World Of Security – Telegram

World Of Security

@world_of_security

4.64K subscribers

39 photos

9 videos

21 files

599 links

Contactus:
@nashenas_tm
@cyberknight0_0

Download Telegram

About

Blog

Apps

Platform

World Of Security

4.64K subscribers

World Of Security

Exploiting a NoSQL injection and dumping data via regex and python

Dumping Data with NoSQL Injection via Regex and Python

Check out Snyk here: https://snyk.co/ippsec

00:00 - Introduction talking about the application we are testing and identifying NoSQL Injection with $ne
02:30 - Showing the RegEx Operator, which will let us do partial matches and enable us to validate characters…

👍2❤1

1.12K views05:18

World Of Security

https://dimazarno.medium.com/bypassing-email-filter-which-leads-to-sql-injection-e57bcbfc6b17

Bypassing Email Filter which leads to SQL Injection

Akhirnya nulis lagi, soalnya temuan ini menurut saya lumayan menarique jadi pengen sharing, maaf yang pakai google translate, artikel ini…

👍2

1.23K views05:29

World Of Security

■■■■□ HTTPX: Use the -screenshot (-ss) option to capture screenshots of specific URLs, pages, or endpoints, including the rendered DOM!

https://github.com/projectdiscovery/httpx

GitHub - projectdiscovery/httpx: httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp…

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library. - projectdiscovery/httpx

👍3🔥1

1.42K views21:27

World Of Security

https://hackerone.com/reports/1864188

EXNESS disclosed on HackerOne: SSRF in graphQL query (pwapi.ex2b.com)

SSRF in one of the graphQL parameters.

👍3

1.32K views05:23

World Of Security

Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR.

https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr

Mobilehackinglab

Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR

Dive into our latest blog to learn a clever technique for exploiting format string vulnerabilities to bypass ASLR, revealing key memory addresses and targeting the Damn Exploitable Android App.

🔥3👍2

1.62K views06:21

World Of Security

https://soroush.me/blog/2023/08/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-36899/

1.58K views06:46

World Of Security

https://ophionsecurity.com/blog/shopify-acount-takeover

👍3❤1

1.49K views06:48

World Of Security

https://5stars217.github.io/2023-08-08-red-teaming-with-ml-models/

Model Confusion - Weaponizing ML models for red teams and bounty hunters

How I hacked a bunch of companies via machine learning attacks.

👍1

1.47K views05:12

World Of Security

ATO | How I exploited security issue to take over admin account.

https://ar1fshaikh.medium.com/1st-ato-how-i-exploited-security-issue-to-take-over-admin-account-e0ae309dc356

ATO | How I exploited security issue to take over admin account

Few days ago I came across one bug bounty program of an booking website lets call https://redacted.com, it was interesting website with…

1.54K views06:46

World Of Security

Making the Cloudflare WARP VPN leak DNS requests.

https://www.mathyvanhoef.com/2023/08/making-cloudflare-warp-vpn-leak-dns.html

Making the Cloudflare WARP VPN leak DNS requests

Cloudflare offers a free VPN client called Cloudflare WARP . I found that its Windows client can be tricked into leaking all DNS requests . ...

👍2

1.47K views05:31

World Of Security

https://hackerone.com/reports/2032842

Internet Bug Bounty disclosed on HackerOne: HTTP Request Smuggling...

The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is...

👍1

1.41K views04:30

World Of Security

2023 OWASP Top-10 Series: API6:2023 Unrestricted Access to Sensitive Business Flows.

https://lab.wallarm.com/api62023-unrestricted-access-to-sensitive-business-flows/

API6:2023 Unrestricted Access to Sensitive Business Flows - OWASP

APIs that expose sensitive business flows without proper authorization can be exploited by attackers to cause significant damage.

👍1

1.58K views06:00

World Of Security

JWT Authentication Bypass via Algorithm Confusion

https://www.youtube.com/watch?v=d-X9CmpnJdE

JWT Authentication Bypass via Algorithm Confusion

👩‍🎓👨‍🎓 Learn about JSON Web Token (JWT) vulnerabilities. This lab uses a JWT-based mechanism for handling sessions. It uses a robust RSA key pair to sign and verify tokens. However, due to implementation flaws, this mechanism is vulnerable to algorithm confusion…

1.41K views05:07

World Of Security

Forwarded from Meisam Monsef

دوره رایگان OWASP
مدرس :‌ میثم منصف
HTTP (Part01) :
https://cafenode.ir/OWASP-FREE/01/c01.mp4
https://cafenode.ir/OWASP-FREE/01/c02.mp4
https://cafenode.ir/OWASP-FREE/01/c03.mp4
https://cafenode.ir/OWASP-FREE/01/c04.mp4

OS Command Injection (Part02):
https://cafenode.ir/OWASP-FREE/02/c01.mp4
https://cafenode.ir/OWASP-FREE/02/c02.mp4
https://cafenode.ir/OWASP-FREE/02/c03.mp4
https://cafenode.ir/OWASP-FREE/02/c04.mp4
https://cafenode.ir/OWASP-FREE/02/c05.mp4
https://cafenode.ir/OWASP-FREE/02/c06.mp4

Server Side Template Injection (Part03):
https://cafenode.ir/OWASP-FREE/03/c01.mp4
https://cafenode.ir/OWASP-FREE/03/c02.mp4
https://cafenode.ir/OWASP-FREE/03/c03.mp4
https://cafenode.ir/OWASP-FREE/03/c04.mp4

XSS - CSRF (Part04):
https://cafenode.ir/OWASP-FREE/04/c01.mp4
https://cafenode.ir/OWASP-FREE/04/c02.mp4
https://cafenode.ir/OWASP-FREE/04/c03.mp4
https://cafenode.ir/OWASP-FREE/04/c04.mp4

