Email Verification Bypass during Account Creation | Insecure Design ⌘ Read more
How to Create a Botnet Using One Tool: A Proof of Concept for Educational Purposes Aspiring…
Learn how attackers build and control botnets — safely and ethically — using … ⌘ Read more
**Burp, Bounce, and Break: How Web Cache Poisoning Let Me Control the App **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/burp-bounce-and-break-how-web-cache-poisoning-let-me-con … ⌘ Read more
OWASP Juice Shop | Part 2 — Bully Chatbot ⌘ Read more
OWASP Juice Shop | Part 1 — ScoreBoard Solution — StrawHat Hackers ⌘ Read more
How to Set Up a Honeypot for Your Apache2 Server ⌘ Read more
.(s) / dot(s) like @eapl.me are valid? 🤔 Or nicks even? 🤔
on timeline the mention looks OK. Is there an issue on Yarn?
It’s an interesting topic. For example on Bsky it’s natural to allow domains https://bsky.social/about/blog/4-28-2023-domain-handle-tutorial
Although TwiXter only allows (letters A-Z, numbers 0-9 and of underscores)
https://help.x.com/en/managing-your-account/x-username-rules
@aelaraji@aelaraji.com I use to be a pot or more a day but have cut that back in the last 4 or so years to just 2-3 cups. Main reason was because I was getting jittery which didn’t happen before. I do think it is good to go without periodically (probably applies to more things than coffee) to just reset the system.
I don’t drink it often but decaf’s taste has gotten better too.
I Lost $3,750 in 30 Seconds — The ATO Bug 99% of Hackers Miss (Here’s How to Avoid It)
The 1 Burp Suite Mistake That Cost Me $3,750 — Fix It in 30 Seconds
[Continue reading on InfoSec Writ … ⌘ Read more
SOC L1 Alert Reporting : Step-by-Step Walkthrough | Tryhackme
As a SOC analyst, it is important to detect high-severity logs and handle them to protect against disasters. A SOC analyst plays the…
[Continue reading on InfoSec Write-ups … ⌘ Read more
**404 to 0wnage: How a Broken Link Led Me to Admin Panel Access **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/404-to-0wnage-how-a-broken-link-led-me-to-admin-panel-access-2b58e1fffaa3?source=r … ⌘ Read more
How to Start Bug Bounty in 2025 (No Experience, No Problem)
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-to-start-bug-bounty-in-2025-no-experience-no-problem-89adc68da592?source=rss—-7b … ⌘ Read more
️ Hacking and Securing Kubernetes: A Deep Dive into Cluster Security
Disclaimer: This document is for educational purposes only. Exploiting systems without authorization is illegal and punishable by … ⌘ Read more
I had Chick-fil-A breakfast today (sausage, egg, and cheese biscuit, hash browns, coffee, and orange juice). Then at lunch my work place offered hot dogs. I had two (kosher, if that matters), plus a coke, a macadamia nuts cookie, and a small chocolate brownie.
So, here I am, at home, feeling hungry but guilty and refusing to eat anything else for the rest of the day. To top it off, I have only clocked 4,000 steps today (and I don’t feel like walking). I am going to hell, am I?
This is something for @movq@www.uninformativ.de and old OS hobbyists alike: FreeDOS 1.4! Get it while it’s hot!
See:
<textarea id="text" name="text" placeholder="Hi! 👋 Don't forget to post a Twt today!" rows="4" maxlength="576" required="true" aria-required="true"></textarea>
So, 576?
️ Free TryHackMe Jr Penetration Tester Roadmap with Resources and Labs
A free, TryHackMe-inspired roadmap with resources and labs to kickstart your penetration testing journey.
[Continue read … ⌘ Read more
5 Tools I Wish I Knew When I Started Hacking ⌘ Read more
Black Basta Leak Analysis ⌘ Read more
I Clicked a Random Button in Google Slides — Then Google Paid Me $2,240
The strange trick that exposed a hidden security flaw (and how you can find bugs like this too).
