⚠️ New POC: CVE-2025-24893 — XWiki unauthenticated RCE 🚨🔥

What: A public proof-of-concept for CVE-2025-24893 (unauthenticated remote code execution in XWiki) was published on GitHub: https://github.com/D3Ext/CVE-2025-24893 📂

Affected: XWiki instances using the SolrSearch macro (allows arbitrary Groovy evaluation by a guest) — high risk for unauthenticated RCE. ⚠️

Severity & context: Critical — can impact confidentiality, integrity and availability. Treat public POC code as hostile. 🔒🔥

Mitigation / Action items 🛠
• Inventory all XWiki instances (public & internal) — find exposed hosts. 🗺
• Patch immediately to vendor-published fixed builds where available. ✅
• Block/monitor suspicious SolrSearch requests and unusual Groovy execution in logs. 👀
• Don’t run the POC against systems you don’t own — illegal and dangerous. ❗️

TL;DR: Verify, patch, monitor, and treat the public PoC as an active threat. If you want, I can convert this into a one-line remediation playbook and scanner queries for your on-call channel. ✅

🚨 NEW EXPLOIT ALERT: CVE-2025-33073 🚨

🔍 What is it?
A Proof of Concept (PoC) exploit for the NTLM Reflection SMB flaw has been released! This exploit allows attackers to perform NTLM relay attacks, potentially leading to unauthorized access and privilege escalation in Windows environments.

🔗 Official Research:
Synacktiv's Analysis

🛠 Prerequisites:
- Kali Linux (recommended)
- NetExec (NXC)
- impacket-ntlmrelayx
- dnstool.py (included in the repo)
- xterm (for GUI)

💻 Example Usage:
python3 CVE-2025-33073.py -u 'DOMAIN\\user' -p 'password' --attacker-ip [YOUR_IP] --dns-ip [DNS_IP] --dc-fqdn [DC_FQDN] --target [TARGET] --target-ip [TARGET_IP]

🎯 Features:
- GUI & CLI modes
- Custom command execution
- SOCKS proxy support for stealthy operations
- Manual exploit without DNS requirement (LLMNR poisoning)

⚠️ Impact:
- Allows attackers to relay NTLM authentication and execute commands as SYSTEM.
- Can be used to dump SAM hashes or run arbitrary commands.

🔧 How to Fix?
- Patch your systems as soon as updates are available.
- Monitor for unusual NTLM authentication attempts.

📌 GitHub Repo:
mverschu/CVE-2025-33073

💡 Note:
This is a PoC. Use responsibly and only in authorized environments.

#CVE #Cybersecurity #NTLM #Exploit #Infosec

🎉 5,000 SUBSCRIBERS — THANK YOU! 🎉

We just crossed 5,000 subscribers on YouTube! A massive thank you to everyone who watched, liked, commented, and supported the journey. This community is the backbone of The Exploit Lab. 🙏🔥

What’s coming next?
• Deep-dive cybersecurity tutorials 💻
• Practical exploit demos & recon techniques 🕵️‍♂️
• Tool walkthroughs, tips, and advanced guides 🚀

Whether you're new or have been here since day one — you're amazing. Let’s push toward 10K next! 💪

👉 YouTube Channel – The Exploit Lab
👉 Join our Telegram

— The Exploit Lab 🔐

🔍 Bug Bounty Search Engine 🚀

Generate advanced Google search queries for your target domain with these powerful categories:


📁 File & Directory Discovery
🐞 Vulnerabilities & Exploits
🌐 Subdomain & Asset Discovery
📜 Archive & Historical Data
🕵️ OSINT & Social


💡 Pro Tip: Use these queries to uncover hidden paths, sensitive files, and potential vulnerabilities!

#BugBounty #Cybersecurity #OSINT

🚨Python-Backdoor 🐍

🔥 Explore the power of Python with this open-source backdoor tool! Perfect for ethical hacking, penetration testing, and cybersecurity research.

