The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted! portswigger.net/research/top…

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com/

⚡️XBOW found LFI where most tools would have given up. Photo download endpoint blocked all path traversal attempts. But JavaScript analysis revealed /photo/proxy?url= - vulnerable to file:// scheme access. Successfully read a password file via proxy endpoint. Technical breakdown: xbow.com/blog/xbow-photo-pro…

Day 2 is packed with some 🔥 talks! Check out the entire schedule on NahamCon.com! Remember this is 100% free, no tickets or anything needed. Just show up and watch the talks!

🎉 Hyped for #NahamCon2025! ✨ Day 1: Full AI x Offensive Security track with @jhaddix, @rez0__ , @DanielMiessler,@wunderwuzzi23, @monkehack, @xssdoctor. Details: NahamCon.com #InfoSec #bugbounty #CyberSecurity

the research paper is out: Next.js and the corrupt middleware: the authorizing artifact result of a collaboration with @inzo____ that led to CVE-2025-29927 (9.1-critical) zhero-web-sec.github.io/rese… enjoy the read!

You might have noticed that the recent SAML writeups omit some crucial details. In "SAML roulette: the hacker always wins", we share everything you need to know for a complete unauthenticated exploit on ruby-saml, using GitLab as a case-study. portswigger.net/research/sam…

Let me share our latest "Gudifu" paper and tool about a new search technique for parsing discrepancies between HTTP servers. The Gudifu tool has discovered several previously unknown attack vectors on popular server pairs such as Request Smuggling, Access Control Bypass and

Per popular demand, Turbo Intruder 1.51 now inserts results at the top of the table so you can watch them arrive without scrolling! Let me know how you find it. If you prefer the old behaviour, you can change it back using: table.setSortOrder(0, False)

Critical vulnerabilities doesn't have to be complex or have a CVE - @deepseek_ai publicly exposed their internal ClickHouse database to the world, without any authentication at all, and leaked sensitive data. No one is safe from security mistakes, follow along to learn more 🧵

One more example for bad behavior / Scam in paid subscription for bugbounty santimillionaire.com/ I was there for the last 5 months trying to find something useful but unfortunately nothing , just a ready payloads and some tips filtered for each bug and this month I found a interesting script with lot of installing issues , and when I asked for help , he’s keep ignoring Nothin new in the last 5 months , so it should be one time payment payments should be 20$ and this month they took 40$ Just cancel the auto payment as Iam always trying to show everything good in bugbounty tips and sure for free, In the same time I will drop the bad content like this as well #bugbountyScam

🎉✨ Big News for GOLDEN PLAN License Winners! ✨ Congratulations again to our 10 lucky winners! We have an important update: out of the 10 winners, only 9 have completed all the required steps to claim their license. 🕒 To the selected winners: Please ensure you message us within the next 24 hours to finalize your claim. If we do not hear from you within this timeframe, unfortunately, your offer will become invalid. We are excited to see you utilize the full capabilities of xss0r GOLDEN PLAN. Don't miss out on this opportunity—reach out to us soon! 📹 Here is the video announcement: Selected Winners: @talhaasim365 @anonymous797201 @mucarofficial @Chaudhry671 @MridulRastogi1 @Abubakar07K @dmDUSTBIN @0xhunster @oklolxdd As we finalize the winners of our GOLDEN PLAN License xss0r giveaway, there's still one spot left to claim! 🚀 We're giving our community 48 more hours to show us who's the biggest fan of xss0r! The person with the most interaction and enthusiasm on our posts will be announced as the 10th winner in just 48 hours. 🕒 💬 Get active, get noticed, and you could be enjoying the full capabilities of xss0rRecon V2 under the coveted GOLDEN PLAN License! 📅 Stay tuned for the big reveal! Your passion and support could earn you this exclusive spot. Don’t miss this chance to shine as xss0r's top supporter! Congratulations to the 10 happy winners of the GOLDEN PLAN xss0r!