[Continue reading on InfoSec Write-ups »](https://in … ⌘ Read more
Lab: Exploiting an API endpoint using documentation
We will solve this lab based on the API documentation exposed to delete Carlos’s user.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/lab-exploiting-an-api-endpoint-using-d … ⌘ Read more
** HTTP Parameter Pollution: The Dirty Little Secret That Gave Me Full Backend Access ️**
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.co … ⌘ Read more
irc.mills.io running behind Caddy Layer 4. However I don't terminate TLS at the edge in this case.
@bender@twtxt.net Sure! 👍
{
...
# Layer 4 Reverse Proxy
layer4 {
# Gopher
0.0.0.0:70 {
route {
proxy <internal_ip>:70
}
}
# IRC (TLS)
0.0.0.0:6697 {
route {
proxy <internal_ip>:6697
}
}
}
}
**(#zhlsx2q) @bender@bender Sure! 👍
{
...
# Layer 4 Reverse Proxy
layer4 {
# Gopher
0.0.0.0:70 {
route { ...**
[@bender _@twtxt.net_](https://twtxt.net/user/bender/) Sure! 👍
{
...
# Layer 4 Reverse Proxy
layer4 {
# Gopher
0.0.0.0:70 {
route {
proxy <internal_ip>:70
}
}
# IRC (TLS)
0.0.0.0:6697 {
route {
proxy <internal_ip>:6697
}
}
}
}
⌘ [Read more](https://twtxt.net/twt/stxbcda)
Chaining Bugs Like a Hacker: IDOR to Account Takeover in 10 Minutes
🚀Free Article Link…
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/chaining-bugs-like-a-hacker-idor-to-account-takeover-in-1 … ⌘ Read more
Reflected XSS using Bookmark ⌘ Read more
Exposed Secrets in JavaScript Files
🔥Free Article https://medium.com/@Abhijeet_kumawat_/exposed-secrets-in-javascript-files-430a76834952?sk=ffd9ca6c8ede38ac77dcb68a507b9299
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/exposed-secrets-in-javascript-fi … ⌘ Read more
**How I Hijacked OAuth Tokens Through a Parallel Auth Flow Race Condition — $8500 P1 Bug Bounty ** ⌘ Read more
BL!ND.exe || Breaching Databases in Total Silence ⌘ Read more
Time-Based Blind SQL Injection: “Hack the Clock” ⌘ Read more
Wazuh Installation & Configuration: A Step-by-Step Tutorial
Hello, my digital adventurers! In this article, I will provide you with a step-by-step guide for installing and configuring the Wazuh…
[Continue reading on InfoSec Write-ups » … ⌘ Read more
**CORSplay of the Century: How I Hijacked APIs with One Misconfigured Header **
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/corsplay-of-the-century-how-i-hijacked-apis- … ⌘ Read more
**Bypassing Like a Pro: How I Fooled the WAF and Made It Pay **
Hi there!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bypassing-like-a-pro-how-i-fooled-the-waf-and-made-it-pay-e433193e1d9d?source=rss—-7b722bf … ⌘ Read more
@kat@yarn.girlonthemoon.xyz it’s up but idk it’s kinda boring i hope it’s helpful though https://stash.4-walls.net/irc1/
@kate@yarn.girlonthemoon.xyz I already have my IRC server irc.mills.io running behind Caddy Layer 4. However I don’t terminate TLS at the edge in this case.
(#w576vrq) @kate@kate I already have my IRC server irc.mills.io running behind Caddy Layer 4. However I don’t terminate TLS …
@kate @yarn.girlonthemoon.xyz I already have my IRC server irc.mills.io running behind Caddy Layer 4. However I don’t terminate TLS at the edge in this case. ⌘ Read more
Everything Trump is doing makes perfect sense if you understand one simple fact
Thom Hartmann, Commentator - Raw Story
Stephan: I think Thom Hartmann’s assessment of Directator Trump Is very insightful. It certainly agrees with what I have been telling you for years.
