Tinfoleak v2.0 - Get detailed information about a Twitter user activity

Are you interested in OSINT tools? Tinfoleak is the best OSINT tool for Twitter, and is open-source! The new version includes a lot of new and improved features: Search by coordinates Geolocated users Tagged users User conversations Identification in other social networks More powerful and flexib...

Yelp: Clickjacking @ Main Domain[www.yelp.com]

Hello Yelp Security Team, I Just want to submit a report Clickjacking on your Main Domain, I Know that this is a Low Risk But may i know if your aware of it. PoC: See Atachments. Impact: For example, imagine an attacker who builds a web site that has a button on it that says "click here for a fre...

TargetGrow Twitter Followers - External URLs, MIT license, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application TargetGrow Twitter Followers published at the 'play' market has multiple vulnerabilities...

Followers+ for Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Followers+ for Twitter published at the 'play' market has multiple vulnerabilities...

Get Twitter Followers Fast - Base64 encoded String, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Get Twitter Followers Fast published at the 'play' market has multiple vulnerabilities...

Reflected Cross-Site Scripting Vulnerability in WordPress Plugin Zhina Twitter Widget

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin Zhina Twitter Widget 'phoenixsearch.php' page, which can be exploited by attackers to...

Free Twitter Follower Coupon - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Free Twitter Follower Coupon published at the 'play' market has multiple vulnerabilities...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

NetGear R series multi-router remote command injection vulnerability analysis-vulnerability warning-the black bar safety net

Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the patch repair.” Thi...

WordPress Twitter Cards Meta plugin <= 2.4.5 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerabilities

WordPress Twitter Cards Meta plugin Cross-Site Request Forgery CSRF/Cross-Site Scripting XSS were found in 2.4.5 version. When the plugins settings are saved to the database and outputted there is no escaping done. Also, it's missing a nonce to check the request after saving the plugin's settings...

DailyMotion Hack Leaks Emails, Passwords of 87M Users

DailyMotion, a popular video sharing website, said Tuesday it recently suffered an “external security problem” resulting in the compromise of an unspecified number of its users’ data. LeakedSource.com, a repository of breached data, added DailyMotion to its list of “Hacked Sites” on Monday. The...

Disk Sorter Enterprise 9.1.12 - Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python print "Disk Sorter Enterprise 9.1.12 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM...

Disk Savvy Enterprise 9.1.14 Buffer Overflow

!/usr/bin/python print "Disk Savvy Enterprise 9.1.14 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM You do not need to be authenticated, password below is...

Dup Scout Enterprise 9.1.14 Buffer Overflow

!/usr/bin/python print "Dup Scout Enterprise 9.1.14 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM You do not need to be authenticated, password below is...

X (Formerly Twitter): Twitter for android is exposing user's location to any installed android app

Hi, I have noticed that while a user is using the location feature in twitter's android application twitter is sending the user's location to all other locally installed applications without verifying the possible malicious receivers By sending a broadcast. As a poc I have created an application...

Microsoft Internet Explorer 8 MSHTML Ptls5::LsFindSpanVisualBoundaries Memory Corruption

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the fifteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

Server Side Bruteforce Module: brut3k1t

Server Side Bruteforce Module brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are: ssh ftp smtp XMPP instagram facebook There will be future implementations of different protocols and servic...

brut3k1t - Server-side Brute-force Module (ssh, ftp, smtp, facebook, and more)

Server-side brute-force module. Brute-force dictionary attack, jk attack that supports multiple protocols and services. 1. Introduction brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are:...

X (Formerly Twitter): [IDOR][translate.twitter.com] Opportunity to change any comment at the forum

POC: https://translate.twitter.com/forum/getting-started/topics/7037/posts/43287/edit Steps to reproduce: 1 Go to any forums topic for example: https://translate.twitter.com/forum/getting-started/topics/7037 2 View source code of the page and take post id screenshot "idor edit.jpg" 3 Append...

Russian Court bans LinkedIn in Russia; Facebook and Twitter Could be Next

As reported late October, the world's largest online professional network LinkedIn is going to ban in Russia beginning Monday following a Moscow court decision this week that found Microsoft-owned LinkedIn to be in violation of the country's data protection laws. Here's why LinkedIn is facing ban...