Brut Security
17.9K subscribers
1.15K photos
103 videos
362 files
1.26K links
โœ…DM: @wtf_brut
โœ…For Ad: https://tlmtr.io/p/2flAsc
๐Ÿ›ƒWhatsApp: https://wa.link/brutsecurity
๐ŸˆดTraining: https://brutsecurity.com
๐Ÿ“จMail: info@brutsec.com
Download Telegram
๐Ÿ”–Extracting endpoints from JavaScript bookmarklets

โฌ‡๏ธUsage
๐Ÿ”ดAdd a new bookmark in your browserโ€™s toolbar
๐Ÿ”ดReplace the bookmarkโ€™s URL with the following JavaScript code:
javascript:(function(){var scripts=document.getElementsByTagName("script"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0โ€“9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<scripts.length;i++){var t=scripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();

๐Ÿ”ดVisit the target page and click the bookmarklet. The script will run in your browser, revealing previously undiscovered endpoints right on the page.
Please open Telegram to view this post
VIEW IN TELEGRAM
10๐Ÿ‘7โค6๐Ÿ”ฅ5๐Ÿค2
๐Ÿ‘ป๐Ÿ‘ป๐Ÿ‘ป
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ—ฟ19๐Ÿ”ฅ5๐Ÿณ4
grep-backURLs - Automated way to extract juicy info with subfinder and waybackurls

https://github.com/gigachad80/grep-backURLs
1๐Ÿ”ฅ12๐Ÿ‘4
๐Ÿ‘ป๐Ÿ‘ป๐Ÿ‘ปSearch across a half million git repos in Grep website - grep.app
Please open Telegram to view this post
VIEW IN TELEGRAM
1๐Ÿ”ฅ12๐Ÿ‘4๐Ÿ‘จโ€๐Ÿ’ป3
๐Ÿ”ฅ๐Ÿ”ฅYou Can Connect with me on LinkedIn- https://www.linkedin.com/in/mandal-saumadip
Please open Telegram to view this post
VIEW IN TELEGRAM
1โค11๐Ÿ˜5๐Ÿ‘1
๐Ÿ›กAdd this to your wordlist and you can ended up getting a CRITICAL
templates/processed/syslog-tcp-forward.conf

templates/processed/config.ini

Credit- Suyash Sharma
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ‘18๐Ÿ”ฅ9โค2
๐Ÿ‘ป๐Ÿ‘ป๐Ÿ‘ปLazyHunter is an automated reconnaissance tool designed for bug hunters, leveraging Shodan's InternetDB and CVEDB APIs. It retrieves open ports, hostnames, tags, and vulnerabilities for a given IP and fetches CVE details, including affected products and CVSS scores. Results are color-coded by severity for easy analysis.

https://github.com/iamunixtz/Lazy-Hunter
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ‘17๐Ÿ”ฅ8โค3๐Ÿ—ฟ1
๐Ÿ‘ปuro 1.0.2 is now out โœจ

โœ…https://github.com/s0md3v/uro
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ”ฅ10๐Ÿ‘5
Need an extensive SQL injection cheat sheet for bug bounty hunting and pentesting in general? ๐Ÿง

Check out @0xTib3rius' SQL Injection cheat sheet, it provides payloads for the 5 most popular databases such as MySQL, PostgreSQL, Oracle, etc.! ๐Ÿ˜Ž

๐Ÿ”— buff.ly/3WeSO5X
๐Ÿ‘13๐Ÿ‘6
This media is not supported in your browser
VIEW IN TELEGRAM
urlhunter: A recon tool that allows searching on URLs that are exposed via shortener services

Link:
https://github.com/utkusen/urlhunter
๐Ÿ”ฅ18๐Ÿ‘3โค2๐Ÿค2
CVE-2025-26794: SQL Injection in Exim 4.98, 7.5 ratingโ—๏ธ

A vulnerability in the Exim mail transfer agent could allow a remote attacker to perform SQL injection.

Search at Netlas.io:
๐Ÿ‘‰ Link: https://nt.ls/ge4Iy
๐Ÿ‘‰ Dork: smtp.banner:"Exim 4.98"

Vendor's advisory: https://www.exim.org/static/doc/security/CVE-2025-26794.txt
๐Ÿ”ฅ35๐Ÿ‘10๐Ÿณ1
Don't forget to react guys ๐Ÿ˜ข
๐Ÿ”ฅ45๐Ÿ‘7๐Ÿ—ฟ4๐Ÿ˜3๐Ÿคฃ3
๐Ÿ‘ป๐Ÿ‘ปURL's Manipulation 4 Reconnaissance

๐Ÿ”ฅ30 ways to gather information about the target domain just by adding different words to URL.

๐Ÿ›กhttps://osintteam.blog/urls-osint-bf5c9b087455
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ‘14๐Ÿ”ฅ3๐Ÿณ1๐Ÿ—ฟ1
CVE-2025-1128: RCE in Everest Forms WordPress Plugin, 9.8 rating ๐Ÿ”ฅ

The vulnerability allows an unauthenticated attacker to perform a wide range of actions with the site: upload arbitrary files, RCE, delete config files.

Search at Netlas.io:
๐Ÿ‘‰ Link: https://nt.ls/q6pgJ
๐Ÿ‘‰ Dork: http.body:"plugins/everest-forms"

Read more: https://www.wordfence.com/blog/2025/02/100000-wordpress-sites-affected-by-arbitrary-file-upload-read-and-deletion-vulnerability-in-everest-forms-wordpress-plugin/
๐Ÿ”ฅ11๐Ÿ‘1
๐Ÿ‘ป๐Ÿ‘ป๐Ÿ‘ปLenovo XSS via Unrestricted File Upload PoC---> https://t.me/brutsecurity_poc/42
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ—ฟ3
๐Ÿ‘ป๐Ÿ‘ป A search engine for CTF writeups
๐Ÿ›กhttps://ctfsearch.hackmap.win/
Please open Telegram to view this post
VIEW IN TELEGRAM
10โค29๐Ÿ‘6
๐—š๐—ฎ๐—บ๐—ฒ ๐—ผ๐—ณ ๐—”๐—ฐ๐˜๐—ถ๐˜ƒ๐—ฒ ๐——๐—ถ๐—ฟ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ๐˜†

๐Ÿ‘ป๐Ÿ‘ปGOAD is a pentest active directory LAB project. This lab aims to give pentesters a vulnerable AD environment ready to use to practice usual attack techniques.

๐Ÿ”ฅhttps://github.com/Orange-Cyberdefense/GOAD
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ”ฅ17๐Ÿ‘7โค2