🛑 GIVEAWAY ALERT 🛑 ⬇️ Today is day SIX of EIGHT days of @arcanuminfosec and friends Black Friday and Cyber Monday giveaways! Today game recognizes game. If you’ve taken my classes, you know I always recommend @LearnPrompting. Today, I’m giving away one free seat to their AI/ML Red-Teaming Masterclass which starts on Dec 5th! I’ll also be guest lecturing, so I’ll see you there! maven.com/learn-prompting-co… PS: If you don't win, you can get $300 off for anyone who registers with my code: "haddix"! You know the drill! Each person can have up to FOUR entries to the giveaway! ♻️ Share This Post = 2 Entries ♥️ Like This Post = 1 Entry ✍️ Comment This Post = 1 Entry Winners will be posted next Tuesday!

🛑 GIVEAWAY ALERT 🛑 Today is day THREE of FIVE days of @arcanuminfosec and friends Black Friday and Cyber Monday giveaways! Today we are giving away FIVE seats to our NEW training: "Hacking Your Career" HYC releases in January and is PACKED with actionable advice to land and excel in your cyber security career! payhip.com/b/Ph2qc Each person can have up to FOUR entries to the giveaway! ♻️ Reshare This Post = 2 Entries ❤️ Like This Post = 1 Entry ✍️ Comment This Post = 1 Entry Winners will be posted next Tuesday!

🚀Black Friday Giveaway!🤗 *** 𝗙𝗼𝗹𝗹𝗼𝘄 𝗼𝘂𝗿 𝗽𝗮𝗴𝗲, 𝗥𝗲𝗽𝗼𝘀𝘁, 𝗟𝗶𝗸𝗲 𝗮𝗻𝗱 𝗖𝗼𝗺𝗺𝗲𝗻𝘁 𝘄𝗵𝗶𝗰𝗵 𝗲𝘅𝗮𝗺 𝘆𝗼𝘂 𝘄𝗼𝘂𝗹𝗱 𝗹𝗶𝗸𝗲 𝘁𝗼 𝘄𝗶𝗻 𝗮𝗻𝗱 𝟱 𝗹𝘂𝗰𝗸𝘆 𝘄𝗶𝗻𝗻𝗲𝗿𝘀 𝘄𝗶𝗹𝗹 𝗴𝗲𝘁 𝗮 𝗳𝗿𝗲𝗲 𝗲𝘅𝗮𝗺 𝗼𝗳 𝘁𝗵𝗲𝗶𝗿 𝗰𝗵𝗼𝗶𝗰𝗲! *** Get started here and select the exam of your choice😎: secops.group/pentesting-exam… #blackfridayoffer #infosecblackfriday #pentestingexams #appsecexam #networksecurity #giveaways

🔴 GIVEAWAY ALERT 🔴 Our AI Red Teaming cohort is over 50% full and starts in just 9 days! For Black Friday, we're giving away TWO seats to our course, which is led by the world's top AI Security Experts! RT this post & Comment below to enter! Winners announced on Dec. 1st!

🎁 End of Year Giveaway 🎁 Hack The Box 6-month VIP+ x1 - Follow, Like, and Retweet to join! - Winner will be picked randomly on December. #hackthebox #giveaway #projectsekaictf

🚨 I convinced my team to do one last giveaway! Options: hhub.io/eu2wxGj 🏆 Full Access: $199 💻 Lifetime Course: $39 (includes updates) 🎯 1-Month trial (no updates): $19 TWO WINNERS (1 each): - Full cert bundle - Lifetime access Enter: ↪️ RT + Reply with 🎯

#xss0rRecon script ! From a total of 209 links crawled from the testphp.vulnweb.com site, xss0rRecon identified 4 URLs potentially vulnerable to reflected XSS attacks. This demonstrates the power and efficiency of xss0rRecon. Currently tested on Debian, with configurations for Ubuntu, WSL, and macOS coming soon. Visit xss0rRecon and try it on your targets: github.com/xss0r/xssorRecon

youtube.com/watch?v=vPwV4xMb… I just came across an amazing video showcasing the XSS to Account Takeover process using the xss0r Tool! 😱 This video highlights just how powerful and effective the tool is when it comes to finding and exploiting XSS vulnerabilities. If you haven’t seen it yet, make sure to check it out here