix4uni/wordgen.git
cd wordgen
go install

━━━━━━━━━━━━━━━━━━━━

🛠 BASIC USAGE:

Single URL without extensions:
echo "http://testphp.vulnweb.com" | wordgen -path "github, admin"

Single URL with extensions:
echo "http://testphp.vulnweb.com" | wordgen -path "github, admin" -e ".zip, .php"

Multiple URLs from file:
cat subs.txt | wordgen -path wordlist.txt

Multiple URLs with extensions:
cat subs.txt | wordgen -path wordlist.txt -e ".zip, .tar.gz, .sql, .bak"

━━━━━━━━━━━━━━━━━━━━

🚀 ADVANCED INTEGRATION:

With httpx for live probing:
cat subs.txt | wordgen -path wordlist.txt -e ".zip, .sql" | httpx -mc 200,301,302 -silent

With ffuf for fuzzing:
cat subs.txt | wordgen -path wordlist.txt -e ".bak" -silent | ffuf -w - -u FUZZ -mc 200,401,403

━━━━━━━━━━━━━━━━━━━━

📝 CREATE CUSTOM WORDLISTS:

Basic backup wordlist:
cat > wordlist.txt << EOF
backup
admin
config
database
old
git
EOF

Date-based wordlist:
echo "backup-$(date +%Y)
old-$(date +%Y-%m)
archive-$(date +%Y%m%d)" > dates.txt

━━━━━━━━━━━━━━━━━━━━

🔧 COMMAND FLAGS:

-path → Paths to test (comma-separated or file)
-e → File extensions (comma-separated)
-silent → Silent mode (no banner)
-version → Show version

━━━━━━━━━━━━━━━━━━━━

💡 COMMON EXTENSIONS TO TEST:

.zip .tar .tar.gz .tgz .rar
.bak .old .backup .tmp .save
.sql .sql.gz .db .sqlite .dump
.env .git .conf .config .xml
.json .log .swp .swo ~

━━━━━━━━━━━━━━━━━━━━

🤖 AUTOMATION SCRIPT:

#!/bin/bash
# Backup Hunter Script

DOMAINS=$1
OUTPUT="backup-scan-$(date +%Y%m%d)"
mkdir -p $OUTPUT

cat $DOMAINS | wordgen -path wordlist.txt \
-e ".zip,.sql,.bak" -silent > $OUTPUT/urls.txt

cat $OUTPUT/urls.txt | httpx -mc 200,403 \
-silent -o $OUTPUT/live.txt

echo "Found $(wc -l < $OUTPUT/live.txt) endpoints"

Usage:
chmod +x backup-hunter.sh
./backup-hunter.sh domains.txt

━━━━━━━━━━━━━━━━━━━━

🎓 BUG BOUNTY TIPS:

✅ Customize wordlists per target
✅ Use company GitHub for intel
✅ Analyze found files thoroughly
✅ Chain with other recon tools
✅ Always respect program scope

━━━━━━━━━━━━━━━━━━━━

🔗 RESOURCES:

Tool Repository:
https://github.com/rix4uni/wordgen

📺 Watch Full Tutorial:
[https://youtu.be/QkZdhlHZmYY]

🔔 Subscribe to The Exploit Lab for more!

━━━━━━━━━━━━━━━━━━━━

⚠️ Legal Disclaimer:
Educational purposes only. Always obtain proper authorization before testing. Respect bug bounty program rules and scope.

#BugBounty #Wordgen #KaliLinux #Pentesting #BugBountyTips #EthicalHacking #WebSecurity #InfoSec #TheExploitLab #Recon

⚠️🚨 Security Advisory — CVE-2025-29927 🚨⚠️

🔍 Researchers have released a Proof-of-Concept (PoC) showing an authorization-bypass weakness in Next.js middleware.
🛡 This PoC is for defensive testing and validation only.
❗️ Unauthorized exploitation is illegal and unethical.

