#Beacon – Telegram

#Beacon

1.13K subscribers

264 photos

24 videos

127 files

1.81K links

Прожаренный цуберпохек

[educational channel/white hat only] - do not try the knowledge from here on your home or other people's microwaves

Download Telegram

About

Blog

Apps

Platform

1.13K subscribers

Forwarded from #Arm1tage

Просто и понятно: BSCP Без Моразма

https://github.com/DingyShark/BurpSuiteCertifiedPractitioner

576 views18:40

Forwarded from DIMOOON 🇺🇦🇺🇸🇮🇱

Почему про это еще CNN не написало?

https://twitter.com/hillai/status/1641146508639600646?t=7b4kX5hofetmLo2I4OCMbA&s=19

439 views08:55

Forwarded from DIMOOON 🇺🇦🇺🇸🇮🇱

Это ведь просто ахуенно.

471 views08:55

Forwarded from DIMOOON 🇺🇦🇺🇸🇮🇱

Зацените, подмена контента в выдаче в bing у Microsoft.

463 views08:55

Forwarded from DIMOOON 🇺🇦🇺🇸🇮🇱

https://youtu.be/hctqRgQW4IU

The #BingBang - a Bing.com vulnerability discovered by Wiz Research

💥 EXCLUSIVE: Wiz Research uncovers #BingBang — a vulnerability in Bing.com

This vulnerability in Bing could enable our research team to manipulate Bing search results and launch XSS attacks on Bing users, potentially accessing their Office 365 data, including…

533 views08:55

https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration

https://twitter.com/shirtamari/status/1643300698044391466

BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog

How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal

644 viewsedited 09:06

Looking to secure your Bitrix-based website from potential threats? Look no further than the BITRIX VULNERABILITY SCANNER, based on the expert insights and techniques found in the Attacking Bitrix guide.

#bitrix

1.7K views14:05

Path Buster - path normalization utility is a tool that can be used to detect vulnerabilities in web applications related to file and directory path handling.

It allows you to automatically normalize and compare different variants of file and directory paths on a server to identify potential vulnerabilities related to normalization.

GitHub - ethicalhackingplayground/pathbuster: A path-normalization pentesting tool.

A path-normalization pentesting tool. Contribute to ethicalhackingplayground/pathbuster development by creating an account on GitHub.

839 views22:16

https://blog.securitybreached.org/2023/04/19/how-i-manipulated-my-rank-on-the-bugcrowd-platform/

Security Breached Blog

How I Manipulated My Rank on the Bugcrowd Platform - Security Breached Blog

This vulnerability on the Bugcrowd platform allowed manipulating rank on the platform using the API.

821 views15:04

https://www.synack.com/blog/exploits-explained-5-unusual-authentication-bypass-techniques/?utm_content=222702763&utm_medium=social&utm_source=twitter&hss_channel=tw-2485761421

Exploits Explained: 5 Unusual Authentication Bypass Techniques

787 views18:32

🔥🔥🔫 Волшебная папка про багбаунти

❗️Теперь все каналы и чаты на тему багбаунти можно добавить себе прямо сейчас в один клик в виде отдельной папки (Павел Дуров запилил нам крутой функционал) - вот эта папка.

В этой папке 26 активных чатов и телеграмм каналов на эту тему, всё что нужно багхантеру. Саму папку буду допиливать в процессе и мы соберем в ней всё, что вообще можно собрать про багбаунти.

🐹 Багхантер

936 viewsedited 23:45

https://github.com/mindedsecurity/semgrep-rules-android-security

GitHub - mindedsecurity/semgrep-rules-android-security: A collection of Semgrep rules derived from the OWASP MASTG specifically…

A collection of Semgrep rules derived from the OWASP MASTG specifically for Android applications. - mindedsecurity/semgrep-rules-android-security

874 views12:48

https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/

Hijacking S3 Buckets: New Attack Technique

Without altering a single line of code, attackers poisoned the NPM package bignum by hijacking the S3 bucket serving binaries necessary for its function and replacing them with malicious ones

664 views18:59

Chrome Browser Extension Security Testing

https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing

* Nuclei templates to audit Chrome extensions

Introduction to Chrome Browser Extension Security Testing | Cobalt

Browser extensions, plugins, and add-ons are software components that enhance the functionality of existing programs, specifically web browsers.

860 views22:04

https://www.nullpt.rs/hacking-gta-servers-using-web-exploitation

Hacking GTA V RP Servers Using Web Exploitation Techniques

FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.

673 views10:01

https://trufflesecurity.com/blog/how-secrets-leak-out-of-docker-images/

#trufflehog

Trufflesecurity

How Secrets Leak out of Docker Images ◆ Truffle Security Co.

Complexities in Docker’s layered architecture and caching has created an environment where developers can easily unintentionally leak secrets. Most Docker secret leaks fall into 3 categories: overly permissive file operations, hardcoded secrets in Dockerfiles…

617 viewsedited 07:08

https://labs.hakaioffsec.com/nginx-alias-traversal/

Vulnerability Research

517 views20:25

https://medium.com/@bazzounbassem/bypass-two-factor-authentication-of-facebook-accounts-25-300-7ae152d7836a

Bypass Two-Factor Authentication of Facebook Accounts ($25,300)

In this writeup, I will explain how I discovered a Two-Factor Authentication bypass in Facebook during Meta bug bounty Researchers…

568 views20:30

https://youtu.be/1w_t6mOaOq4

Сергей Канибор . Kubernetes Pentest All‑in‑One: The Ultimate Toolkit

Kubernetes Pentest All‑in‑One: The Ultimate Toolkit

Сергей Канибор
R&D / Container Security, Luntry

Чтобы автоматизировать и ускорить работу при проведении пентеста Kubernetes‑кластера, обычно используют различные инструменты. Но что делать, если ты находишься…

531 views15:29

https://medium.com/@evan.connelly/post-account-takeover-account-takeover-of-internal-tesla-accounts-bc720603e67d

Post Account Takeover? Account Takeover of Internal Tesla Accounts

In testing various Tesla web applications as part of the Tesla Bug Bounty Program, I’ve created many Tesla user accounts. At some point…

610 views20:10