Information Security
@sec_nerd_en
414 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
414 subscribers
Information Security
https://twitter.com/Yumi_Sec/status/1253620834691887105
Twitter
Yumi
If a web application allow you to upload a .zip file, zip:// is an interesting PHP wrapper to turn a LFI into a RCE. #BugBounty #BugBountyTips #InfoSec
123 views
Information Security
https://twitter.com/Madrobot_/status/1253595339950444545
Twitter
Santhosh
Content Discovery list critical once #1/3 /_session_start_/%0atest /+CSCOU+/../+CSCOE+/files/file_list.json /josso/%5C../web-console /gui/file_viewer.php?encrypt=N&target_folder=utilities&uploaded_filename=../../../../../../../etc/passwd #bugbounty #BugBountyTips…
123 views
Information Security
https://p4fg.github.io/h1_415_2020/
114 views
Information Security
http://abdelgayoom.me/reconnaissance-and-information-gathering/
116 views
Information Security
https://medium.com/@ddigvijay29/reading-local-files-abusing-aws-metadata-services-63cad5bf921e
Medium
Reading Local files & Abusing AWS metadata services
Hello Friends,
106 views
Information Security
https://medium.com/bugbountywriteup/how-i-was-able-to-steal-millions-of-data-and-money-from-a-ticketing-portal-65036cb9f8d2
Medium
How I was able to steal millions of data and money from a Ticketing Portal.
People who aren’t familiar with townscript, it is a ticketing platform for event managers to sell their tickets online operating on 27+…
103 views
Information Security
https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common.txt
GitHub
SecLists/Discovery/Web-Content/common.txt at master · danielmiessler/SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, pas...
103 views
Information Security
#bugbounty Read

https://t.co/LMjiOAXhSJ
https://t.co/zu6IHTzdxn
https://t.co/xxtN0PzgOq
https://t.co/uOCO2HzhqU
https://t.co/hZEgiXGpSE
https://t.co/RPvk3g6x8Z

#bugbountytips
Medium
Bounty Tip !! Easiest way to bypass API’s Rate Limit.
What is Rate Limit ?
119 views
Information Security
https://medium.com/bugbountywriteup/guide-to-basic-recon-bug-bounties-recon-728c5242a115
Medium
How To Do Your Reconnaissance Properly Before Chasing A Bug Bounty
Today I am writing about the love story between bug bounties & reconnaissance, but before I do I should say that i’m not much of an expert…
124 views
Information Security
https://twitter.com/NahamSec/status/1254007496781389829?s=19
Twitter
NahamSec
Check out my latest video on "Creating Wordlists for Pentesting & Bug Bounty Hunting". I also showed how I use @DanielMiessler's SecLists, @TomNomNom's Waybackurls, or Google's BigQuery to create my own wordlists! LMK what you think of the video! https:/…
130 views
Information Security
https://santuysec.com/2020/03/06/google-bug-bounty-clickjacking-on-google-payment-1337/
123 views
Information Security
https://blog.avatao.com/How-I-could-steal-your-photos-from-Google/
119 views
Information Security
https://github.com/tarunkant/Gopherus
GitHub
GitHub - tarunkant/Gopherus: This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
This tool generates gopher link for exploiting SSRF and gaining RCE in various servers - tarunkant/Gopherus
120 views
Information Security
https://h0mbre.github.io/atillk64_exploit/
The Human Machine Interface
CVE-2020-12138 Exploit Proof-of-Concept, Privilege Escalation in ATI Technologies Inc. Driver atillk64.sys
Background
114 views
Information Security
https://techblog.mediaservice.net/2020/04/my-ysoserial-fork/
112 views
Information Security
https://medium.com/@metnew/you-better-not-make-an-electron-app-to-wrap-a-website-dd3fe876481b
Medium
You better not make an Electron app to “wrap” a website
TL;DR: Why investing in Electron apps might be a waste of time.
112 views
Information Security
This is how to find sql-Injection 100% of the time
For http://site.com/?q=HERE

/?q=1
/?q=1'
/?q=1"
/?q=[1]
/?q[]=1
/?q=1`
/?q=1\
/?q=1/*'*/
/?q=1/*!1111'*/
/?q=1'||'asd'||' <== concat string
/?q=1' or '1'='1
/?q=1 or 1=1
/?q='or''='
131 views
Information Security
https://blog.deteact.com/ru/bitrix-waf-bypass/
Deteact - continuous information security services
Bitrix WAF bypass - Deteact - continuous information security services
In Russian: https://blog.deteact.com/ru/bitrix-waf-bypass/ UPD: CVE-2020-13758 assigned Sometimes when exploiting reflected XSS the input parameters get injected directly into the body of the <script> tag. Typically, this means that the exploit is trivial:…
114 views
Information Security
Two Factor Authentication
writeups:- CC @009fal_con

https://t.co/rObGIJy2iA
https://t.co/5WsH8frlur
https://t.co/BxL74qnCqE
https://t.co/VdSeUFZ0Mi
https://t.co/fO8vWjruwy
https://t.co/gDng3cn0hL
https://t.co/3uOLJpJEnU
https://t.co/u49bGQkwvn
https://t.co/XLQtyodYWS
Medium
4 Methods to Bypass two factor Authentication
Since the dawn of the World Wide Web, attackers have been involved in discovering techniques to compromise systems. Likewise security…
133 views
Information Security
https://medium.com/bugbountywriteup/privilege-escalation-in-windows-380bee3a2842?source=rss----7b722bfd1b8d---4
Medium
Privilege Escalation in Windows
All roads lead to SYSTEM
121 views