Hey Hunter's,

Do you guys want to learn about how "Google Authenticator" actually works? And how we can bypass it...

If you guys are interested I'll share a detail write-up about the work flow and the bypass method of Google Authenticator 2FA.

Share Your opinion here @brutsec

~DarkShadow

🚨 Brut Security | Feb 2026 – Enrollments Open 🚨

Ready to step into cybersecurity the right way?

🔥 Courses Available
• Ethical Hacking
• Web Penetration Testing
• Bug Bounty Hunting
• SOC / SIEM (Blue Team)

💻 Live training + practical labs
🧠 Real-world attack & defense mindset
🎯 Limited seats only

📅 Batch Starts: February 2026

If you’re serious about skills, not certificates — this is for you.

📩 DM Brut Security to enroll

Argus: A Python-based toolkit for Information Gathering & Reconnaissance #OSINT

GitHub: github.com/jasonxtn/Argus

🚨 CVE-2026-22794: Critical Appsmith Flaw Allows Account Takeover.
🔥PoC -https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv

Hey Hunter's,
DarkShadow is here back again!

hunting backup is a underestimate vulnerability which missed by many bug bounty hunters.

Find API endpoints via reading js or api documentation (if available). Then play with various request methods (e g. GET, POST)

also you might use my this provided simple and effective Wordlist:

/api/v1/backup/create
/api/v1/backup/export
/api/v1/backup/download/{id}
/api/v1/backup/restore
/api/v1/backup/schedule
/api/v1/backup/config
/api/setup/backup
/api/admin/system/backup/run
/api/manage/backup/snapshot
/api/settings/maintenance/backup
/api/system/export-data
/api/db/backup/start
/api/db/dump
/api/v1/database/snapshot
/api/v1/sql/backup
/api/v1/storage/archive
/api/v1/sync/backup
/api/v1/volumes/{id}/snapshot
/api/v1/backups/checkpoints



Guys I'll soon upload a detailed write-up about "Google Authenticator" workflow fundamentals and chain reaction for bypass it. Until show your love ❤️

#bugbountytips #missconfig

100+ N8N Security workflow & automation✨

For Red/Blue/AppSec workflows, integrations, and ready-to-run playbooks.

https://github.com/0xSojalSec/n8n-Red-Blue-AppSec-workflows

#infosec #cybersec #bugbounty

Automates enumeration and recon scans in the background

https://github.com/21y4d/nmapAutomator

Hey everyone! We’ve officially updated the Brut Security branding. We wanted something more minimal, eye-catching, and "cyber."

Check out the new orange-red glow. Does it hit the mark for you?

Drop a 🔥 if you love it, or let us know your thoughts in the comments!

🔓 Google released Net-NTLMv1 rainbow tables that enable cracking password hashes in under 12 hours using consumer hardware.

🔗 Learn more here

Hey Hunter's,
DarkShadow is here back again!

🔥SQL injection in json endpoint💀

Always be check json, js endpoints for SQLi. Make sure you check blind base injections. Cause here only possible blind base injections.

#sqli #bugbountytips

To the Brut Security Community: Saraswati Puja is a celebration of learning, and in our field, learning never stops. May your curiosity be endless, your logic be sharp, and your thirst for knowledge lead you to mastery.

Wishing you a powerful and blessed Saraswati Puja. Let’s keep building, keep breaking, and keep learning.

♾Bug Bounty Tip: Bypassing WAFs for Stored XSS via ASCII-Hex Encoded PDF Payloads

➡️Many platforms allow users to upload PDFs that get previewed/rendered directly in the browser (often using libraries like PDF.js in Firefox, Chrome extensions, embedded viewers, or custom implementations).

A clever trick for Stored XSS (or Blind XSS variants):

1. Craft a classic XSS payload (e.g., one that executes alert(document.domain) or exfiltrates cookies/tokens).

2. Encode the entire malicious JavaScript as ASCII hex (each character → \xHH format).

3. Embed it inside a tiny/valid PDF structure that triggers execution during font/glyph rendering or object parsing in vulnerable PDF renderers.

4. Upload the PDF to a target feature that stores and previews user-uploaded documents (profile, reports, tickets, resumes, invoices, shared files, etc.).

5. When a victim (admin, user, or support) previews/opens the PDF in a vulnerable renderer → XSS fires in the context of the PDF viewer.

⚡️Key advantages:
- Many WAFs / upload filters / content scanners completely miss it because it's not a classic <script> or HTML — it's binary-ish PDF content with hex-encoded JS.

- Can be tuned for Stored → persistent until deleted.

- Can be adapted for Blind XSS → exfiltrate to your server instead of alert().

💬Real-world notes from hunters:
- Works especially well against PDF.js-based previews (Firefox default, many web apps embed it).

- Reference: Similar to behavior seen in CVE-2024-4367 (arbitrary JS exec in PDF.js via font handling path).

- Impact varies:

- Self-XSS / low-priv user alert → usually P4–P5 or Informational.

- Admin views it → potential session theft / higher severity (P2–P3 possible if you can prove escalation).

- Some programs reject pure alert() PoCs in sandboxed viewers (no cookie access in most cases) → demonstrate real impact (e.g., redirect, keylogger, token exfil) or target-specific quirks.

- Pro tip: Test on your primary programs that have PDF preview/generation features — many still do!

⚡️Resources to start:
- Repo with example payloads: https://github.com/orwagodfather/XSS-Payloads
- Edit payloads easily in Notepad++ (hex view or find/replace).

Happy hunting — stay ethical & report responsibly! 🏆

Photo Credit- Orwa

#bugbountytip #bugbounty #xss #websecurity #pdfxss