Coffin

@lostsec_ • 29,799 subscribers

ʜᴇʟᴘɪɴɢ ᴏʀɢᴀɴɪᴢᴀᴛɪᴏɴꜱ ꜱᴛᴀʏ ꜱᴇᴄᴜʀᴇ ᴛʜʀᴏᴜɢʜ ʙᴜɢ ʜᴜɴᴛɪɴɢ, ᴏꜱɪɴᴛ ᴀɴᴅ ꜱᴇᴄᴜʀɪᴛʏ ʀᴇꜱᴇᴀʀᴄʜ | ᴡʀɪᴛᴇᴜᴘꜱ: https://t.co/39DXITYobD | ᴄᴏᴍᴍᴜɴɪᴛʏ: https://t.co/7HlHg4MWbh

Shorts

Here’s a proper PoC I made for PasteJacking XSS. You can test it yourself on my website:

29,801 views

i made a simple CORS PoC, just replace the target and test it against a sensitive endpoint, since public ones usually don’t qualify for a valid report..

17,706 views

Videos

LIVE

1.2k

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Streaming Now

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

HD live stream

Exclusive private shows

1.2k viewers online

Current Status

Live

Private Show

Join now for exclusive access

Free preview available • Premium content

Live Cam

Coffin

Shorts

Here’s a proper PoC I made for PasteJacking XSS. You can test it yourself on my website:

i made a simple CORS PoC, just replace the target and test it against a sensitive endpoint, since public ones usually don’t qualify for a valid report..

Videos

Watch Anya Live

if you are a bug hunter and your notes don’t look like this, you’re not my type..

/Dependency Confusion/ FULL SYSTEM + CLOUD METADATA HARVESTING &amp; MULTI-CHANNEL EXFILTRATION (DNS + HTTP)

People seriously underestimate how dangerous leaked Google API keys are. With just a little know-how, you can use them to access Gemini without spending money. This clip is just a small demo. I’ve covered a wide range of dorks and methods in my member only video.

Hi everyone! I just built a WaybackURLs extension that saves you a ton of time when gathering archive URLs. it supports main domains, wildcards, specific paths and sensitive file extensions. Give it a try and let me know your feedback!

just built this tool, take a look 🔥

Finally our website is live! You’ll find all the bug hunting commands, tools, extensions &amp; writeups here—many more things coming soon for all types of bugs. Huge thanks to @madhusudan91263 for contributing and making this toolkit even more amazing!

Try the latest version of Crtmon. We’ve completely removed Docker, so you can now run the tool without any Docker-related issues. It also works smoothly with stdin input.

so finally guys here is your final script for xss now its give you results with 0% false postive free tool for all 🔥and special thanks to my brother who make this tool more better and we will add all owsp top 10 vuln scan soon..

amazing xss tool ❤️

Google Captcha Bypass :) thank to my friend Sarper⚡

tried something new for the Bug Hunting community i hope this will help in there hunting jurney ❤️ site: special thanks to my team haq and javox to make it more better..

I used to think people didn’t really care about the content or its value. But after seeing all the comments on my YouTube and X posts, I’m honestly amazed by the reactions. It really motivates me to keep improving and make even better content.. #yourLostsecForever

Created a private bookmarklet packed with features to extract hidden paths, URLs and endpoints. It fetches data from HTML elements, inline scripts, quoted strings, performance logs and even external JavaScript files for deep reconnaissance.

get lifetime free powerful ryzen 9 vps for Bug hunting 🔥 watch poc and full details how to setup in my telegram channel

i see some guy struggling with shodan ip extraction and showing long process here you go use this one click method and boom 💥

These three extensions will definitely help and save you time during your bug hunting process: Fake Filler, Code Formatter: js, css, json

/Dependency Confusion/ FULL SYSTEM + CLOUD METADATA HARVESTING & MULTI-CHANNEL EXFILTRATION (DNS + HTTP)

Finally our website is live! You’ll find all the bug hunting commands, tools, extensions & writeups here—many more things coming soon for all types of bugs. Huge thanks to @madhusudan91263 for contributing and making this toolkit even more amazing!