Hi everyone last week there was a wave of Telegram channel blocks in the OSINT community, and my second channel @osintgit was among those affected. Most channels have already been restored, but mine remains blocked. Please help forward the following message to Telegram support:

The @osintgit channel has been blocked. It contained links to articles, presentations from the author’s conference talks, and publicly available tools related to information security. The channel never published personal data or any other prohibited content. Please unblock this channel and remove the restrictions on.

Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.

Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport

Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.

And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org

I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.

Читать полностью…

Sensitive Information Leak via api call
Severity: 9.1

From /api/contact an unauthenticated user can view all the private messages which only can show from Admin Panel.

tip:
always collect /api/ endpoints and try GET, POST etc methods.

if you guy’s really enjoy to read such methods, react ❤️

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

📖 شکار عملی باگ بانتی : از Recon تا Bounty واقعی : متدولوژی و شناسایی و آسیب پذیری های دنیای واقعی

این کتاب معرفی کامل و کاربردی‌ای به دنیای «باگ بانتی» ارائه می‌دهد. این برنامه برای علاقه‌مندان به امنیت سایبری، پنتسترها، و توسعه‌دهندگانی طراحی شده که می‌خواهند کشف آسیب ‌پذیری ‌ها در برنامه ‌های واقعی را بیاموزند؛ تمرکز آن بر مهارت ‌های عملی، متدولوژی ‌های تست مدرن، و اصول هک اخلاقی است.


توضیحات کتاب
نمونه کتاب

💰 قیمت : ۳۶۰,۰۰۰ تومان
🔥  با تخفیف : ۳۱۰،۰۰۰ تومان

📌 جهت خرید به ایدی زیر پیام دهید:
@THBxSupport

Читать полностью…

🔥 TIP: Automate Secret Hunting Like a Pro
Manual hunting is slow. Automation scales.

Instead of randomly browsing subdomains, pipe your recon properly:

subfinder -d target.com -silent | httpx -silent | gau | grep -Ei "\.env|config|backup"


What this really means is:

• subfinder → enumerate subdomains
• httpx → filter alive hosts
• gau → pull historical URLs
• grep → hunt for juicy patterns like .env, config, backup

You’re basically combining live assets + historical endpoints + pattern filtering in one clean chain.

This approach often reveals:

Exposed environment files
Backup endpoints
Forgotten config files
Hidden OpenID configurations
JS config leaks

Most hunters stop at subdomain enumeration. Smart hunters pivot into URL discovery and pattern extraction.

Automation doesn’t replace thinking. It multiplies it.

Test responsibly. Stay within scope. Move fast, think slow.

❤ Share & Support Us
🧩 #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

pass: 311138

README (en+ru) inside, plz read it before run BS.

Happy Hacking! 🥳

Run with Java 18 or Java 22 with JDK21+

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

📖 Cyber ​​Security books and sources
📚 @LibrarySecOfficial

💠 Blueteam sources:
⭕️ @BlueTeamKit

💠 Osint tools and courses:

⭕️ @OsintGit

💠 Cyber ​​Security Courses and Resources & Learn Bug bounty:

⭕ @BackupLso


💠 All Red Team resources are here!

⭕ @RedTeamVillageRtv


💠 To add to the message list:
🤖 @LibrarySecOfficialBot

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

Читать полностью…

📖 Secure Coding Practices OWASP Based Checklist, 200+ Test Cases, 2025

I just reviewed one of the most complete Secure Coding Practice guides I’ve seen a 200+ test case, OWASP-aligned, multi-language blueprint that exposes how fragile most applications really are.

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🚨🚨 به زودی نت ملی میشه این کانالها را داشته باش 👇

Proxy :
/channel/+4-GLHdg6IpNkZWQ0

V2ray Config :
/channel/+E45B9TJB51wxYjQ8

Npv Spara :
/channel/+pZVOLjc9GHA1MmE0

Читать полностью…

Deep-Dive Drop: Dev(sec)Ops Process for Dummies 🐜⚙️

Most teams ship code to production in minutes… and trust a few YAML lines not to burn the house down

In this guide, I break down how one missing security gate in a CI/CD pipeline led to a 47-minute attack and $4M+ in damage—and how to redesign your processes so it never happens again.

🔍 The 3:47 AM Incident
• Step-by-step timeline from alert → triage → forensics → root cause
• How a “hotfix” branch, skipped scans, and an expired token led to full domain compromise

🏗 Secure vs Insecure DevOps Patterns
• Manual approval gates, shared service accounts, static tokens, no baselines
• Secure alternatives: immutable workflows, environment-specific gates, anomaly detection, auto-rollback, ephemeral creds

🧩 8 Core Processes Across the SDLC
• Vulnerability scanning (SAST/SCA/DAST/Cloud/IaC)
• CI/CD pipeline security and workflow hardening
• Infrastructure change management (Terraform / K8s / cloud)


📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

JWT Security – Complete Enterprise Implementation for Modern Apps 🛡

🔐 JWT Architecture & Design
• Header, payload, signature internals
• Secure use of alg, kid, and claim design
• Stateless vs session-based auth from a security lens

💣 Real-World Vulnerabilities
• Algorithm confusion (none, RS256→HS256) with full exploit + fix
• Key management pitfalls (weak secrets, kid path-traversal, JWKS abuse)
• Token storage risks (localStorage, extensions, XSS, supply-chain issues)