Top Stories: iPhone 17 Pro Rumors, CarPlay Bug Fix, and More
This week saw rumor updates on the iPhone 17 Pro and next-generation Vision Pro, while a minor iOS 18.4.1 update delivered not just security fixes but also a fix for some CarPlay issues.
We also looked ahead at what else is in Apple’s pipeline for the rest of 2025 and even the 20th-anniversary iPhone coming in 2027, so read on belo … ⌘ Read more
WAF Bypass Masterclass: Using SQLMap with Proxychains and Tamper Scripts Against Cloudflare &…
A hands-on guide to understanding and testing WAF evasion techniques usin … ⌘ Read more
Burp Suite Beyond Basics: Hidden Features That Save Time and Find More Bugs
📌Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/burp-suite-beyond-basics-hidden-f … ⌘ Read more
Obfuscation Isn’t a Fix, And It Cost Them $2,500 — A Real-World Case Study ⌘ Read more
ResolverRAT: A Sophisticated Threat Targeting Healthcare and Pharma
he healthcare and pharmaceutical sectors are prime targets for cybercriminals due to their sensitive data and critical infrastructure. In…
[Continue read … ⌘ Read more
** CVSS 10.0 Critical Vulnerability in Erlang/OTP’s SSH: Unauthenticated Remote Code Execution Risk**
A critical security vulnerability (CVE-2025–32433) with a CVSS … ⌘ Read more
Automating GraphQL Bug Bounty Hunting with GrapeQL ⌘ Read more
7k words of docs on deploying a livejournal folk. you absolutely want to read 7 thousand words of me forcing dreamwidth into production shape in docker https://stash.4-walls.net/selfhostdw/
Open Your Favorite Chat Right From Your iPhone Lock Screen
In iOS 18.4, Apple added a new Shortcuts action to open a specific conversation in the Messages app. This means it’s now possible to open a chat thread with someone important to you straight from your Lock Screen, for example. Keep reading to learn more.
If you’d like to reduce the time it takes to chat with a frequently conta … ⌘ Read more
️♂️ “I Didn’t Plan to Find a P1… But My Script Had Other Plans ” ⌘ Read more
Top 20 Linux Commands Every Pentester Should Know ⌘ Read more
Secret tricks to get hidden information in Bug Bounty
This article gives you a best and hidden tricks to find secret or hidden information from GitHub. we can call hidden approach on GitHub.
[Continue reading on InfoSec Write-ups »](https:/ … ⌘ Read more
Hacking and Securing Docker Containers: A Deep Dive into Common Vulnerabilities and Test Cases
Disclaimer: This document is for educational purposes only. Exploiti … ⌘ Read more
Why The End of MITRE’s CVE Isn’t A Big Deal ⌘ Read more
Hacking Linux with Zombie Processes ⌘ Read more
️ Blind XSS Attack in Production: My Favorite Exploit with a Delayed Surprise
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8F-bli … ⌘ Read more
iOS 18.4.1 Update Released with CarPlay Fix & Security Patches
Apple has released iOS 18.4.1 update for iPhone, along with iPadOS 18.4.1 for iPad. The software updates include a few bug fixes and important security patches, making them recommended to update. Additionally, iOS 18.4.1 includes a bug fix for a particular issue with CarPlay not connecting properly in some situations. If you have been experiencing … [Read More](https://osxdaily.com/2025/04/16/ios-18-4-1-up … ⌘ Read more
MacOS Sequoia 15.4.1 Update Released with Bug & Security Fixes
Apple has released MacOS Sequoia 15.4.1 as a software update for Mac users running the Sequoia operating system. The update focuses exclusively on security updates and bug fixes, and contains no new features. Separately, Apple also released iOS 18.4.1 for iPhone, iPadOS 18.4.1 for iPad, and updates to tvOS, watchOS, and visionOS, and those updates … [Read More](https://osxdaily.com/2025/04/16/macos-sequoia-15- … ⌘ Read more
