r3s1n

Do you remember when you joined X? I do! #MyXAnniversary

Working on researching AD/windows exploitation. Lots of things to learn!

Amazing story🥲: A guy from our Discord found a poor cat in the garden. The cat had an animal RFID tag implant (FDX-B 134kHz), so he scanned it with Flipper, found the cat's owner via the local animal ID database, and they were reunited Turned out that 🐈 was missing for 2 years!

Do you remember when you joined Twitter? I do! #MyTwitterAnniversary

How bypass HTML to Reflected XSS I using KNOXSS payload to bypass it KNOXSS Payload👇👇 "--!><Svg/Onload=confirm`cookie`>"

After 6 months of hard work... Monad is finally going to be launched in its open beta phase!!! It will be available at **beta.monad.ilioslabs.dev**. Twitter: x.com/IliosLabs ProductHunt: producthunt.com/posts/monad Discord: discord.gg/b8ugMm7nvc #Monad #launchday

Here's a mind map I made to help you with Linux privilege escalation

So, I now have full remote control of over 20 Tesla’s in 10 countries and there seems to be no way to find the owners and report it to them…

Monad is on ProductHunt! Check it out at producthunt.com/posts/monad and make sure to upvote + share the link so we can get a great launch on the 23rd!

Just wanted to let you all know, @IliosLabs is working on a new project called Monad, which lets you share your own code snippets with a really intuitive tagging system. I'd definitely suggest checking them out when it releases! #infosec #bugbountytips

Shoutout to @ResinSec for hacking Monad and alerting us to many vulnerabilities!

Nginx Path Traversal @403Timeout httpx -l url.txt -path "///////../../../../../../etc/passwd" -status-code -mc 200 -ms 'root:' #bugbountytips #infosec

Privacy is a human right.

If the main endpoint is forbidden we can also check for the backup file. /blog/wp-config.php => 403 Forbidden /blog/wp-config.php.bkp => 200 OK #bugbountytips #bugbounty #infosec

Bypass Defender AV static detection: If you name a malicious file DumpStack.log Defender doesn't scan it.

Cache Poisoning at Scale: Identifying and Exploiting over 70 Cache Poisoning Vulnerabilities youst.in/posts/cache-po…

@rootxyash Biggest security risk to most WordPress sites is plugins/themes. Fingerprint the versions being used and try to see if a CVE exists. If so, how easy would it be to make a PoC? Is there an existing exploit on github/exploit-db?

@rootxyash Most of the time SSRF via xmlrpc.php will be closed as N/A or informational. Usually cited on the basis that HTTP and DNS requests aren't valid vulnerabilities unless you could exfiltrate information, which you can't do here

A thread all about Common Vulnerabilities in WordPress Websites. Retweet this and let others to know about this (•‿•)

You are under no obligation to remain the same person you were a year ago, a month ago, or even a day ago. You are here to create yourself, continuously.