Amal PK

Vulhub Vulhub is an open-source collection of pre-built vulnerable docker environments for security researchers and educators. Explore Environments GitHub 19.0k+ Stars • 4.6k+ Forks • 298 Environments # Clone the repository git clone --depth 1 https://github.com/vulhub/vulhub.git # Enter the directory cd vulhub/spring/CVE-2022-22947 # Start the environment docker compose up -d

🏖️🐻 Les Logiciels Libres de l'été, jour 32 :

Vulhub : un projet Open Source offrant des environnements vulnérables préconstruits basés sur Docker-Compose. Idéal pour tester et apprendre la gestion des vulnérabilités, chaque environnement inclut un guide d'installation et d'utilisation.

Install Docker (example for Ubuntu 24.04): # Install the latest version docker curl -s https://get.docker.com/ | sh # Run docker service systemctl start docker For other operating systems, see the Docker documentation. Although all Vulhub environments are running based on Docker Compose, you no longer need to install docker-compose separately. Instead, you can use the built-in docker compose command to start Vulhub environments. Download and set up Vulhub: git clone --depth 1 https://github.com/vulhub/vulhub Launch a vulnerable environment: cd vulhub/langflow/CVE-2025-3248 # Example: enter a vulnerability directory docker compose up -d Each environment directory contains a detailed README with reproduction steps and usage instructions. Clean up after testing: docker compose down -v

🔗 Liens utiles Vulhub :

👉 Le projet : github.com/vulhub/vu...
👉 En savoir plus : https://vulhub.org/

Sponsorisez Vulhub ❤️ : github.com/sponsors/...

Most open redirects are low-severity or N/A.

But used creatively, they can become high impact gadgets.

Here are 4 ways to show impact with open redirects:

Host Header Injection: How One Header Can Break Your Web App Discover how Host Header Injection works, its risks, real-world attack examples, and steps to secure your web applications from this hidden threat.

Wrote a blog on Hostheader injection and how we can use this to manipulate the forgot password Link.

blog.amalpk.in/host-header-...

#cybersecurity #bugbounty #bug #web #vapt #hacking

NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL database.

Read my new Blog here:
blog.amalpk.in/nosql-inject...

Bypassing Detections with Command-Line Obfuscation Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits exec...

Bypassing Detections with Command-Line Obfuscation

www.wietzebeukema.nl/blog/bypassi...

We've just released Shadow Repeater, for AI-enhanced manual testing. Simply use Burp Repeater as you normally would, and behind the scenes Shadow Repeater will learn from your attacks, try payload permutations, and report any discoveries via Organizer.

portswigger.net/research/sha...

Client Side Path Traversal (CSPT) - A Deep Dive into an Overlooked Vulnerability Exploring Client-Side Path Traversal (CSPT): How Attackers Exploit API Requests to Bypass Security and Exfiltrate Data

Client-Side Path Traversal (CSPT): The Overlooked Vulnerability.

Read more about this on my new blog: 0xkratos.medium.com/client-side-...

#cybersecurity #bugbounty #hacking

URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS ...

Check out the newest version here:
portswigger.net/web-security...

Null byte tricks:
portswigger.net/web-security...

This article on Solr and its (in)security is really good 💎

And I strongly recommend to read @hacefresko.com previous article on Solr before diving in this one (I will share the link in my reply)

🛠️ waymore: Tip #1 📝

By default, waymore will get URLs and download responses (-mode B).
If you just want URLs, then use "-mode U".
If you just want to download archived responses, then use "-mode R".

🤘

Yesterday I discovered a tweet of mine was referenced in the book "Attacking and Exploiting Modern Web Applications: Discover the mindset, techniques, and tools to perform modern web attacks and exploitation"

www.amazon.nl/-/en/Simone-...

Since I deleted my account, this is the tweet:

made an archive collection site thing for all the x3ctf web design stuff i did

the intro/outro can be rewatched with websocket replay data (eg the messages and synced mouse cursors)

and the platform itself has emulations for auth and flags and stuff

u can check it out at x3c.tf/archive/

PHP Type Juggling Vulnerabilities: How Attackers Exploit Loose Comparisons PHP type juggling can lead to security vulnerabilities. Learn how attackers exploit it and how to secure your web applications.

Simple Blog about PHP Type Juggling

Read More: 0xkratos.medium.com/php-type-jug...

#cybersecurity #bugbounty #bug #php #programming

Thanks man!

Do this count:
0xkrat0s.github.io
And 0xkratos.medium.com

If so please add me to the list.

Web Cache Deception: Understanding and Mitigating Security Risks Learn about Web Cache Deception and Cache Poisoning, how they exploit misconfigured caches, and tips to prevent these vulnerabilities in…

Wrote a blog about Web Cache Deception.

Read here: 0xkratos.medium.com/web-cache-de...

#WebSecurity #cybersecurity #pentesting #InfoSec #bugbbounty

GET /%0D%0ASet-Cookie: foo=bar 403 Forbidden GET /%E4%BC%8D%E4%BC%8ASet-Cookie: foo=bar 200 OK Set-Cookie: foo=bar

Discover blocklist bypasses via unicode overflows using the latest updates to ActiveScan++, Hackvertor & Shazzer! Thanks to Ryan Barnett and Neh Patel for sharing this technique.

portswigger.net/research/byp...

Is there a way to run alert() when "alert" is blocked by a WAF and unsafe-eval is not allowed?

This one is good😲

CVE-2025-21298 Windows OLE Remote Code Execution Vulnerability!

A critical vulnerability in Windows Object Linking and Embedding (OLE) technology, which enables remote code execution (RCE) with a CVSS severity score of 9.8.

Read more: 0xkrat0s.github.io/posts/CVE-20...

A good old trick for bypassing WAF/filters while testing for command injection using shell globbing / wildcard expansion.

Read More: 0xkrat0s.github.io/posts/Shell-...

#bash #waf #bypass #bugbounty. #cybersecurity

Be like OP.

Right 📈

Suggest me some topics for my blog!

Link: 0xKrat0s.github.io

#bugbounty #infosec #cybersecurity #bug #hacking #tech

First blog post of the new year and this is one I've been meaning to write up for a while which is some details on #Kubernetes API Server proxy feature and how it might be possible to use some known weaknesses in it to escalate your privileges in a cluster.

raesene.github.io/blog/2025/01...

The Simpsons 'Prediction' !
Internet Blackout On January 16, 2025?

:(

0x999's Blog - Exploring Javascript events & Bypassing WAFs via character normalization

Just published a new blog post "Exploring Javascript events & Bypassing WAFs via character normalization", check it out: 0x999.net/blog/explori...

Post: Mutation XSS: Explained, CVE and Challenge | Jorian Woltjer Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online

To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all.
If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this!
jorianwoltjer.com/blog/p/hacki...