🔗 PoC (research purposes only):
github.com/websecnl/CVE-2025-29927-PoC-Exploit

🔥 Patch Immediately:
• 🔄 13.x → 13.5.9+
• 🔄 14.x → 14.2.25+
• 🔄 15.x → 15.2.3+

🛠 Mitigations:
• 🚫 Block external requests containing x-middleware-subrequest at your WAF/edge.
• 📊 Review logs for unusual 200 responses on protected routes.
• 🔁 Re-check your middleware-based authentication logic.

⚠️ Reminder:
🔐 Use PoC code only in authorized, controlled environments.
The goal is to strengthen defenses, not exploit systems.

⚠️ New POC: CVE-2025-24893 — XWiki unauthenticated RCE 🚨🔥

What: A public proof-of-concept for CVE-2025-24893 (unauthenticated remote code execution in XWiki) was published on GitHub: https://github.com/D3Ext/CVE-2025-24893 📂

Affected: XWiki instances using the SolrSearch macro (allows arbitrary Groovy evaluation by a guest) — high risk for unauthenticated RCE. ⚠️

Severity & context: Critical — can impact confidentiality, integrity and availability. Treat public POC code as hostile. 🔒🔥

Mitigation / Action items 🛠
• Inventory all XWiki instances (public & internal) — find exposed hosts. 🗺
• Patch immediately to vendor-published fixed builds where available. ✅
• Block/monitor suspicious SolrSearch requests and unusual Groovy execution in logs. 👀
• Don’t run the POC against systems you don’t own — illegal and dangerous. ❗️

TL;DR: Verify, patch, monitor, and treat the public PoC as an active threat. If you want, I can convert this into a one-line remediation playbook and scanner queries for your on-call channel. ✅

🚨 NEW EXPLOIT ALERT: CVE-2025-33073 🚨

🔍 What is it?
A Proof of Concept (PoC) exploit for the NTLM Reflection SMB flaw has been released! This exploit allows attackers to perform NTLM relay attacks, potentially leading to unauthorized access and privilege escalation in Windows environments.

🔗 Official Research:
Synacktiv's Analysis

🛠 Prerequisites:
- Kali Linux (recommended)
- NetExec (NXC)
- impacket-ntlmrelayx
- dnstool.py (included in the repo)
- xterm (for GUI)

💻 Example Usage:
python3 CVE-2025-33073.py -u 'DOMAIN\\user' -p 'password' --attacker-ip [YOUR_IP] --dns-ip [DNS_IP] --dc-fqdn [DC_FQDN] --target [TARGET] --target-ip [TARGET_IP]

🎯 Features:
- GUI & CLI modes
- Custom command execution
- SOCKS proxy support for stealthy operations
- Manual exploit without DNS requirement (LLMNR poisoning)

⚠️ Impact:
- Allows attackers to relay NTLM authentication and execute commands as SYSTEM.
- Can be used to dump SAM hashes or run arbitrary commands.

🔧 How to Fix?
- Patch your systems as soon as updates are available.
- Monitor for unusual NTLM authentication attempts.

📌 GitHub Repo:
mverschu/CVE-2025-33073

💡 Note:
This is a PoC. Use responsibly and only in authorized environments.

#CVE #Cybersecurity #NTLM #Exploit #Infosec

🎉 5,000 SUBSCRIBERS — THANK YOU! 🎉

We just crossed 5,000 subscribers on YouTube! A massive thank you to everyone who watched, liked, commented, and supported the journey. This community is the backbone of The Exploit Lab. 🙏🔥

What’s coming next?
• Deep-dive cybersecurity tutorials 💻
• Practical exploit demos & recon techniques 🕵️‍♂️
• Tool walkthroughs, tips, and advanced guides 🚀

Whether you're new or have been here since day one — you're amazing. Let’s push toward 10K next! 💪

👉 YouTube Channel – The Exploit Lab
👉 Join our Telegram

— The Exploit Lab 🔐

🔍 Bug Bounty Search Engine 🚀

Generate advanced Google search queries for your target domain with these powerful categories:


📁 File & Directory Discovery
🐞 Vulnerabilities & Exploits
🌐 Subdomain & Asset Discovery
📜 Archive & Historical Data
🕵️ OSINT & Social


💡 Pro Tip: Use these queries to uncover hidden paths, sensitive files, and potential vulnerabilities!

