🔖Top 25 JavaScript path files used to store sensitive information in Web Application⬇️
01. /js/config.js
02. /js/credentials.js
03. /js/secrets.js
04. /js/keys.js
05. /js/password.js
06. /js/api_keys.js
07. /js/auth_tokens.js
08. /js/access_tokens.js
09. /js/sessions.js
10. /js/authorization.js
11. /js/encryption.js
12. /js/certificates.js
13. /js/ssl_keys.js
14. /js/passphrases.js
15. /js/policies.js
16. /js/permissions.js
17. /js/privileges.js
18. /js/hashes.js
19. /js/salts.js
20. /js/nonces.js
21. /js/signatures.js
22. /js/digests.js
23. /js/tokens.js
24. /js/cookies.js
25. /js/topsecr3tdonotlook.js
#InfoSec #CyberSecurity #Hacking #BugBounty #bugbountyTools #bugbountytips #Pentest #Fuzzing
01. /js/config.js
02. /js/credentials.js
03. /js/secrets.js
04. /js/keys.js
05. /js/password.js
06. /js/api_keys.js
07. /js/auth_tokens.js
08. /js/access_tokens.js
09. /js/sessions.js
10. /js/authorization.js
11. /js/encryption.js
12. /js/certificates.js
13. /js/ssl_keys.js
14. /js/passphrases.js
15. /js/policies.js
16. /js/permissions.js
17. /js/privileges.js
18. /js/hashes.js
19. /js/salts.js
20. /js/nonces.js
21. /js/signatures.js
22. /js/digests.js
23. /js/tokens.js
24. /js/cookies.js
25. /js/topsecr3tdonotlook.js
#InfoSec #CyberSecurity #Hacking #BugBounty #bugbountyTools #bugbountytips #Pentest #Fuzzing
🔥8❤4👍2
Media is too big
VIEW IN TELEGRAM
PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).
If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.
https://github.com/advisories/GHSA-cwph-f4w9-f4wq
If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.
https://github.com/advisories/GHSA-cwph-f4w9-f4wq
❤8🔥3😱3🐳1
💀 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker🛠️
TOOLS:
Nuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml
Exploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-
💥 IMPACT: Pre‑auth XSS → RCE. No credentials needed. Over 500M sites at risk.
TOOLS:
Nuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml
Exploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-
💥 IMPACT: Pre‑auth XSS → RCE. No credentials needed. Over 500M sites at risk.
🔥6❤5👏3
BRUT SECURITY INTERNSHIP AND CONTRIBUTOR PROGRAM
We are considering the launch of a new community-based internship program designed to provide real-world experience through contributions to Brut Security.
Potential areas of contribution include:
This program requires no fixed hours, daily attendance, or pressure. Participants may contribute at their discretion. The program operates on a task-based structure:
Upon completion of assigned work, submissions will be manually reviewed, and a Brut Security Internship Certificate will be issued within seven days.
Are you interested?
Please comment
Sufficient interest will result in the launch of the first cohort.
We are considering the launch of a new community-based internship program designed to provide real-world experience through contributions to Brut Security.
Potential areas of contribution include:
- Social Media and Marketing
- Cybersecurity Blogging
- Tool and Script Development
- Web Redesign and Development
- UI/UX and Graphics
- Security Research and OSINT
- Automation and additional fieldsThis program requires no fixed hours, daily attendance, or pressure. Participants may contribute at their discretion. The program operates on a task-based structure:
TASK 01 → TASK 02 → TASK 03 → COMPLETED
Upon completion of assigned work, submissions will be manually reviewed, and a Brut Security Internship Certificate will be issued within seven days.
This is a voluntary, unpaid program. Certification will be awarded based on the successful completion of work rather than simple enrollment. A separate registration page will be established to shortlist participants. In the event that the number of applicants exceeds available slots, candidates will be placed on a waitlist rather than rejected.Are you interested?
Please comment
"INTERESTED" if you wish to join.Sufficient interest will result in the launch of the first cohort.
❤6🔥4
Brut Security pinned «BRUT SECURITY INTERNSHIP AND CONTRIBUTOR PROGRAM We are considering the launch of a new community-based internship program designed to provide real-world experience through contributions to Brut Security. Potential areas of contribution include: - Social…»
Follow the Brut Security channel on WhatsApp: https://whatsapp.com/channel/0029VacUEmpCnA8014ZLnm1L
👍2❤1🗿1
PentesterFlow – AI Tool for Penetration Testers and Bug Hunters to Automate Workflows
Resource: https://cybersecuritynews.com/pentesterflow
Resource: https://cybersecuritynews.com/pentesterflow
❤3👍2🔥2
You Don't Need Mimikatz for DCSync Anymore (SharpDCSync)
Credit/Resource: https://lsecqt.github.io/Red-Teaming-Army/active-directory/you-dont-need-mimikatz-for-dcsync-anymore-(sharpdcsync)
Credit/Resource: https://lsecqt.github.io/Red-Teaming-Army/active-directory/you-dont-need-mimikatz-for-dcsync-anymore-(sharpdcsync)
❤4👍3🔥2👏1
New CT Recon Source ⚡
Looking for a ridiculously fast way to discover subdomains?
