shinraa @R4THnull

Akamai Waf bypass tip found by @bountyforge_ ai Normal curl /browser on the expample.com =403 But using AWS origin ip returned 301

keyboard_arrow_left Previous keyboard_arrow_right Next

I detected SSRF in an external request in an Android app using the Intent.getSelector() (SEL) bypass. I did this with my custom AndroScope tool, which I've been developing for 3 years. If you're curious about what AndroScope is, visit: ynsmroztas.github.io/androscope.html I haven't made it publicly available yet, but I will be sharing it in a limited way soon 🌹🥳🥳 #BugBounty #infosec #android #AppSec #BugBountytip #BugBountytips #infosec #recon

Node2Shell PoC is now public. CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE. No execSync. No eval. No fake webhook. The brotli decoder itself can reach system(). PoC: github.com/syrex1013/CVE-… #Node2Shell #NodeJS #CVE #InfoSec

I found this interesting "403 Forbidden" Bypass; through "Microsoft-Azure-Application-Gateway/v2" 1. Accessing the URL returns "403 Forbidden" 2. Appending the query "?x=.js", successfully bypasses the Azure restriction leading to direct access to the restricted resource.

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC: github.com/Boreas37/CVE-2…

php2shell - CVE-2026-109618 / CVE-2026-109619 github.com/ikow/php2shell…

PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm Watchtowr Labs confirmed that the flaws are real. Both vulnerabilities are due to be disclosed on Thursday, October 22, alongside patches. Until those advisories land, no fix is available, which leaves the flaws as zero-days in PHP installations everywhere.There is currently a scheduled release of an advisement and possible patch on Wednesday, October 21 2026 at 14:00 UTC. Below is a video of a researcher, maybe the original researcher, showcasing the exploits. #CTI #BlueTeam #ThreatIntel #CVE-2026-109618 #CVE-2026-109619

API security is where most modern breaches begin. My API-Pentesting-Tools repo gathers specialized tools for testing and analyzing API vulnerabilities in one place. Add it to your toolkit and test APIs like an attacker would. Explore it here: github.com/yogsec/API-Pen… #apisecurity #pentesting #infosec #bugbounty #github

WIRESHARK

XXE to LFI -> results are in PDF and its preview.....Weird bug I encountered today...🫡 #bugbounty

"3 bugs chains" (IDOR+Broken Auth+ Blind XSS) #CTF #bugbounty #bugbountytips #bugbountytip

Another good hunt tonight. Nginx merge slashes path traversal vulnerability in one of the popular tech giant. Path Traversals can be soo simple. 🔥 Payload: GET ///////../../../etc/passwd Credit: @__nav1n_ #bugbountytips #bugbountytip #bugbounty

0-Click RCE on the Tesla Infotainment Through Cellular Network cc @_p0ly_ @vdehors synacktiv.com/sites/default/…

keyboard_arrow_left Previous keyboard_arrow_right Next

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty. Write-up: samchen.blog/blog/vscode-ne…

Blind SSRF to full read SSRF 👀 Found a PDF export API with no login required. Injected HTML to make the render server fetch internal URLs and got the control plane's debug page right in my downloaded PDF. #BugBounty #SSRF #Cybersecurity

SQLi with HoneySQL Maps A JSON field that should be a number, sent as a map, becomes SQL: {"id":{"raw":"1 or 1=1"}} HoneySQL is the default SQL builder for Clojure apps, and it turns the JSON you send into database queries. Some keys are instructions, not data. :raw means insert this as literal SQL, so the value runs as code. This is real. Metabase, GHSA-vwf4-m7j8-wcjf (CVE-2026-72898), unauthenticated, CVSS 10.0, exploited in the wild, now patched across v1.58 to v1.63. Its reset_password endpoint took a user-id as a raw map and compiled it straight to SQL: {"user-id":{"raw":"1 OR is_superuser=1 --"}} That pulls the first superuser row, and the reset flow then overwrites that admin’s password. Full takeover from one unauthenticated request. The bug is not HoneySQL. It is the app passing a JSON field to the builder without checking it is a number. Signature filters dodge the same way, since the SQL rides inside a string. Escape the keywords in that first payload and the parser decodes them before HoneySQL ever sees them: {"id":{"raw":"1 \u004fR 1\u003d1"}} More payloads: Read a column: {"id":{"raw":"(SELECT password FROM core_user LIMIT 1)"}} Blind, time-based: {"id":{"raw":"1 OR 1=(SELECT 1 FROM pg_sleep(5))"}} Blind, boolean: {"id":{"raw":"1 OR substr((SELECT password FROM core_user LIMIT 1),1,1)='a'"}} Any Clojure app on HoneySQL that lets a JSON field reach the query builder untyped is open to this.

Can you change the response without changing the cache key? In Repeater, add 👇 X-Forwarded-Host: cache-test.example Then compare the response. If the header changes the response but the cache does not include it in its key, it is an unkeyed input. When that altered response is cached, later requests with the same cache key can receive it too. Find the ignored input in the free labs 👇 portswigger.net/web-security/w…

File upload extension bypass new method🔥 in media upload section you can upload files like: .png .jpg .txt but if you upload any php file it block: .php .jpg.php .php7 .shtml Bypass: ".php " (just add a simple space after .php) CC: @darkshadow2bd #bugbountytips #bugbountytip

keyboard_arrow_left Previous keyboard_arrow_right Next

Exploit for CVE-2026-83834: github.com/wkpwn/CVE-2026… (my first windows exploit!!!!)