#BugBounty #Cybersecurity #OSINT

🚨Python-Backdoor 🐍

🔥 Explore the power of Python with this open-source backdoor tool! Perfect for ethical hacking, penetration testing, and cybersecurity research.

📌 GitHub: Check it out here

🔍 Want to learn more? Follow us for updates, tutorials, and deep dives into cybersecurity:

📢 Twitter/X
📡 Telegram
🎥 YouTube

🚨 Apepe Vulnerability Discovered! 🚨

A critical vulnerability has been found in the Apepe project. This could allow attackers to exploit systems running vulnerable configurations.

🔍 What’s at risk?
- Unauthorized access
- Potential system compromise
- Data leaks

🛡 Mitigation:
- Update immediately if you’re using Apepe.
- Review your configurations for exposed endpoints.

🔗 Details: GitHub Repository

Stay secure, stay updated! 🔒

---
This is my Telegram channel for more exploits and security insights:
@TheExploitLabX

Almost all sites hosted on Cloudflare are not working.

🚨Fundamentals of AI for Red Teamers!

🔗 Watch Now

📌 What’s Inside?
- How AI is reshaping offensive security
- Practical use cases for red teamers
- Tools & techniques to stay ahead

🎯 Perfect for hackers, pentesters, and security enthusiasts!

📺 Duration: 13:47 | Resolution: 1920x1104

💡 Knowledge is power—stay sharp!

---
🔔 This is my Telegram channel for more cutting-edge content:
@TheExploitLabX

🔥 Hands On AI (LLM) Red Teaming 🔥

---
📚 A short Fundamentals of LLMs
🔗 Watch Here

---
📌 Module 1: Adversarial Testing
1️⃣ Introduction to Adversarial Testing
2️⃣ Introduction IBM ART
3️⃣ Introduction Textattack
4️⃣ Adversarial Text Generation with Textattack (Data Augmentation)
5️⃣ Blackbox Adversarial Testing with Textattack

---
📌 Module 2: AI Risk & Red Teaming
1️⃣ History of AI Attacks & Failures
2️⃣ AI Risk Classes
3️⃣ What is AI Red Teaming
4️⃣ AI Attacks Taxonomy Part 1
5️⃣ AI Attacks Taxonomy Part 2

---
📌 Module 3: Adversarial Testing Demos
1️⃣ Adversarial Testing - TextAttack Demo
2️⃣ TextAttack Results
3️⃣ Adversarial Testing - Jailbreaking Demo
4️⃣ Reading Garak Results

---
📌 Module 4: Prompt Injections
1️⃣ Introduction to Prompt Injections
2️⃣ Prompt Internal Structure
3️⃣ Real-life Examples of Prompt Injections
4️⃣ Craft a Prompt Injection Prompt
5️⃣ Try Prompt Injections on Pokebot
6️⃣ Basic Prompt Injection Techniques
7️⃣ Try Prompt Injections on Medusa
8️⃣ Intermediate Prompt Injection Techniques
9️⃣ OWASP Top 10 LLM Apps

---
📢 Call to Action
🔗 Follow us for more:
🐦 Twitter
📌 Telegram
🎥 YouTube

---
#AI #RedTeam #LLM #Cybersecurity #AdversarialTesting

🚨 Critical Google Security Flaw Exposed: Attackers Could Brute-Force Your Recovery Phone Number!

