Shodan 5$ Lifetime Membership sale is live until 2026-08-09 00:00 UTC : https://account.shodan.io/billing/member

5 Free Coupons for Brut Security Ultimate Bundle https://topmate.io/saumadip/2223098?coupon_code=jioo

🔖Top 25 JavaScript path files used to store sensitive information in Web Application⬇️

01. /js/config.js
02. /js/credentials.js
03. /js/secrets.js
04. /js/keys.js
05. /js/password.js
06. /js/api_keys.js
07. /js/auth_tokens.js
08. /js/access_tokens.js
09. /js/sessions.js
10. /js/authorization.js
11. /js/encryption.js
12. /js/certificates.js
13. /js/ssl_keys.js
14. /js/passphrases.js
15. /js/policies.js
16. /js/permissions.js
17. /js/privileges.js
18. /js/hashes.js
19. /js/salts.js
20. /js/nonces.js
21. /js/signatures.js
22. /js/digests.js
23. /js/tokens.js
24. /js/cookies.js
25. /js/topsecr3tdonotlook.js

#InfoSec #CyberSecurity #Hacking #BugBounty #bugbountyTools #bugbountytips #Pentest #Fuzzing

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).

If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.

https://github.com/advisories/GHSA-cwph-f4w9-f4wq

💀 CVE-2026-64638: XSS2Shell (WP login XSS to RCE)WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker🛠️

TOOLS:

Nuclei Template (Detection): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml

Exploit Tool (xss2shell): https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

💥 IMPACT: Pre‑auth XSS → RCE. No credentials needed. Over 500M sites at risk.

BRUT SECURITY INTERNSHIP AND CONTRIBUTOR PROGRAM

We are considering the launch of a new community-based internship program designed to provide real-world experience through contributions to Brut Security.

Potential areas of contribution include:

- Social Media and Marketing
- Cybersecurity Blogging
- Tool and Script Development
- Web Redesign and Development
- UI/UX and Graphics
- Security Research and OSINT
- Automation and additional fields

This program requires no fixed hours, daily attendance, or pressure. Participants may contribute at their discretion. The program operates on a task-based structure:

TASK 01 → TASK 02 → TASK 03 → COMPLETED

Upon completion of assigned work, submissions will be manually reviewed, and a Brut Security Internship Certificate will be issued within seven days.

This is a voluntary, unpaid program. Certification will be awarded based on the successful completion of work rather than simple enrollment. A separate registration page will be established to shortlist participants. In the event that the number of applicants exceeds available slots, candidates will be placed on a waitlist rather than rejected.

Are you interested?

Please comment "INTERESTED" if you wish to join.

Sufficient interest will result in the launch of the first cohort.

Follow the Brut Security channel on WhatsApp: https://whatsapp.com/channel/0029VacUEmpCnA8014ZLnm1L

PentesterFlow – AI Tool for Penetration Testers and Bug Hunters to Automate Workflows

Resource: https://cybersecuritynews.com/pentesterflow

5 free coupons for the new joiners on this channel https://topmate.io/saumadip/2187710?coupon_code=awww

You Don't Need Mimikatz for DCSync Anymore (SharpDCSync)

Credit/Resource: https://lsecqt.github.io/Red-Teaming-Army/active-directory/you-dont-need-mimikatz-for-dcsync-anymore-(sharpdcsync)

New CT Recon Source ⚡

Looking for a ridiculously fast way to discover subdomains?

Try crt.name:
https://crt.name/v1/search?apex=target.com

It returns the subdomains found in Certificate Transparency records along with the date they were first seen.

Need only the subdomains? 👇

curl -s "https://crt.name/v1/search?apex=target.com"| awk '{print $1}' | sort -u

Fast. Simple. No unnecessary hassle.

A useful addition to your subdomain reconnaissance workflow. 🔥

OLD days OR wot 🤣🤣🤣🤣

dork:
*inurl:/asset/kcfinder
*sites/all/modules/civicrm/packages/kcfinder
*inurl:templates/_editor/kcfinder/
*inurl:includes/kcfinder/browse.php
*inurl:/kcfinder/browse.php
*lib/kcfinder/files/upload
*admin/kcfinder/files/upload
*panel/kcfinder/upload/files
*editor/kcfinder/upload
*Kcfinder/upload/files
*inurl:/panel/kcfinder/ ext:png

⚔️ The Hunt Begins.

Admissions are now open for all Brut Security courses.

📅 Next Batch: 17 August
📩 DM to enroll wa.link/brutsecurity