Brut Security
17.7K subscribers
1.15K photos
102 videos
362 files
1.26K links
✅DM: @wtf_brut
✅For Ad: https://tlmtr.io/p/2flAsc
🛃WhatsApp: https://wa.link/brutsecurity
🈴Training: https://brutsecurity.com
📨Mail: info@brutsec.com
Download Telegram
dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS queries, user supplied resolvers, DNS wildcard filtering like shuffledns etc.

Resource: https://github.com/projectdiscovery/dnsx
❤6👍4
A full-chain exploit dubbed “IonStack” demonstrates how a single malicious URL click can hand attackers complete control over an Android device

Credit/Source: https://cybersecuritynews.com/android-17-root-1-click
👍5❤2
This media is not supported in your browser
VIEW IN TELEGRAM
PenTesting Agent : is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

red team ops, Automated recon & exploitation, smart task trees, multi-agent collab, and seamless tool chaining like Nmap, Metasploit, SQLMap, Amass etc

https://github.com/GH05TCREW/pentestagent
🔥7❤2
SQL injection.pdf
599.4 KB
🚨SQL Injection Cheat Sheet
❤7👍3
This media is not supported in your browser
VIEW IN TELEGRAM
🐧GhostLock (CVE-2026-43499): a 15-year-old Linux kernel vulnerability that affects every distribution. Desktop, server, Android, IoT, embedded. $92,337 Google kernelCTF bounty.

A stack-UAF in the rtmutex subsystem. remove_waiter() uses current instead of waiter::task during proxy-lock rollback in futex_requeue(), leaving a dangling pointer to freed kernel stack memory. No special kernel modules needed, only CONFIG_FUTEX_PI which is enabled on every distro.

Nebula Security (NebuSec) turned it into a 97% stable privilege escalation and container escape. The exploit chains a dangling pointer into an arbitrary address write, hijacks a function table for control flow, and achieves root in about 5 seconds. Found by VEGA, their AI vulnerability scanner.

Part of IonStack, the first browser-to-kernel full-chain RCE on Android 17: CVE-2026-10702 (Firefox IonMonkey JIT 0-day, near 100% success rate) chained with GhostLock for kernel LPE.

Present since Linux 2.6.39 (2011). Fixed in Linux 7.1. Full exploit code published on GitHub.


Exploit:

https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499
❤2👍1🗿1
This media is not supported in your browser
VIEW IN TELEGRAM
The feeling of relief 😮‍💨
❤3🐳3😁1
This media is not supported in your browser
VIEW IN TELEGRAM
💥Feroxbuster: A fast recursive content discovery tool written in Rust.

Built for finding hidden files, directories, and endpoints using wordlists, with support for recursion, filters, extensions, headers, proxies, and more.

GitHub: https://github.com/epi052/feroxbuster
❤7👍3
Brut Security pinned «Bug Bounty Guide 2026 is now available at 1$ and 5 Free Coupon https://topmate.io/saumadip/2187710?coupon_code=awxea»
❤6
redacted_demo.svg
376.4 KB
🚨Zomato Contact Recommendation Data Exposure (PoC)

This tool demonstrates a privacy issue in Zomato's contact recommendation feature. By syncing a target phone number, the following data can be retrieved without the target's explicit consent (provided they have "Recommend to friends" enabled):

😮https://github.com/jatin-dot-py/zomato-intelligence
Please open Telegram to view this post
VIEW IN TELEGRAM
❤4
❤10
Forwarded from Brut Security 2.0
Cybersecurity Tools Collection (Pentesting • Recon • Web Security • Network Analysis) 💀

Download Link : https://drive.google.com/drive/u/0/mobile/folders/1lGnd9YAzE5-Nes8NAsDDMpd-Aq3GES3p
❤3👍2
Media is too big
VIEW IN TELEGRAM
‼️ CVE-2025-26529: Moodle XSS to RCE Exploit

GitHub: https://github.com/Astroo18/PoC-CVE-2025-26529
❤3👍1