Hundreds of High-Profile Twitter Accounts Hacked through 3rd-Party App

In a large-scale Twitter hack, thousands of Twitter accounts from media outlets to celebrities, including the European Parliament, Forbes, BlockChain, Amnesty International, UNICEF, Nike Spain and numerous other individuals and organizations, were compromised early Wednesday. The compromised...

struts-pwn - An exploit for Apache Struts CVE-2017-5638

An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL. python...

PostMessage cross-domain vulnerability-vulnerability warning-the black bar safety net

Note: this article is“millet Security Center”original, reprint please contact the“millet Security Center” Background Value: $3000 Vulnerability cause: postMessage cross-domain vulnerabilities to cause, the use of the websocket receives a user authentication token Original address:...

[SECURITY] Fedora 25 Update: drupal7-metatag-1.21-1.fc25

The Metatag module allows you to automatically provide structured metadata, aka "meta tags", about your website. In the context of search engine optimization, when people refer to meta tags they are usually referring to the meta description tag and the meta keywords tag that may help improve the...

EPSON TMNet WebConfig 1.00 - Cross-Site Scripting

Exploit Title: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 Google Dork: intitle:"EPSON TMNet WebConfig Ver.1.00" Date: 3/3/2017 Exploit Author: Michael Benich Vendor Homepage: https://www.epson-biz.com/ Software Link: https://c4b.epson-biz.com/modules/community/index.php?contentid=50 Versio...

Wordpress Theagency Themes File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Themes Theagency File Upload Vulnerability Author : Berandal Google Dork: inurl:/wp-content/themes/theagency Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ Video Proof :...

X (Formerly Twitter): [URGENT] Opportunity to publish tweets on any twitters account

The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user. By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account. This...

[SECURITY] Fedora 24 Update: bitlbee-3.5.1-1.fc24

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

[SECURITY] Fedora 25 Update: bitlbee-3.5.1-1.fc25

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

X (Formerly Twitter): Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]

The reporter discovered a bug related to the Vine Archive which had the potential to expose the email address or phone number associated with a Vine account to a third party through the Vine API. The vulnerability was discovered by the reporter, triaged, and remediated within 24 hours of the...

Simple Twitter Metadata Scraper

Simple Twitter Metadata Scraper The goal of this simple python script is to analyze a Twitter profile through its tweets by detecting: Average tweet activity, by hour and by day of the week Timezone and language set for the Twitter interface Sources used mobile application, web browser, …...

President Trump's @POTUS Twitter Linked To A Private Gmail Account

It seems like the new American President's Twitter account could easily be hacked due to security blunders he made with the most powerful Twitter account in the world, experts warned. Days after we got to know that the newly inaugurated President Donald Trump was still using his old, insecure...

X (Formerly Twitter): Attacker can get vine repost user all informations even Ip address and location .

The researcher discovered that an endpoint used for providing information about Vine reposts was unintentionally disclosing the IP address the repost was made from. Upon receiving this report we immediately took steps to correct the issue and updated the misconfigured endpoint the same day the...

Massive Twitter Botnet Dormant Since 2013

A sizable and dormant Twitter botnet has been uncovered by two researchers from the University College London, who expressed concern about the possible risks should the botmaster decide to waken the accounts under his control. Research student Juan Echeverria Guzman and his supervisor and senior...

Tinfoleak v2.0 - Get detailed information about a Twitter user activity

Are you interested in OSINT tools? Tinfoleak is the best OSINT tool for Twitter, and is open-source! The new version includes a lot of new and improved features: Search by coordinates Geolocated users Tagged users User conversations Identification in other social networks More powerful and flexib...

Yelp: Clickjacking @ Main Domain[www.yelp.com]

Hello Yelp Security Team, I Just want to submit a report Clickjacking on your Main Domain, I Know that this is a Low Risk But may i know if your aware of it. PoC: See Atachments. Impact: For example, imagine an attacker who builds a web site that has a button on it that says "click here for a fre...

TargetGrow Twitter Followers - External URLs, MIT license, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application TargetGrow Twitter Followers published at the 'play' market has multiple vulnerabilities...

Followers+ for Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Followers+ for Twitter published at the 'play' market has multiple vulnerabilities...

Get Twitter Followers Fast - Base64 encoded String, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Get Twitter Followers Fast published at the 'play' market has multiple vulnerabilities...

Reflected Cross-Site Scripting Vulnerability in WordPress Plugin Zhina Twitter Widget

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin Zhina Twitter Widget 'phoenixsearch.php' page, which can be exploited by attackers to...