Hacking Vidhya

前往频道在 Telegram

We Talk about : Hacking , CTFs , Pentesting , Red & Blue Team etc. Not Allowed: Selling, Carding, Cracking Crypto.

显示更多

印度152 157 技术与应用47 943

385

订阅者

+224 小时

+47 天

+2430 天

198

帖子浏览量

~ 5124 小时

~ 6948 小时

51.43%

参与率

~ 1

每日帖子数

Ads index

beta

帖子存档

{{end}} {{template \"T1\"}}\n\n🔍 This works because:\n💎 Go templates treat {{define}} and {{template}} as dynamic blocks.\n⚡️ You can inject arbitrary template logic including script tags.\n🔸 Useful in misconfigured custom template rendering engines.\n\n💡 Why it matters:\nStored XSS via SSTI can lead to session hijacking, data exfiltration, or even account takeover.","datePublished":"2026-04-12T07:11:02Z","dateModified":"2026-04-12T07:11:02Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":87},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":18,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/980","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/980","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/980","headline":"come vc anyone know about facebook ads https://t.me/Hacking_Vidhya?livestream=64c2d81213eaf33140","articleBody":"come vc anyone know about facebook ads \n\n\n\nhttps://t.me/Hacking_Vidhya?livestream=64c2d81213eaf33140","datePublished":"2026-04-11T16:54:16Z","dateModified":"2026-04-11T16:54:16Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":85}]}},{"@type":"ListItem","position":19,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/978","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/978","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/978","headline":"Next.js + WAF Bypass + SXSS via Cookie Reordering Attack Summary: You’re dealing with: 🔍 A Next.js app Two re…","articleBody":"Next.js + WAF Bypass + SXSS via Cookie Reordering\n\nAttack Summary:\nYou’re dealing with:\n\n🔍 A Next.js app\n\nTwo reflected cookies in pageProps\nA WAF blocking your initial attempts\n\n🧪 Observations:\n🧨 Single payload → 403 Forbidden\n\n🧨 Split payload across two cookies → Still 403\n\n🧨 Reorder the cookie fragments → 200 OK ✅\n\nReversing the order bypasses the WAF inspection logic \n\nNow chain it with:\n\nCVE-2024-46982 (Elixir Stale SSR template injection)\n https://github.com/masch1/CVE-2024-46982\n\n➡️ This allows CP (Client-side Prototype Pollution) → Stored XSS (SXSS) in Next.js apps.\n\nExploit Flow:\n 💎 Bypass WAF via cookie reordering\n 💎 Inject CP payload using stale Elixir template vuln\n 💎 Achieve SXSS across all visiting users!\n\nMitigation Tips:\n ✅ Sanitize cookie inputs server-side\n ✅ Audit template engines for unsafe parsing\n ✅ Patch Elixir if in stack (see CVE-2024-46982)\n\n#bugbounty #nextjs #xss #sxss #wafbypass #infosec #cybersecurity #cve2024_46982","datePublished":"2026-04-11T07:11:02Z","dateModified":"2026-04-11T07:11:02Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":85},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1}]}},{"@type":"ListItem","position":20,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/977","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/977","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/977","headline":"⚔️ Top 15 Vulnerability Scanners 🔹Nuclei - https://github.com/projectdiscovery/nuclei 🔹Sn1per - https://githu…","articleBody":"⚔️ Top 15 Vulnerability Scanners\n\n🔹Nuclei - https://github.com/projectdiscovery/nuclei\n🔹Sn1per - https://github.com/1N3/Sn1per\n🔹Metasploit - Framework - https://github.com/rapid7/metasploit-framework\n🔹Nikto - https://github.com/sullo/nikto\n🔹Arachni - https://github.com/Arachni/arachni\n🔹Jaeles - https://github.com/jaeles-project/jaeles\n🔹Retire.js - https://github.com/retirejs/retire.js/\n🔹Osmedeus - https://github.com/j3ssie/osmedeus\n🔹Getsploit - https://github.com/vulnersCom/getsploit\n🔹Flan - https://github.com/google-research/FLAN\n🔹Findsploit - https://github.com/1N3/findsploit\n🔹Blackwidow - https://github.com/1N3/BlackWidow\n🔹Backslash-powered-scanner - https://github.com/PortSwigger/backslash-powered-scanner\n🔹Eagle - https://github.com/BitTheByte/Eagle\n🔹Cariddi - https://github.com/edoardottt/cariddi\n\n🔖 #infosec #cybersecurity #pentesting #security","datePublished":"2026-04-11T04:48:16Z","dateModified":"2026-04-11T04:48:16Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"image":["https://n3.tlmtr.cc/p/_e5a1B6s-cirYh276j7Ppak4C7QefX6cmcffKweZgYfQ?ty=l"],"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":96},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":5}]}}]}

385

https://t.me/Hacking_Vidhya?livestream=f60e104989406cf4c0

385

#MLSecOps #Whitepaper "System Card: Claude Mythos Preview", April 8 2026. // Claude Mythos Preview - new LLM from Anthropic. In particular, it has demonstrated powerful cybersecurity skills, which can be used for both defensive purposes (finding and fixing vulnerabilities in software code) and offensive purposes (designing sophisticated ways to exploit those vulnerabilities)

385

https://github.com/BlackSnufkin/BYOVD BYOVD is a collection of PoCs demonstrating how vulnerable drivers can be exploited to disable AV/EDR solutions.

