Brut Security
@brutsecurity
15.2K subscribers
965 photos
76 videos
292 files
1.01K links
✅DM: @wtf_brut
🛃WhatsApp: https://wa.link/brutsecurity
🈴Training: https://brutsecurity.com
📨Mail: info@brutsec.com
Download Telegram
About
Blog
Apps
Platform
Join
Brut Security
15.2K subscribers
Brut Security
🤔New Bug Bounty Target - https://www.werkstatt-bremen.de/.well-known/security.txt
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥2
2.05K viewsSaumadip Mandal, edited  
Brut Security
☄️Sensitive Information Disclosure Through Config File☄️

⚠️Steps To Reproduce:
ffuf -c -ac -r -u https://target[.]com/FUZZ -w wordlist.txt


⚠️Wordlists:
🔗https://github.com/six2dez/OneListForAll
🔗https://wordlists.assetnote.io/
🔗https://github.com/danielmiessler/SecLists
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - six2dez/OneListForAll: Rockyou for web fuzzing
Rockyou for web fuzzing. Contribute to six2dez/OneListForAll development by creating an account on GitHub.
🔥5
2.44K viewsSaumadip Mandal, 
Brut Security
157 Methods for Privilege Escalation (WindowsLinuxMacos) PDF.pdf
84.9 MB
👍1
2.38K viewsSaumadip Mandal, 
Brut Security
This media is not supported in your browser
VIEW IN TELEGRAM
🥲
👍2
2.25K viewsSaumadip Mandal, 
Brut Security
Shodan_for_Pentesting_1718863899.pdf
13.1 MB
👍5
2.42K viewsSaumadip Mandal, 
Brut Security
🔥2
2.22K viewsSaumadip Mandal, 
Brut Security
CVE-2024-6385: Improper Access Control in GitLab, 9.6 rating 🔥

The new vulnerability allows an attacker to run pipeline jobs with the rights of any other user.

Search at Netlas.io:
👉 Link: https://nt.ls/HvsUY
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef

Read more: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-bug-that-lets-attackers-run-pipelines-as-an-arbitrary-user/
2.32K viewsSaumadip Mandal, 
Brut Security
⚠️CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow
▶️Video POC - Click Here
⚠️Nuclei Template - Click Here
Please open Telegram to view this post
VIEW IN TELEGRAM
YouTube
CVE-2024-4879 | Template Injection Vulnerability in ServiceNow | Bug Bounty POC | Brut Security
🚨CVE-2024-4879 & CVE-2024-5217: ServiceNow Security Vulnerabilities Expose Businesses to RCE and Data Breaches

⚖These vulnerabilities enable unauthenticated remote attackers to execute arbitrary code within the Now Platform,
potentially leading to complete…
🤡2❤1🔥1
2.61K viewsSaumadip Mandal, 
Brut Security
Brut Security
⚠️CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ▶️Video POC - Click Here ⚠️Nuclei Template - Click Here
☄️New Template Added For DB Exploitation
🔥Link - https://github.com/Brut-Security/CVE-2024-4879
Please open Telegram to view this post
VIEW IN TELEGRAM
👍4
2.58K viewsSaumadip Mandal, edited  
Brut Security
IDOR.pdf
78.5 KB
👍1
2.68K viewsSaumadip Mandal, 
Brut Security
Brut Security
Parameters where you can try Command Injection. ?cmd={payload} ?exec={payload} ?command={payload} ?execute{payload} ?ping={payload} ?query={payload} ?jump={payload} ?code={payload} ?reg={payload} ?do={payload} ?func={payload} ?arg={payload} …
Keep Checking Old Posts 🍿
Please open Telegram to view this post
VIEW IN TELEGRAM
👍2
2.41K viewsSaumadip Mandal, 
Brut Security
Brut Security pinned «Keep Checking Old Posts 🍿»
Brut Security
Is X Bug Bounty Community
Anonymous Poll
38%
Toxic
62%
Great
180 voters2.26K viewsSaumadip Mandal, 
Brut Security
url/?f=etc/passwd ==> 403
encode etc/passwd as base64

url/?f=L2V0Yy9wYXNzd2Q= ==> 200

#note
you can use this trick in SQL , SSTI , XSS , LFI , Etc...

By:@GodfatherOrwa

#bugbountytips #BugBounty
👍10🔥2🤔2❤1
2.53K viewsSaumadip Mandal, 
Brut Security
https://t.me/boost/brutsecurity
Telegram
Brut Security
Boost this channel to help it unlock additional features.
👍1
2.14K viewsSaumadip Mandal, 
Brut Security
This media is not supported in your browser
VIEW IN TELEGRAM
Meme Time 🤔
Please open Telegram to view this post
VIEW IN TELEGRAM
🤣4
2.26K viewsSaumadip Mandal, edited  
Brut Security
💥2 Days Left for Registration of July Batch: Extreme Web Application Penetration Testing 💥

🚨Classes Starting From- Tuesday 16 July, 4PM INDIAN STANDARD TIME

💯Registration Link- https://wa.me/message/NQLPOBIAEFDBN1

⭕️Join us for an intensive 2-month course designed for beginners with basic IT & cybersecurity knowledge!
Please open Telegram to view this post
VIEW IN TELEGRAM
WhatsApp.com
Brut Security Academy
Business Account
2.22K viewsSaumadip Mandal, 
Brut Security
Find public files in Amazon S3
http://s3digger.com

Find public files in Dropbox 
https://drodigger.com

Find public files in Disk Yandex
https://yadigger.com

Find public files in Google Drive
https://drodigger.com

Find public files in other file sharing sites
https://fidigger.com

Find public files on url shortening sites
https://shortdigger.com
👍4❤2
2.58K viewsSaumadip Mandal, 
Brut Security
🚨A directory traversal bug in a private Intigrity program.

💥Payload: /****/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd

✅Courtesy- Click Here
Please open Telegram to view this post
VIEW IN TELEGRAM
❤11👍4
2.58K viewsSaumadip Mandal, edited  
Brut Security
Brut Security
🚨A directory traversal bug in a private Intigrity program. 💥Payload: /****/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd ✅Courtesy- Click Here
/****/: This is a directory traversal sequence, which is used to navigate through the file system. The **** is a common pattern used to traverse directories, allowing an attacker to access files outside of the web root.
👍4
2.61K viewsSaumadip Mandal, 
Brut Security
payloads.txt
5.3 MB
Directory-Traversal-Payloads
👍2😁1
2.79K viewsSaumadip Mandal,