Google recently patched a major security vulnerability that allowed attackers to brute-force and discover phone numbers linked to any Google account. The flaw, uncovered by security researcher brutecat, exploited a deprecated JavaScript-disabled version of Google’s username recovery form, which lacked anti-abuse protections.

How the Exploit Worked:
- Attackers could leak a Google account’s display name via Looker Studio.
- Using the "Forgot Password" flow, they could obtain a masked phone number (with the last 2 digits visible).
- By brute-forcing the remaining digits, the full phone number could be uncovered in seconds to minutes, depending on the country.

💥 Impact:
With the phone number, attackers could launch SIM-swapping attacks, reset passwords, and take over accounts. Google awarded brutecat a $5,000 bug bounty and fixed the issue by removing the vulnerable form on June 6, 2025.

🔍 Why It Matters:
This isn’t the first time brutecat exposed Google flaws. Earlier this year, they revealed exploits to leak YouTube creators’ emails, earning $30,000+ in bounties.

🔗 Stay Updated & Secure:
Follow The Exploit Lab on X
Join The Exploit Lab on Telegram
Watch The Exploit Lab on YouTube

#CyberSecurity #Google #Privacy #Exploit #BugBounty

🔍 Quick Port Scanner Script!

Want to check which ports are open on your local machine? Try this one-liner in your terminal:

for port in {1..100}; do (echo > /dev/tcp/localhost/$port) 2>/dev/null && echo "✅ Port $port OPEN"; done

How it works:
- It loops through ports 1 to 100.
- Attempts to connect to each port on localhost.
- If the port is open, it prints: ✅ Port [number] OPEN.

💡 Pro Tip: Replace localhost with an IP to scan remote hosts (ensure you have permission!).

---
📢 Follow for more tips & tricks!
🔗 X (Twitter)
🔗 Telegram
🔗 YouTube

🔍 Discover Open Ports & Services on Your Linux System!

Ever wondered what services are listening on your machine? This one-liner does the trick:

ss -tlpn | awk 'NR>1 {gsub(/.*:/,"",$4); split($7,p,","); print $4, p[2]}' | sort -n | uniq

What it does:
- ss -tlpn: Lists all TCP/UDP listening ports and processes.
- awk: Extracts the port number and process name.
- sort -n | uniq: Sorts and removes duplicates for a clean output.

📢 Follow for more Linux tips & cybersecurity insights!
🔗 Twitter
🔗 Telegram
🔗 YouTube

#Linux #Cybersecurity #Networking #TheExploitLab

🚨 Top 5 IP Addresses Attempting SSH Brute Force Attacks!

Ever wondered who's trying to brute force your SSH server? This one-liner extracts the top 5 IP addresses with failed password attempts from your /var/log/auth.log:

sudo grep "Failed password" /var/log/auth.log 2>/dev/null | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | sort | uniq -c | sort -rn | head -5

How it works:
1. grep "Failed password" → Filters failed login attempts.
2. grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" → Extracts IP addresses.
3. sort | uniq -c | sort -rn → Counts and sorts IPs by frequency.
4. head -5 → Shows the top 5 offenders.

🔍 Why monitor this?
- Identify malicious IPs targeting your server.
- Block them using iptables or fail2ban.

📢 Stay updated with more security tips:
🐦 X (Twitter)
📺 YouTube
💬 Telegram

#CyberSecurity #SSH #Linux #TheExploitLab

🔍 Monitor Active Network Connections Like a Pro!

Ever wanted to real-time monitor established network connections on your Linux machine? Here's a powerful one-liner:

watch -n 1 'ss -tpn state established 2>/dev/null | awk '\''NR>1{split($6,proc,","); print $5, proc[2]}'\'' | sort | uniq -c | sort -rn'

What it does:
- Lists all established connections.
- Extracts the port and process name.
- Counts and sorts connections by frequency.

💡 Perfect for debugging, security audits, or just keeping an eye on your system!

---
📢 Follow for more tips & tricks!
🔗 Twitter
🔗 Telegram
🔗 YouTube