Live (Part05):
https://cafenode.ir/OWASP-FREE/05/c01.mp4
https://cafenode.ir/OWASP-FREE/05/c02.mp4

Server Side Request Forgery (Part06):
https://cafenode.ir/OWASP-FREE/06/c01.mp4
https://cafenode.ir/OWASP-FREE/06/c02.mp4
https://cafenode.ir/OWASP-FREE/06/c03.mp4
https://cafenode.ir/OWASP-FREE/06/c04.mp4
https://cafenode.ir/OWASP-FREE/06/c05.mp4
https://cafenode.ir/OWASP-FREE/06/c06.mp4

SQL Injection I (Part07) :
https://cafenode.ir/OWASP-FREE/07/c01.mp4
https://cafenode.ir/OWASP-FREE/07/c02.mp4
https://cafenode.ir/OWASP-FREE/07/c03.mp4
https://cafenode.ir/OWASP-FREE/07/c04.mp4
https://cafenode.ir/OWASP-FREE/07/c05.mp4
https://cafenode.ir/OWASP-FREE/07/c06.mp4
https://cafenode.ir/OWASP-FREE/07/c07.mp4
https://cafenode.ir/OWASP-FREE/07/c08.mp4

SQL Injection II (Part08) :
https://cafenode.ir/OWASP-FREE/08/c01.mp4
https://cafenode.ir/OWASP-FREE/08/c02.mp4
https://cafenode.ir/OWASP-FREE/08/c03.mp4
https://cafenode.ir/OWASP-FREE/08/c04.mp4
https://cafenode.ir/OWASP-FREE/08/c05.mp4
https://cafenode.ir/OWASP-FREE/08/c06.mp4
https://cafenode.ir/OWASP-FREE/08/c07.mp4

XML External Entity (Part09) :
https://cafenode.ir/OWASP-FREE/09/c01.mp4
https://cafenode.ir/OWASP-FREE/09/c02.mp4
https://cafenode.ir/OWASP-FREE/09/c03.mp4
https://cafenode.ir/OWASP-FREE/09/c04.mp4
https://cafenode.ir/OWASP-FREE/09/c05.mp4
https://cafenode.ir/OWASP-FREE/09/c06.mp4
https://cafenode.ir/OWASP-FREE/09/c07.mp4
https://cafenode.ir/OWASP-FREE/09/c08.mp4
https://cafenode.ir/OWASP-FREE/09/c09.mp4
https://cafenode.ir/OWASP-FREE/09/c10.mp4

Broken Authentication (Part10) :
https://cafenode.ir/OWASP-FREE/10/c01.mp4
https://cafenode.ir/OWASP-FREE/10/c02.mp4
https://cafenode.ir/OWASP-FREE/10/c03.mp4
https://cafenode.ir/OWASP-FREE/10/c04.mp4
https://cafenode.ir/OWASP-FREE/10/c05.mp4

API Security (Part11) :
https://cafenode.ir/OWASP-FREE/11/c01.mp4
https://cafenode.ir/OWASP-FREE/11/c02.mp4
https://cafenode.ir/OWASP-FREE/11/c03.mp4
https://cafenode.ir/OWASP-FREE/11/c04.mp4
https://cafenode.ir/OWASP-FREE/11/c05.mp4

@SecCode

👍8👎3❤2

1.36K views08:13

World Of Security

https://medium.com/@garkolym/uncovering-a-critical-vulnerability-in-samsung-mobile-security-a-bug-bounty-journey-95d614ba1841

Uncovering a Critical Vulnerability in Samsung Mobile Security: A Bug Bounty Journey

👍3❤1

1.47K views04:10

World Of Security

JWT Attacks

https://juba-notes.notion.site/JWT-attacks-4f62b2b641a84032bc624f8e8432345d

juba-notes on Notion

JWT attacks | Notion

By Mahmoud Hawash → reach me on LinkedIn

👍2❤1

1.33K views07:53

World Of Security

How it is possible to get persistent reverse shell from Android app without visible permissions to make device unusable via annoying DoS
https://www.mobile-hacker.com/2023/09/27/get-persistent-reverse-shell-from-android-app-without-visible-permissions-to-make-device-unusable/

Get persistent reverse shell from Android app without visible permissions to make device unusable Mobile Hacker

This blog will introduce you how it is possible to write a persistent reverse shell app on Android without any user requested and visible permissions. Since such application has no permissions, it shouldn’t be able to perform any task. Well, that isn’t true.…

👍2❤1

1.31K views05:08

World Of Security

https://sklnhunt.github.io/posts/xpathinjectionerrorbased/

Krunal Savaliya

XPATH Injection - Exploiting Error-based SQL Injection

Hey hackers!! Today, I’m explaining the exploitation of the error-based SQL injection via XPATH injection. This vulnerability was discovered during a private pen-test engagement.

👍3

1.12K views16:39

World Of Security

Use silent SMS messages to track LTE users’ locations
https://mandomat.github.io/2023-09-21-localization-with-silent-SMS/

Using silent SMS to localize LTE users

Proof of concept implementation

👍2

1.13K views04:59

World Of Security

https://portswigger.net/research/how-to-build-custom-scanners-for-web-security-research-automation

PortSwigger Research

How to build custom scanners for web security research automation

In this post, I'll share my approach to developing custom automation to aid research into under-appreciated attack classes and (hopefully) push the boundaries of web security. As a worked example, I'l

🔥3

1.31K views05:07

World Of Security

Binary Exploitation vs. Web Security

https://www.youtube.com/watch?v=FbeaklEkMgM

Binary Exploitation vs. Web Security

Want to learn hacking? (ad) https://hextree.io

👍3

1.15K views04:30