Try crt.name:
It returns the subdomains found in Certificate Transparency records along with the date they were first seen.
Need only the subdomains? 👇
Fast. Simple. No unnecessary hassle.
A useful addition to your subdomain reconnaissance workflow. 🔥
Looking for a ridiculously fast way to discover subdomains?
Try crt.name:
https://crt.name/v1/search?apex=target.com
It returns the subdomains found in Certificate Transparency records along with the date they were first seen.
Need only the subdomains? 👇
curl -s "https://crt.name/v1/search?apex=target.com"| awk '{print $1}' | sort -u
Fast. Simple. No unnecessary hassle.
A useful addition to your subdomain reconnaissance workflow. 🔥
❤7🔥4👍1👏1🙏1
OLD days OR wot 🤣🤣🤣🤣
dork:
*inurl:/asset/kcfinder
*sites/all/modules/civicrm/packages/kcfinder
*inurl:templates/_editor/kcfinder/
*inurl:includes/kcfinder/browse.php
*inurl:/kcfinder/browse.php
*lib/kcfinder/files/upload
*admin/kcfinder/files/upload
*panel/kcfinder/upload/files
*editor/kcfinder/upload
*Kcfinder/upload/files
*inurl:/panel/kcfinder/ ext:png
dork:
*inurl:/asset/kcfinder
*sites/all/modules/civicrm/packages/kcfinder
*inurl:templates/_editor/kcfinder/
*inurl:includes/kcfinder/browse.php
*inurl:/kcfinder/browse.php
*lib/kcfinder/files/upload
*admin/kcfinder/files/upload
*panel/kcfinder/upload/files
*editor/kcfinder/upload
*Kcfinder/upload/files
*inurl:/panel/kcfinder/ ext:png
❤5
This Independence Day, we celebrate the spirit of a nation that keeps moving forward.
From securing a system to securing a nation, every line of code, every defender, and every ethical hacker has a role to play.
Happy Independence Day
Stay free. Stay curious. Stay secure.
#IndependenceDay #India #BrutSecurity #CyberSecurity #EthicalHacking #CyberPatriot
Please open Telegram to view this post
VIEW IN TELEGRAM
❤7🔥2👏1
Forwarded from Brut Security
⚔️ The Hunt Begins.
Admissions are now open for all Brut Security courses.
📅 Next Batch: 17 August
📩 DM to enroll wa.link/brutsecurity
Admissions are now open for all Brut Security courses.
📅 Next Batch: 17 August
📩 DM to enroll wa.link/brutsecurity
❤2
Brut Security
⚔️ The Hunt Begins. Admissions are now open for all Brut Security courses. 📅 Next Batch: 17 August 📩 DM to enroll wa.link/brutsecurity
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2
Hey Hunter's
DarkShadow is here back again!
⚡️Blind RCE via Chaining Requests💀
one word for all:
"To exploit any high severity vulnerability you have to analyze and chain multiple request components"
How to approach chaining a bug:
• First open your target in burpsuite (disable browser extensions to reduce other requests)
• Brows the target maually as much possible (don't run automatic crawler do first manually)
• Turn off proxy and review porxy history and send all the imporetent requests in 'Organizer' tab
• Now play in repeater, and if you got anything interesting see the serial number of the request in proxy history
• For chaining with other request analyze after the request history (this will help you to understand whats your second step request now)
THIS IS HOW YOU CAN FIND CRITICAL BUGS BY CHAINING THEM
so guy's if you really enjoy to read such as muthods don't forget follow me x.com/darkshadow2bd
#bugbountytips #rce
DarkShadow is here back again!
⚡️Blind RCE via Chaining Requests💀
one word for all:
"To exploit any high severity vulnerability you have to analyze and chain multiple request components"
How to approach chaining a bug:
• First open your target in burpsuite (disable browser extensions to reduce other requests)
• Brows the target maually as much possible (don't run automatic crawler do first manually)
• Turn off proxy and review porxy history and send all the imporetent requests in 'Organizer' tab
• Now play in repeater, and if you got anything interesting see the serial number of the request in proxy history
• For chaining with other request analyze after the request history (this will help you to understand whats your second step request now)
THIS IS HOW YOU CAN FIND CRITICAL BUGS BY CHAINING THEM
so guy's if you really enjoy to read such as muthods don't forget follow me x.com/darkshadow2bd
#bugbountytips #rce
❤3👍3🔥1