385

1st Upgrading Non-Interactive Shells.ts52.08 MB

385

Most beginners don’t fail at bug bounty because it’s “too hard.” They fail because they jump between tools, watch random tutorials, and call that learning. No structure = no results. You don’t need more tools. You need a path. Something that shows: what to learn → what to practice → how to actually find bugs. That’s where these come in: * https://resources.codelivly.com/product/bug-bounty-beginner-editions/ * https://resources.codelivly.com/product/the-ultimate-bug-bounty-starter-pack/ They’re not theory dumps. It’s the stuff you actually use—recon, XSS, SQLi, reporting—step by step. If you’re tired of “learning” but not earning, this might fix that. Check it out if it clicks.

385

https://drive.google.com/drive/folders/1KRpR_VF-L1jOO8GWjp-DKZk39m4FNmzf

385

RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience, Apr. 2026. MarkLLM An Open-Source Toolkit for LLM Watermarking PMark Towards Robust and Distortion-free Semantic-level Watermarking With Multiple Channel Constraints Open-Source Toolkit for LLM Watermarking #offensivesecurity #tools #llm #mlsecops

385

did you try labs.bugthrive.com ??

Anonymous voting

385

https://t.me/Hacking_Vidhya?livestream=f60e104989406cf4c0

385

kisi k pass solution h to batao @sttexo

385

Wordlist for Directory fuzzing

385

https://t.me/boost/Hacking_Vidhya

385

Telegram OSINT (part of OSINT Master Toolkit by zhetikal77) Guides Tools lists Search engines Channels directories https://cyberz7.github.io/Ghostint-Tools/ #socmint

385

Fuzz for directories without killing the host: cat subdomains.txt | while read -r host;do bash http://fuzy,sh $host;done #bugbounty #bugbountytips #cybersecurity #bugbountytip

385

🚀 New Tool Drop: CypherBypass403 👀

Most people stop at 403 Forbidden ❌ We go deeper 💀 🔗 https://github.com/CypherBinu/CypherBypass403 ⚡ Automate 403 bypass ⚡ Find hidden endpoints 🧪 Includes practice lab Perfect for Bug Bounty hunters & pentesters 🔥 🐦 Follow on X for more: https://x.com/CypherBinu #BugBounty #CyberSecurity #EthicalHacking #Pentesting #InfoSec

@Hacktsuki @HacktsukiCommunity

385

💥 SSTI in Go Templates = Stored XSS? If you come across SSTI (Server-Side Template Injection) in a Go (Golang) application, don’t stop at just proving injection — go for impact! Try this payload to bypass HTML sanitization and achieve XSS : {{define "T1"}}{{end}} {{template "T1"}} 🔍 This works because: 💎 Go templates treat {{define}} and {{template}} as dynamic blocks. ⚡️ You can inject arbitrary template logic including script tags. 🔸 Useful in misconfigured custom template rendering engines. 💡 Why it matters: Stored XSS via SSTI can lead to session hijacking, data exfiltration, or even account takeover.

385

come vc anyone know about facebook ads https://t.me/Hacking_Vidhya?livestream=64c2d81213eaf33140

385

Next.js + WAF Bypass + SXSS via Cookie Reordering Attack Summary: You’re dealing with: 🔍 A Next.js app Two reflected cookies in pageProps A WAF blocking your initial attempts 🧪 Observations: 🧨 Single payload → 403 Forbidden 🧨 Split payload across two cookies → Still 403 🧨 Reorder the cookie fragments → 200 OK ✅ Reversing the order bypasses the WAF inspection logic Now chain it with: CVE-2024-46982 (Elixir Stale SSR template injection) https://github.com/masch1/CVE-2024-46982 ➡️ This allows CP (Client-side Prototype Pollution) → Stored XSS (SXSS) in Next.js apps. Exploit Flow: 💎 Bypass WAF via cookie reordering 💎 Inject CP payload using stale Elixir template vuln 💎 Achieve SXSS across all visiting users! Mitigation Tips: ✅ Sanitize cookie inputs server-side ✅ Audit template engines for unsafe parsing ✅ Patch Elixir if in stack (see CVE-2024-46982) #bugbounty #nextjs #xss #sxss #wafbypass #infosec #cybersecurity #cve2024_46982

385