Security updates for Wednesday
Security updates have been issued by AlmaLinux (gvisor-tap-vsock, kernel, and kernel-rt), Fedora (chromium, dnf, dotnet9.0, golang, lemonldap-ng, mariadb10.11, perl-Crypt-URandom-Token, perl-DBIx-Class-EncodedColumn, php-tcpdf, podman-tui, and trunk), Red Hat (java-17-openjdk and kernel), Slackware (mozilla), SUSE (apache2-mod_auth_openidc, cosign, etcd, expat, flannel, kernel, libsqlite3-0, libvarnishapi3, mozjs52, Multi-Linux Manager 4.3: Server, Multi-Linux Manager 5.0: Server, … ⌘ Read more
Apple Releases iOS 18.4.1 With Bug Fixes
Apple today released iOS 18.4.1 and iPadOS 18.4.1, minor updates to the iOS 18 and iPadOS 18 operating systems that came out last September. iOS 18.4.1 and iPadOS 18.4.1 come two weeks after the launch of iOS 18.4 and iPadOS 18.4.
 of the Arch-based Manjaro Linux
distribution is now available. This release includes Linux kernel 6.12,
GNOME 48, KDE 6.3, Xfce 4.18, and more. ⌘ Read more
ProcessOne: Hello from the other side: Matrix ↔ XMPP via ejabberd 25.03
With ejabberd 25.03, the Matrix gateway ( mod_matrix_gw) no … ⌘ Read more
** OWASP Top 10 for LLMs in 2025: Security Test Cases You Must Know**
As Large Language Models (LLMs) continue to integrate into critical systems, securing them has become a top priority. In 2025, OWASP…
[Continue reading on I … ⌘ Read more
**Click, Recon, Jackpot! ️♂️ How a Subdomain Led Me to an S3 Treasure Trove **
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/click-recon-jackpo … ⌘ Read more
⚡️Oops, They Logged It! Turning LFI into Remote Shell Like a Pro ⚔️
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Foops-they-logged-it-turning-l … ⌘ Read more
Mastering the Linux Terminal: 10 Essential Network Commands You Need to Know
Hello, my digital adventurers!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/mastering-the-l … ⌘ Read more
** Uncovering Hidden APIs: How One Forgotten Endpoint Made Me $500**
🚀Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/uncovering-hidden-apis-how-one-forgotten-endpoint-made-me-500-424e6388c … ⌘ Read more
Pinta 3.0 released
Version\
3.0 of the Pinta
image editor has been released. The most notable change in this
release is that Pinta has been ported to GTK 4.0 and libadwaita. It
also includes a number of improvements, new effects, and bug fixes. ⌘ Read more
Children in Gaza Are So Hungry They’re Drawing Pictures of Food in the Sand
Sharon Zhang, Staff Writer - truthout
Stephan: This is what Palestinian children of Gaza have been reduced to, even as the international aid workers who are trying to help the children are being killed by Israel.
_Palestinian children react as they inspect the rubble and debris at the site of Isra … ⌘ Read moreHow to Spot a Phishing Email in 5 Seconds (Real Examples)
And What to Do When Your Smart Home and a Stalker’s AirTag Team Up Against You
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-to-spot-a-phishing-email-in-5-second … ⌘ Read more
$10,000 worth GitHub Access Tokens | Secret Search Operators
Secret but basic GitHub dorks & search operators that can lead to $10k bounty worth Acess Tokens.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/10- … ⌘ Read more
MisCloud — HackTheBox Sherlock Writeup ⌘ Read more
A Complete Guide to Securing Secrets in AWS Lambda
Learn how to securely manage secrets in AWS Lambda using environment variables, KMS encryption, Secrets Manager, and more.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-c … ⌘ Read more
Fast Flux: The DNS Botnet Technique Alarming National Security Agencies ⌘ Read more
Think You’re Safe? Here’s How Hackers Actually Break Into Your Accounts in 2025
How secure are you really when even two-factor authentication isn’t enough anymore?