📌 GitHub: Check it out here

🔍 Want to learn more? Follow us for updates, tutorials, and deep dives into cybersecurity:

📢 Twitter/X
📡 Telegram
🎥 YouTube

🚨 Apepe Vulnerability Discovered! 🚨

A critical vulnerability has been found in the Apepe project. This could allow attackers to exploit systems running vulnerable configurations.

🔍 What’s at risk?
- Unauthorized access
- Potential system compromise
- Data leaks

🛡 Mitigation:
- Update immediately if you’re using Apepe.
- Review your configurations for exposed endpoints.

🔗 Details: GitHub Repository

Stay secure, stay updated! 🔒

---
This is my Telegram channel for more exploits and security insights:
@TheExploitLabX

Almost all sites hosted on Cloudflare are not working.

🚨Fundamentals of AI for Red Teamers!

🔗 Watch Now

📌 What’s Inside?
- How AI is reshaping offensive security
- Practical use cases for red teamers
- Tools & techniques to stay ahead

🎯 Perfect for hackers, pentesters, and security enthusiasts!

📺 Duration: 13:47 | Resolution: 1920x1104

💡 Knowledge is power—stay sharp!

---
🔔 This is my Telegram channel for more cutting-edge content:
@TheExploitLabX

🔥 Hands On AI (LLM) Red Teaming 🔥

---
📚 A short Fundamentals of LLMs
🔗 Watch Here

---
📌 Module 1: Adversarial Testing
1️⃣ Introduction to Adversarial Testing
2️⃣ Introduction IBM ART
3️⃣ Introduction Textattack
4️⃣ Adversarial Text Generation with Textattack (Data Augmentation)
5️⃣ Blackbox Adversarial Testing with Textattack

---
📌 Module 2: AI Risk & Red Teaming
1️⃣ History of AI Attacks & Failures
2️⃣ AI Risk Classes
3️⃣ What is AI Red Teaming
4️⃣ AI Attacks Taxonomy Part 1
5️⃣ AI Attacks Taxonomy Part 2

---
📌 Module 3: Adversarial Testing Demos
1️⃣ Adversarial Testing - TextAttack Demo
2️⃣ TextAttack Results
3️⃣ Adversarial Testing - Jailbreaking Demo
4️⃣ Reading Garak Results

---
📌 Module 4: Prompt Injections
1️⃣ Introduction to Prompt Injections
2️⃣ Prompt Internal Structure
3️⃣ Real-life Examples of Prompt Injections
4️⃣ Craft a Prompt Injection Prompt
5️⃣ Try Prompt Injections on Pokebot
6️⃣ Basic Prompt Injection Techniques
7️⃣ Try Prompt Injections on Medusa
8️⃣ Intermediate Prompt Injection Techniques
9️⃣ OWASP Top 10 LLM Apps

---
📢 Call to Action
🔗 Follow us for more:
🐦 Twitter
📌 Telegram
🎥 YouTube

---
#AI #RedTeam #LLM #Cybersecurity #AdversarialTesting

🚨 Critical Google Security Flaw Exposed: Attackers Could Brute-Force Your Recovery Phone Number!

Google recently patched a major security vulnerability that allowed attackers to brute-force and discover phone numbers linked to any Google account. The flaw, uncovered by security researcher brutecat, exploited a deprecated JavaScript-disabled version of Google’s username recovery form, which lacked anti-abuse protections.

How the Exploit Worked:
- Attackers could leak a Google account’s display name via Looker Studio.
- Using the "Forgot Password" flow, they could obtain a masked phone number (with the last 2 digits visible).
- By brute-forcing the remaining digits, the full phone number could be uncovered in seconds to minutes, depending on the country.

💥 Impact:
With the phone number, attackers could launch SIM-swapping attacks, reset passwords, and take over accounts. Google awarded brutecat a $5,000 bug bounty and fixed the issue by removing the vulnerable form on June 6, 2025.

🔍 Why It Matters:
This isn’t the first time brutecat exposed Google flaws. Earlier this year, they revealed exploits to leak YouTube creators’ emails, earning $30,000+ in bounties.

🔗 Stay Updated & Secure:
Follow The Exploit Lab on X
Join The Exploit Lab on Telegram
Watch The Exploit Lab on YouTube

#CyberSecurity #Google #Privacy #Exploit #BugBounty

🔍 Quick Port Scanner Script!

