Kn1ght

I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like. If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs and what anomalous look might like. github.com/nasbench/Misc-…

@F4tM4n2k Nice bro 😎

Fun enough with critical #bugbounty #intigriti

🚨XSS Found🚨 1⃣ katana -u "url" -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -kf -jc -fx -ef woff,css,png,svg,jpg,woff2,jpeg,gif,svg thx man @coffinxp7 🥂 2⃣ nuclei -t /string/dast/ -dast -headless 3⃣ Confirm payloads!

@coffinxp7 Brother, some time ago I made this tool for when you're targeting a large number of subdomains. The idea was to create a fast tool for discovery. github.com/Acorzo1983/Ali… #bugbounty #hacking #cybersecurity

h1-6102 @Hacker0x01 @salesforce

After going through all the comments and questions about setting up IDN domains and using Punycode based emails, I finally made a video that covers everything step by step. I’m confident this will help many of you land some serious bounties! youtu.be/Cj1sOFHDClM?si…

This #NahamCon2025 talk has generated over $50,000 in bounties for @YShahinzadeh and a few other hackers: Puny-Code, 0-Click Account Takeover. 🎥👉🏼youtu.be/4CCghc7eUgI

🔍 Bug Bounty Web Checklist Track your web pentesting progress by checking each subcategory. nemocyberworld.github.io/BugBountyCheck…

📋 Detailed Checklist: Android APK Pentesting Checklist Checklist: book.hacktricks.xyz/mobile-pentest… #infosec

"Business logic allows any user to be blocked from creating an account" @jeetpal2007/business-logic-allows-any-user-to-be-blocked-from-creating-an-account-6a7ab7013ccc" target="_blank" rel="nofollow noopener">medium.com/@jeetpal2007/b… #bugbounty #bugbountytips

API Hacking - Cracking JWT Tokens ghostlulz.com/blog/api-hacki… Pre Account Takeover ghostlulz.com/blog/pre-accou… XSS With Polyglots ghostlulz.com/blog/smart-xss… React JS SourceMaps to XSS ghostlulz.com/blog/reactjs-s… Bypass AI Powered Wafs ghostlulz.com/blog/bypass-ai… #bugbounty #bugbountytips #bugbountytip #infosec #xss #OWASP #redteam #pentest #hackerone #bugcrowd

Want to master client-side bugs? 😎 Check out this extensive GitHub repository with tens of different resources curated by @zomasec! 🔗 github.com/zomasec/client…

Vibe coding? Nah, Hacking with a vibe 🌆🗽

While learning and practicing website application security and exploitation, also learn to hack APIs effectively. portswigger.net/web-security/l…

SQL Injection

🎁Monthly Giveaway🎁 Hack The Box 6-month VIP+ - Follow, Like, and Retweet to join! - Winners will be picked randomly on 5 June. #hackthebox #giveaway #projectsekaictf

🔥 𝐀𝐈 𝐑𝐞𝐝 𝐓𝐞𝐚𝐦𝐢𝐧𝐠 𝐏𝐥𝐚𝐲𝐠𝐫𝐨𝐮𝐧𝐝 𝐋𝐚𝐛𝐬 from @Microsoft 12 free labs to up-level your hacking skills from the “AI Red Teaming in Practice” Black Hat training, covering: - Credential exfiltration - Extracting a secret from the metaprompt - Indirect prompt injection - and more! Super cool that this was open sourced, huge shout-out to Dr. Amanda Minnich (AIRT), Gary L., Martin Pouliot, and anyone else involved 🙏 🔗 github.com/microsoft/AI-R…

Want to quickly and easily import BChecks and Bambdas to your library? 👀 Check out Extensibility Helper on the BApp Store! 📄 Pull scripts directly from the PortSwigger community repositories, or provide your own for a custom store experience.

Built a Burp Suite extension to run SQLmap directly from the GUI. No more saving HTTP requests + jumping to terminal. Just: – Mark param with * – Right-click → Send to SQLmap – Pick options → Run Linux-only for now. Windows support coming soon. Full write-up: @YousefAlotaibi/burp-suite-integration-with-sqlmap-8ee7c65e2a1e" target="_blank" rel="nofollow noopener">medium.com/@YousefAlotaib… #BurpSuite #SQLmap #CyberSecurity #BugBounty #RedTeam #infosec