[Continue reading on InfoSec Write-ups … ⌘ Read more
One Random Recon, One Real Bounty: The Paytm Story
From countless dead ends to a single Swagger UI payload — the unexpected breakthrough that changed my bug hunting journey forever.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ghost-paytm-xss-bounty-4f5efe6a643b?source=rss—-7b … ⌘ Read more
Add support for skipping backup if data is unchagned · 0cf9514e9e - backup-docker-volumes - Mills 👈 I just discovered today, when running backups, that this commit is why my backups stopped working for the last 4 months. It wasn’t that I was forgetting to do them every month, I broke the fucking tool 🤣 Fuck 🤦♂️
Add support for skipping backup if data is unchagned · 0cf9514e9e - backup-docker-volumes - Mills 👈 I just discovered today, when running ba …
Add support for skipping backup if data is unchagned · 0cf9514e9e - backup-docker-volumes - Mills 👈 I just discovered today, when running backups, that this commit is why my backups stopped working for the last 4 months. It wasn’t that I was forgetting to do them every month, I broke the fuckin … ⌘ Read more
Zephyr RTOS 4.1 Released with Performance Boosts, IAR and Rust Support, and Broader Board Compatibility
Zephyr Project has released version 4.1 of its RTOS, bringing notable improvements in kernel performance, toolchain support, and hardware compatibility. While not an LTS release, it introduces key updates aimed at enhancing developer experience and system efficiency. One of the main focuses of this release is performance. Extensive work wen … ⌘ Read more
Banana Pi Teases BPI-CM6 Module Featuring SpacemiT K1 RISC-V Processor
Banana Pi has shared details of its upcoming BPI-CM6 module, built with the SpacemiT K1 octa-core RISC-V processor. Though not yet launched, it is suggested for AI edge computing, robotics, industrial control, and network storage The BPI-CM6 adopts a 40x55mm form factor and uses board-to-board connectors consistent with the Raspberry Pi Compute Module 4, enabling […] ⌘ Read more
Security updates for Friday
Security updates have been issued by AlmaLinux (delve and golang and go-toolset:rhel8), Debian (webkit2gtk), Fedora (openvpn, thunderbird, uboot-tools, and zabbix), SUSE (expat, fontforge, govulncheck-vulndb, and kernel), and Ubuntu (haproxy and libsoup2.4, libsoup3). ⌘ Read more
It’s incredible how much difference 4 months make ⌘ Read more
Trump Targets Law Firm Behind $787.5 Million Fox News Suit (4)
John Hughes, Reporter/Editor - Bloomberg Law
_Stephan: Psychopath “tyrant” Trump, and his fascist servant, Attorney General Pam Bondi, are, as quickly as possible, trying to destroy the judicial system of the United States. As a result over half of the attorneys in the Solicitor General’s office are resigning, and Trump is resentfully targeting law firms, many of whom are caving to his wishes. This a … ⌘ Read more
Nicolas, 35 ans, découvre les urgences à la française
Un article à 4 mains écrit par h16 & Citronne Nicolas, 35 ans, marié, et père de deux enfants (de 5 et 8 ans), vit un quotidien familial plutôt paisible et des week-ends rythmés par les activités extra-scolaires des deux marmots. Cette année, alors qu’Emma pratique la danse, pour Léo, la question se pose encore : […] ⌘ Read more
Eight new stable kernels
Greg Kroah-Hartman has announced the release of eight stable kernels: 6.14.2, 6.13.11, 6.12.23, 6.6.87, 6.1.134, 5.15.180, 5.10.236, and 5.4.292. These all contain a large
assortment of important kernel fixes throughou … ⌘ Read more
Security updates for Thursday
Security updates have been issued by AlmaLinux (tomcat and webkit2gtk3), Debian (chromium), Fedora (ghostscript), Mageia (atop, docker-containerd, and xz), Red Hat (go-toolset:rhel8), SUSE (apache2-mod_auth_openidc, apparmor, etcd, expat, firefox, kernel, libmozjs-128-0, and libpoppler-cpp2), and Ubuntu (dino-im, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-l … ⌘ Read more
5.4.292: longterm
Version:5.4.292 (longterm)Released:2025-04-10Source:linux-5.4.292.tar.xzPGP Signature:linux-5.4.292.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-5.4.292 ⌘ Read more
[$] LWN.net Weekly Edition for April 10, 2025
Inside this week’s LWN.net Weekly Edition:
Front: Debian project leader election; 6.15 Merge window; Lots of LSFMM coverage; Joplin.