🧬 Secure Implementation Blueprint
• End-to-end JWT lifecycle: auth → issuance → storage → usage → refresh → revocation
• Device binding, replay detection, anomaly detection & rate limiting
• Production-ready JWT service with Redis, logging, metrics & audit trails

🛠 Code You Can Drop Into Your Stack
• Python & Node-style examples
• Secure header/payload builders
• Signature verification pipelines with strict algorithm whitelisting
• Key rotation strategy with kid and overlapping keys

🧩 #JWT
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Complete SQLMap Database Penetration Testing Guide by Harshit Rajpal & Aarti Singh

This PDF breaks down SQLMap from beginner to advanced level, with real-world examples, commands, and workflows that mirror what you’d do in an actual assessment.

🔹 SQL Injection Detection
– Error-based, Boolean-based, Time-based
– Identifying vulnerable parameters
– Breaking queries to trigger server errors

🔹 Database Enumeration
– Listing DBMS names
– Enumerating databases, tables, columns
– Extracting sensitive data safely

🔹 Data Extraction Techniques
– Dumping specific tables
– Full database dumps
– Hash extraction and format recognition

🔹 SQLMap Targeting Options
– -u for single URL targeting
– Attacking from log files
– Bulk attack using multiple URLs
– Using Google Dorks with SQLMap
– Running SQLMap on intercepted HTTP requests (-r option)

🔹 File System & OS Interaction
– Uploading / downloading files
– Executing system commands
– Out-of-band shells and Meterpreter sessions


📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🧑‍🎓 👉 SQL Injection $1000 Bounty | Bug bounty POC by The Cyberboy, 2024

See also:
❗️ How Finding an SQL Injection Vulnerability Earned a $1000 Bug Bounty
❗️ hellomiketesting1/sql-injection-bug-bounty-poc-e88353705db1">SQL Injection Bug Bounty POC
❗️ SQL Injection by HackTricks

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔖 XML External Entity XXE Attack
🧩 #XXE #XML
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

https://medium.com/p/ef4fbe28ceab

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

✎ ASN → IP Recon Workflow (BGPView alternative)

I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo:

• as-ip-blocks: Github

It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation.

</> Bash Function for ASN → IP Enumeration

You can plug this directly into your recon pipeline or customize it for your tools

asn2ip() {
  local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as"

  fetch_asn() {
    curl -fsSL "$base/$1/aggregated.json" \
      | jq -r '.prefixes.ipv4[]?' 2>/dev/null \
      | sort -u
  }

  if [ ! -t 0 ]; then
    while IFS= read -r asn; do
      fetch_asn "$asn"
    done
  else
    fetch_asn "$1"
  fi
}

• Single ASN → IP Ranges

asn2ip 1234

• List of ASNs → IP Ranges

cat asnList | asn2ip

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔥 URILoot is a browser extension designed for Bug Bounty Hunters and Pentesters. Makes fetching uris easy from various sources.

https://github.com/rsingh0x/URILoot

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔖 چک‌ لیست VAPT امنیت شبکه

🥀 @TryHackBox
#Checklist

Читать полностью…

امروز چهلمِ جاوید نام‌هاییه که تو اعتراضات دی‌ماه، جونشون رو تو راه آزادی و کرامت انسانی از دست دادن.

روحشون شاد و یادشون گرامی 🤍🕊


Today marks the fortieth day since the tragic loss of the brave souls who sacrificed their lives during the protests in December, fighting for freedom and human dignity in Iran.

May their spirits rest in peace, and may we always remember their courage and sacrifice. 🤍🕊

For Iran 🕊

Читать полностью…

🔖 Practical Web Application Security and Testing

"Practical Web Application Security and Testing" is a foundational course on web application technologies, security concerns in web application development, and the process of penetration testing for web applications.

We will start with the basics of networks, servers, and clients, then move on to the OWASP Top 10, and conclude with a complete demonstration of penetration testing. We will also cover the process of reporting on web application assessments so that you are prepared not only to conduct security evaluations of web applications but also to communicate your findings clearly and effectively.

❤ Share & Support Us
🧩 #web #Security
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Secure Coding Practices OWASP Based #Checklist, 200+ Test Cases, 2025

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

⭕ OWASP Top 10 2025 Updates: Supply Chain, Secrets, And Misconfigurations Take Center Stage

🔖 Official page

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Friends, please support us to reach 3K subscribers. Thank you!🔥

Читать полностью…

OWASP Juice Shop Walkthrough All-in-one-PDF, 2025 (upd)

Updated 2025 version

OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools!

Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!

💥Official page

Early post:
YouTube playlist + PDF (2020)

❤ Share & Support & Reaction Us
🧩 #Owasp
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔖 Session Fixation, Session Hijacking, and Captcha Bypass

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

✎ Deobfuscate obfuscator.io, unminify, transpile, and unpack webpack/browserify, using webcrack to resemble the original source code as much as possible.

Command Line Interface

npm install -g webcrack

Examples

webcrack input.js
webcrack input.js > output.js
webcrack bundle.js -o output-dir

• Repository: Github
• Website: webcrack.netlify.app

#bugbounty #recon #javascript #deobfuscate
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…