Amal PK
LightNews LightNews
0xkratos.bsky.social
Amal PK
@0xkratos.bsky.social
200 followers 180 following 18 posts
Cyber Security Researcher | CTF Player | VAPT
Posts Replies Media Videos
Pinned
0xkratos.bsky.social
Amal PK @0xkratos.bsky.social · Jul 5
Wrote a blog on Hostheader injection and how we can use this to manipulate the forgot password Link.

blog.amalpk.in/host-header-...

#cybersecurity #bugbounty #bug #web #vapt #hacking
Host Header Injection: How One Header Can Break Your Web App
Discover how Host Header Injection works, its risks, real-world attack examples, and steps to secure your web applications from this hidden threat.
blog.amalpk.in
Reposted by Amal PK
bearstech.com
🏖️🐻 Les Logiciels Libres de l'été, jour 32 :

Vulhub : un projet Open Source offrant des environnements vulnérables préconstruits basés sur Docker-Compose. Idéal pour tester et apprendre la gestion des vulnérabilités, chaque environnement inclut un guide d'installation et d'utilisation.
Vulhub Vulhub is an open-source collection of pre-built vulnerable docker environments for security researchers and educators. Explore Environments GitHub 19.0k+ Stars • 4.6k+ Forks • 298 Environments # Clone the repository git clone --depth 1 https://github.com/vulhub/vulhub.git # Enter the directory cd vulhub/spring/CVE-2022-22947 # Start the environment docker compose up -d
July 22, 2025 at 7:30 PM
Reposted by Amal PK
bearstech.com
🔗 Liens utiles Vulhub :

👉 Le projet : github.com/vulhub/vu...
👉 En savoir plus : https://vulhub.org/

Sponsorisez Vulhub ❤️ : github.com/sponsors/...
Install Docker (example for Ubuntu 24.04): # Install the latest version docker curl -s https://get.docker.com/ | sh # Run docker service systemctl start docker For other operating systems, see the Docker documentation. Although all Vulhub environments are running based on Docker Compose, you no longer need to install docker-compose separately. Instead, you can use the built-in docker compose command to start Vulhub environments. Download and set up Vulhub: git clone --depth 1 https://github.com/vulhub/vulhub Launch a vulnerable environment: cd vulhub/langflow/CVE-2025-3248 # Example: enter a vulnerability directory docker compose up -d Each environment directory contains a detailed README with reproduction steps and usage instructions. Clean up after testing: docker compose down -v
July 22, 2025 at 7:30 PM
Reposted by Amal PK
0xacb.com
Most open redirects are low-severity or N/A.

But used creatively, they can become high impact gadgets.

Here are 4 ways to show impact with open redirects:
July 7, 2025 at 9:37 AM
0xkratos.bsky.social
Wrote a blog on Hostheader injection and how we can use this to manipulate the forgot password Link.

blog.amalpk.in/host-header-...

#cybersecurity #bugbounty #bug #web #vapt #hacking
Host Header Injection: How One Header Can Break Your Web App
Discover how Host Header Injection works, its risks, real-world attack examples, and steps to secure your web applications from this hidden threat.
blog.amalpk.in
July 5, 2025 at 3:23 AM
0xkratos.bsky.social
NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL database.

Read my new Blog here:
blog.amalpk.in/nosql-inject...
NoSQL injection
NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL database
blog.amalpk.in
May 17, 2025 at 10:21 AM
Reposted by Amal PK
areyou1or0.com
Bypassing Detections with Command-Line Obfuscation

www.wietzebeukema.nl/blog/bypassi...
Bypassing Detections with Command-Line Obfuscation
Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits exec...
www.wietzebeukema.nl
March 24, 2025 at 4:41 PM
Reposted by Amal PK
garethheyes.co.uk
We've just released Shadow Repeater, for AI-enhanced manual testing. Simply use Burp Repeater as you normally would, and behind the scenes Shadow Repeater will learn from your attacks, try payload permutations, and report any discoveries via Organizer.

portswigger.net/research/sha...
February 20, 2025 at 1:24 PM
0xkratos.bsky.social
Client-Side Path Traversal (CSPT): The Overlooked Vulnerability.

Read more about this on my new blog: 0xkratos.medium.com/client-side-...

#cybersecurity #bugbounty #hacking
Client Side Path Traversal (CSPT) - A Deep Dive into an Overlooked Vulnerability
Exploring Client-Side Path Traversal (CSPT): How Attackers Exploit API Requests to Bypass Security and Exfiltrate Data
0xkratos.medium.com
March 11, 2025 at 11:51 AM
Reposted by Amal PK
zakfedotkin.bsky.social
Check out the newest version here:
portswigger.net/web-security...

Null byte tricks:
portswigger.net/web-security...
URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy
This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS ...
portswigger.net
March 5, 2025 at 1:35 PM
Reposted by Amal PK
agarri.fr
This article on Solr and its (in)security is really good 💎

And I strongly recommend to read @hacefresko.com previous article on Solr before diving in this one (I will share the link in my reply)
hacefresko.com Victor Fresk0 @hacefresko.com · Feb 26
Good news! I've uploaded a new post about the most complex and beautiful vulnerability I've ever found, involving patching and uploading deprecated .jar libraries to get RCE on a big target. It's a very technical post, but I hope you like it ! :)

www.hacefresko.com/posts/rce-on...
A very fancy way to obtain RCE on a Solr server
www.hacefresko.com
March 7, 2025 at 8:32 PM
Reposted by Amal PK
xnl-h4ck3r.bsky.social
🛠️ waymore: Tip #1 📝

By default, waymore will get URLs and download responses (-mode B).
If you just want URLs, then use "-mode U".
If you just want to download archived responses, then use "-mode R".