Want to check which ports are open on your local machine? Try this one-liner in your terminal:

for port in {1..100}; do (echo > /dev/tcp/localhost/$port) 2>/dev/null && echo "✅ Port $port OPEN"; done

How it works:
- It loops through ports 1 to 100.
- Attempts to connect to each port on localhost.
- If the port is open, it prints: ✅ Port [number] OPEN.

💡 Pro Tip: Replace localhost with an IP to scan remote hosts (ensure you have permission!).

---
📢 Follow for more tips & tricks!
🔗 X (Twitter)
🔗 Telegram
🔗 YouTube

🔍 Discover Open Ports & Services on Your Linux System!

Ever wondered what services are listening on your machine? This one-liner does the trick:

ss -tlpn | awk 'NR>1 {gsub(/.*:/,"",$4); split($7,p,","); print $4, p[2]}' | sort -n | uniq

What it does:
- ss -tlpn: Lists all TCP/UDP listening ports and processes.
- awk: Extracts the port number and process name.
- sort -n | uniq: Sorts and removes duplicates for a clean output.

📢 Follow for more Linux tips & cybersecurity insights!
🔗 Twitter
🔗 Telegram
🔗 YouTube

#Linux #Cybersecurity #Networking #TheExploitLab

🚨 Top 5 IP Addresses Attempting SSH Brute Force Attacks!

Ever wondered who's trying to brute force your SSH server? This one-liner extracts the top 5 IP addresses with failed password attempts from your /var/log/auth.log:

sudo grep "Failed password" /var/log/auth.log 2>/dev/null | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | sort | uniq -c | sort -rn | head -5

How it works:
1. grep "Failed password" → Filters failed login attempts.
2. grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" → Extracts IP addresses.
3. sort | uniq -c | sort -rn → Counts and sorts IPs by frequency.
4. head -5 → Shows the top 5 offenders.

🔍 Why monitor this?
- Identify malicious IPs targeting your server.
- Block them using iptables or fail2ban.

📢 Stay updated with more security tips:
🐦 X (Twitter)
📺 YouTube
💬 Telegram

#CyberSecurity #SSH #Linux #TheExploitLab

🔍 Monitor Active Network Connections Like a Pro!

Ever wanted to real-time monitor established network connections on your Linux machine? Here's a powerful one-liner:

watch -n 1 'ss -tpn state established 2>/dev/null | awk '\''NR>1{split($6,proc,","); print $5, proc[2]}'\'' | sort | uniq -c | sort -rn'

What it does:
- Lists all established connections.
- Extracts the port and process name.
- Counts and sorts connections by frequency.

💡 Perfect for debugging, security audits, or just keeping an eye on your system!

---
📢 Follow for more tips & tricks!
🔗 Twitter
🔗 Telegram
🔗 YouTube

🔍 Top 10 Files with Deleted Links (But Still Open)

Ever wondered which files on your system are deleted but still held open by processes? This one-liner reveals the top 10 culprits:

lsof +L1 2>/dev/null | awk 'NR>1 {print $1" "$2" "$9}' | sort | uniq -c | sort -rn | head -10

🔎 What it does:
- lsof +L1: Lists files with a link count of 0 (deleted but open).
- 2>/dev/null: Silences errors.
- awk: Extracts process name, PID, and file path.
- sort | uniq -c | sort -rn: Counts and ranks by frequency.
- head -10: Shows the top 10 results.

💡 Why it matters:
Deleted files still in use can hog resources or cause issues. This helps you identify and investigate them!

---
📢 Follow for more Linux/Unix tips & tricks:
🐦 X (Twitter)
📌 Telegram
🎥 YouTube

🔍✨ The Ultimate OSINT Toolkit for Investigators & Researchers ✨🔍

Whether you're a cybersecurity pro 🛡, researcher 🔬, or just curious about OSINT (Open Source Intelligence), this list of powerful tools will help you gather information efficiently and effectively!

