Please open Telegram to view this post
VIEW IN TELEGRAM
❤8👍3
Hey Hunter's,
DarkShadow here back again, dropping a RCE in mail input field!
Listen, this is very important.
I Hope this method also help you to improve your bug hunting. Now guys show your love ❤️
#bugbountytip #rce
DarkShadow here back again, dropping a RCE in mail input field!
Listen, this is very important.
1. When a sign-in/sign-up page comes, use a normal email using your burp collaborator.
2. If you got any HTTP hit back in your burp, then don't stop thinking by SSRF.
3. Now test command injection payload on the mail input field.
4. Don't use URL encoding in space like %20 always use ${IFS} to replace spaces.
5. It's essential when you try here RCE also try blind OS injection payloads.
I Hope this method also help you to improve your bug hunting. Now guys show your love ❤️
#bugbountytip #rce
❤7🔥7
⚡Flowsint - Flowsint is an open-source OSINT graph exploration tool designed for ethical investigation, transparency, and verification.
✅https://github.com/reconurge/flowsint
✅https://github.com/reconurge/flowsint
❤7🔥4
#AD
🛡 Private Exploit Subscription
💜 VIP Nxploited Access 💜
📌 What’s Included:
💙 All vulnerabilities are critical (high-severity CVEs only)
💙 Every CVE is published immediately upon release along with a dedicated exploit
💙 All vulnerabilities include a working Proof of Concept (POC) or ready-to-use script
💙 Clear documentation is provided, along with private support for target verification
💙 No public or outdated exploits — all content is exclusive and up to date
🧠 Subscription Plans:
-✅ Weekly: $150
-✅ Monthly: $300
-✅ 4 Months: $600
📜 Terms of Subscription:
- Access is personal and non-transferable
- Sharing or leaking any materials is strictly prohibited
- Any violation results in permanent removal without refund
- All content is for educational and research purposes only
- Each member is fully responsible for how the material is used
📞 Contact to Join:
Telegram: @Kxploit🐶
Channel ✅ https://t.me/KNxploited
🛡 Private Exploit Subscription
📌 What’s Included:
-
-
-
📜 Terms of Subscription:
- Access is personal and non-transferable
- Sharing or leaking any materials is strictly prohibited
- Any violation results in permanent removal without refund
- All content is for educational and research purposes only
- Each member is fully responsible for how the material is used
📞 Contact to Join:
Telegram: @Kxploit
Channel ✅ https://t.me/KNxploited
#AD
Please open Telegram to view this post
VIEW IN TELEGRAM
1❤6🔥1👨💻1
Please open Telegram to view this post
VIEW IN TELEGRAM
👍2
🔥 Bug Bounty Recon Tip: Find forgotten / hidden APIs & endpoints devs left behind! 🔥
Chain these 2 awesome free tools by @xnl-h4ck3r:
💡 Pro combo (most people run):
waymore -i example.com -oU urls.txt && xnLinkFinder -i urls.txt -sf example.com -o cli -sp
You’ll often discover undocumented /admin-api/v2, debug endpoints, old GraphQL paths, forgotten params with IDORs, leaked keys etc. → pure passive recon gold!
Install both via pip:
pip install waymore
pip install git+https://github.com/xnl-h4ck3r/xnLinkFinder.git
Repos:
→ https://github.com/xnl-h4ck3r/waymore
→ https://github.com/xnl-h4ck3r/xnLinkFinder
Happy hunting & don’t forget to chain → gau + katana + waymore + xnLinkFinder = monster recon list 😈
#BugBounty #Recon #WebHacking #APIHunting #CyberSecurity
Chain these 2 awesome free tools by @xnl-h4ck3r:
1️⃣ waymore → pulls massive archived URLs + responses from Wayback, Common Crawl, VirusTotal, URLScan, OTX & more
Basic command:
waymore -i target.com -oU waymore-urls.txt
2️⃣ xnLinkFinder → parses those responses / JS / pages and extracts juicy endpoints, parameters, secrets & even generates a target-specific wordlist
Chain it like this:
xnLinkFinder -i waymore-urls.txt -sf target.com -o results/💡 Pro combo (most people run):
waymore -i example.com -oU urls.txt && xnLinkFinder -i urls.txt -sf example.com -o cli -sp
You’ll often discover undocumented /admin-api/v2, debug endpoints, old GraphQL paths, forgotten params with IDORs, leaked keys etc. → pure passive recon gold!
Install both via pip:
pip install waymore
pip install git+https://github.com/xnl-h4ck3r/xnLinkFinder.git
Repos:
→ https://github.com/xnl-h4ck3r/waymore
→ https://github.com/xnl-h4ck3r/xnLinkFinder
Happy hunting & don’t forget to chain → gau + katana + waymore + xnLinkFinder = monster recon list 😈
#BugBounty #Recon #WebHacking #APIHunting #CyberSecurity
❤13👍6🔥2
Please open Telegram to view this post
VIEW IN TELEGRAM
👍8👏1
Hey Hunter's,
DarkShadow is here back again, and dropping again a RCE method!
💀Steps to reproduce:☠️
1. Collect all possible js endpoints.
You can use my DarkEndFinder for quick js find.
2. Grep .map files from js files.
3. Use jsmap-inspector to debug clearly
4. Read manually one by one js logics and note down all the critical endpoints
5. Now play in your burp also use curl
AND I HOPE YOU KNOW WHAT SHOULD YOU DO NEXT... ALSO READ THE IMAGES.
Tip:
To collect more js use wayback machine urls.
So guy's if you really enjoyed to read methods then show your love❤️
#bugbountytip #rce
DarkShadow is here back again, and dropping again a RCE method!
💀Steps to reproduce:☠️
1. Collect all possible js endpoints.
You can use my DarkEndFinder for quick js find.
2. Grep .map files from js files.
3. Use jsmap-inspector to debug clearly
4. Read manually one by one js logics and note down all the critical endpoints
5. Now play in your burp also use curl
AND I HOPE YOU KNOW WHAT SHOULD YOU DO NEXT... ALSO READ THE IMAGES.
Tip:
To collect more js use wayback machine urls.
So guy's if you really enjoyed to read methods then show your love❤️
#bugbountytip #rce
❤13🔥3👏3🫡2