Briefs: Firefox hardening; OpenSSH 10.0; Supply chain security; FreeDOS 1.4; OpenSSL 3.5.0; Rust 1.86.0; Quotes; …
Announcements: Newsletters, conferences, security updates, patches, and more. ⌘ Read more
guys omg the people behind pico.sh are so nice ;_; one of the people running it emailed me to let me know i had what was likely a malfunctioning (or well, not working as intended) script that was spawning the same SSH tunnel over and over and they wanted to give me a heads up.
and i felt SO BAD because i worried i was straining their service or something so i disabled my 4 tunnels (they were serving little SSH games and services) and got back to them.
but i just woke up to THE NICEST EMAIL EVER reassuring me that i was actually using it as intended, it was just my script that was having problems, and they even said that if it was intended to work that way it was fine and they just wanted to let me know!
so i restarted the tunnels but have since added lockfiles as safeguards so that when the script is run it’ll check if it’s already running :D
iOS 18.4.1 Update Coming Soon for iPhones
Apple employees are testing iOS 18.4.1 for iPhones, according to the MacRumors visitor logs, which have been a reliable indicator of upcoming iOS versions. The software update will likely be released in a week or two, if not sooner.
As the version number implies, iOS 18.4.1 will obviously be a minor update that addresses software bugs and/or security vulnerabilities.
There ar … ⌘ Read more
hello friends i spent a couple hours today using a random string generator by charm CLI called hotdiva2000 to make a script that 1) generates a static index.html page 2) the page is a prompt generator where all the prompts are from hotdiva2000!!!!!
this makes more sense if you look at it check it out
How to Play Ambient Music on iPhone
One of the more interesting features to arrive on iPhone lately is the Ambient Music player, which, as the name implies, plays ambient music. This neat audio feature was introduced with iOS 18.4, and the Ambient Music Player offers four different ambient music types to play; Sleep, Chill, Productivity, and Wellbeing. While the Ambient Music … Read More ⌘ Read more
@thecanine@twtxt.net I mean I can restore whatever anyone likes, the problem is the last backup I took was 4 months ago 😭 So I decided to start over (from scratch). Just let me know what you want and I’ll do it! I used the 4-month old backup to restore your account (by hand) and avatar at least 🤣
(#phvll7a) @thecanine@thecanine I mean I can restore whatever anyone likes, the problem is the last backup I took was 4 months ago 😭 So I dec …
@thecanine @twtxt.net I mean I can restore whatever anyone likes, the problem is the last backup I took was 4 months ago 😭 So I decided to start over ( from scratch). Just let me know what you want and I’ll do it! I used the 4-month old backup to restore your account ( by hand) and avatar at least 🤣 ⌘ Read more
$ head -n 1 /var/log/pacman.log
[2015-10-16 17:08] [PACMAN] Running 'pacman -r /mnt -Sy --cachedir=/mnt/var/cache/pacman/pkg base base-devel'
Mine is 4,5 years behind!
This is a reminder to have a look to S.M.A.R.T. data I guess O:)