📌 Featured OSINT Tools:

1. Holehe
📧 Checks if an email is used on various platforms (e.g., Twitter, Instagram) via "forgot password" functions.

2. Toutatis
📸 Extracts emails, phone numbers, and other data from Instagram accounts.

3. Mr.Holmes
🌍 A complete OSINT tool for geolocation, username checking, and information gathering.

4. Tookie-OSINT
🔎 Advanced tool to find social media accounts from given inputs.

5. OnionSearch
🧅 Scrapes URLs from multiple .onion sites.

6. Maigret
🕵️‍♂️ Collects usernames across multiple platforms for investigation.

7. theHarvester
🌾 Gathers emails, subdomains, hosts, and employee names from public sources.

8. Sherlock
🔍 Finds usernames across social networks.

9. Amass
🗺 Performs network mapping of attack surfaces and external asset discovery.

10. Metagoofil
📄 Extracts metadata from public documents.

11. Recon-ng
🕸 Web reconnaissance framework for information gathering.

12. Sublist3r
🚀 Fast subdomain enumeration tool for penetration testers.

13. WAFW00F
🛡 Identifies and fingerprints Web Application Firewall (WAF) products.

14. OSINT-Search
🔗 Searches for usernames, emails, and domains across multiple platforms.

15. Shodan-Eyes
👁 Real-time monitoring for Shodan.io queries.

16. GitDorker
🔗 Scans GitHub repositories for sensitive information using customizable dorks.

17. Pagodo
🔍 Automates Google hacking/dorking and search engine discovery.

18. WhatBreach
🔓 Searches for breached emails and passwords in public databases.

19. PhoneInfoga
📱 Advanced tool for phone number reconnaissance.

20. Amass
🌐 In-depth DNS enumeration and network mapping.

21. WebAnalyze
💻 Analyzes websites for technologies, CMS, and frameworks used.

22. EyeWitness
📸 Captures screenshots of websites, RDP services, and open VNC servers.

23. FOCA
🔍 Fingerprints organizations by analyzing metadata and hidden information in documents.

24. Maltego
🔗 Forensic and link analysis tool for gathering and connecting information.

25. SpiderFoot
🕷 Automates OSINT collection and analysis for footprinting and reconnaissance.

📢 Want to learn how to use these tools?
Follow The Exploit Lab on X for tips and tutorials!
Join our Telegram channel for updates.
Subscribe to our YouTube channel for in-depth guides.

#OSINT #Cybersecurity #OpenSource #Investigation #TheExploitLab #Hacking #InfoSec

⭐️ Information Gathering Repositories on GitHub

GoogleScraper: Scrape search engines using proxies for automated info gathering.

postExploitTool: Post-exploitation information gathering.

PyGrobid: Python wrapper for scholarly information extraction.

LiteQnaire-Project: Questionnaire management desktop software.

yotter: Reconnaissance and directory discovery bash script.

BraMoSia: Brand Model Automatic Identification Script.

DirtyENUM: Basic Linux enumeration tool.

Infoga: Email information gathering.

Dracnmap: Automates Nmap scanning for information gathering.

URLExtractor: Website reconnaissance and info gathering.

social-scanner-cli: CLI for social media reconnaissance.

Info-Fetcher: PC and disk info fetcher.

CTED: Find subdomains using certificate transparency logs.

renji: OSINT and penetration testing tool.

TwLocation: Scrape tweet locations.

information_gathering_beta: One-key information gathering tool.

NumSpy-older: Mobile number info for India.

informationSpreeFb: Facebook information scraper.

zenco: Quick DNS/IP/port reconnaissance tool.

Xandria: Knowledge library project.


Connect:
Twitter |
Telegram |
YouTube

🔥 Discover GoSearch - The ultimate OSINT tool to track anyone's digital footprint across 300+ websites! 🕵️‍♂️ Made with Go, it's faster and more accurate than Sherlock, includes support for huge breach databases, and avoids false positives/negatives.

✨ Just run:
go install github.com/ibnaleem/gosearch@latest
🔓 Hunt usernames, check breaches, and crack password hashes with Weakpass support!

Learn more & contribute: [LINK]

This is my Telegram channel for more such tools and tutorials: @TheExploitLabX