🤘
March 9, 2025 at 11:18 PM
Reposted by Amal PK
alp1n3.dev
March 9, 2025 at 2:13 AM
Reposted by Amal PK
renniepak.nl
Yesterday I discovered a tweet of mine was referenced in the book "Attacking and Exploiting Modern Web Applications: Discover the mindset, techniques, and tools to perform modern web attacks and exploitation"

www.amazon.nl/-/en/Simone-...

Since I deleted my account, this is the tweet:
February 12, 2025 at 8:19 AM
Reposted by Amal PK
rebane2001.bsky.social
made an archive collection site thing for all the x3ctf web design stuff i did

the intro/outro can be rewatched with websocket replay data (eg the messages and synced mouse cursors)

and the platform itself has emulations for auth and flags and stuff

u can check it out at x3c.tf/archive/
February 9, 2025 at 10:00 PM
0xkratos.bsky.social
Simple Blog about PHP Type Juggling

Read More: 0xkratos.medium.com/php-type-jug...

#cybersecurity #bugbounty #bug #php #programming
PHP Type Juggling Vulnerabilities: How Attackers Exploit Loose Comparisons
PHP type juggling can lead to security vulnerabilities. Learn how attackers exploit it and how to secure your web applications.
0xkratos.medium.com
February 6, 2025 at 3:05 PM
0xkratos.bsky.social
Wrote a blog about Web Cache Deception.

Read here: 0xkratos.medium.com/web-cache-de...

#WebSecurity #cybersecurity #pentesting #InfoSec #bugbbounty
Web Cache Deception: Understanding and Mitigating Security Risks
Learn about Web Cache Deception and Cache Poisoning, how they exploit misconfigured caches, and tips to prevent these vulnerabilities in…
0xkratos.medium.com
January 30, 2025 at 7:35 AM
Reposted by Amal PK
garethheyes.co.uk
Discover blocklist bypasses via unicode overflows using the latest updates to ActiveScan++, Hackvertor & Shazzer! Thanks to Ryan Barnett and Neh Patel for sharing this technique.

portswigger.net/research/byp...
GET /%0D%0ASet-Cookie: foo=bar 403 Forbidden GET /%E4%BC%8D%E4%BC%8ASet-Cookie: foo=bar 200 OK Set-Cookie: foo=bar
January 28, 2025 at 2:01 PM
Reposted by Amal PK
renniepak.nl
Is there a way to run alert() when "alert" is blocked by a WAF and unsafe-eval is not allowed?
January 27, 2025 at 2:35 PM
0xkratos.bsky.social
CVE-2025-21298 Windows OLE Remote Code Execution Vulnerability!

A critical vulnerability in Windows Object Linking and Embedding (OLE) technology, which enables remote code execution (RCE) with a CVSS severity score of 9.8.

Read more: 0xkrat0s.github.io/posts/CVE-20...
CVE-2025-21298 Windows OLE Remote Code Execution Vulnerability
Overview CVE-2025-21298 is a critical vulnerability in Windows Object Linking and Embedding (OLE) technology, which enables remote code execution (RCE) with a CVSS severity score of 9.8. OLE is a prop...
0xkrat0s.github.io
January 27, 2025 at 7:07 AM
0xkratos.bsky.social
A good old trick for bypassing WAF/filters while testing for command injection using shell globbing / wildcard expansion.

Read More: 0xkrat0s.github.io/posts/Shell-...

#bash #waf #bypass #bugbounty. #cybersecurity
Bypassing Web Application Firewalls with Shell Globbing
Bypassing Web Application Firewalls with Shell Globbing Introduction Web Application Firewalls (WAFs) are a critical line of defense for modern web applications, meticulously inspecting incoming traff...
0xkrat0s.github.io
January 26, 2025 at 9:33 AM
0xkratos.bsky.social
Suggest me some topics for my blog!

Link: 0xKrat0s.github.io

#bugbounty #infosec #cybersecurity #bug #hacking #tech
Amal PK
A blog about everything.
0xKrat0s.github.io
January 25, 2025 at 10:04 PM
Reposted by Amal PK
mccune.org.uk
First blog post of the new year and this is one I've been meaning to write up for a while which is some details on #Kubernetes API Server proxy feature and how it might be possible to use some known weaknesses in it to escalate your privileges in a cluster.

raesene.github.io/blog/2025/01...
Exploring the Kubernetes API Server Proxy
raesene.github.io
January 18, 2025 at 12:54 PM
0xkratos.bsky.social
The Simpsons 'Prediction' !
Internet Blackout On January 16, 2025?

:(
January 15, 2025 at 6:54 PM
Reposted by Amal PK
0x999.net
Just published a new blog post "Exploring Javascript events & Bypassing WAFs via character normalization", check it out: 0x999.net/blog/explori...
0x999's Blog - Exploring Javascript events & Bypassing WAFs via character normalization
0x999.net
November 18, 2024 at 6:07 PM
Reposted by Amal PK
jorianwoltjer.com
To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all.
If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this!
jorianwoltjer.com/blog/p/hacki...
Post: Mutation XSS: Explained, CVE and Challenge | Jorian Woltjer
Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online
jorianwoltjer.com
November 27, 2024 at 4:01 PM