I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

gmsgadget.com

1/4

@mizu.re just launched a service to list XSS gadgets that bypass CSP or sanitizers. A good thing to keep in the arsenal - and a good thing to contribute on, if you have something to add!

gmsgadget.com

#hacking #bugbounty #cybersecurity Sharing is caring. 😃 Here is a writup of my first earned cve number, CVE-2025-0474 to be precise. A joint effort with @laluka.bsky.social and a totally cool story about a very interesting Server Side Request Forgery, with a twist. Cheers 😃🥳😃🥳😃

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

hear me out, pass the certificate auth on nxc 🔥

I've pushed some updates to Dom-Explorer:
- Allow multiple pipeline embed
- Short links for sharing/sync
- Support for DomPurify triggers
- User settings

Give it a try and share your findings!

yeswehack.github.io/Dom-Explorer

New module on #NetExec : wam
Dump #Entra access tokens from Windows Token Broker Cache, and make your way to Entra 🚀

Thanks @xpnsec.com for the technique! More info on his blog : blog.xpnsec.com/wam-bam/

🚀 Big Announcement! 🚀

After 8+ years of working on PayloadsAllTheThings, I’m excited to release it as an ebook on Leanpub! 📖✨

To celebrate, I’m gifting 2 free copies to random reposters! 🔥

👉 Repost for a chance to win

Thank you all for your incredible support! 🙌

#CyberSecurity #Infosec