正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:

Dark Web Informer

222,084 subscribers

24,247 次观看 • 6 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

‼️ Leaking the email of any YouTube user for $10,000 Bug Bounty Writeup:

‼️ Leaking the email of any YouTube user for $10,000 Bug Bounty Writeup:

Dark Web Informer

44,839 次观看 • 5 个月前

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

58,758 次观看 • 17 天前

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Dark Web Informer

97,512 次观看 • 6 个月前

[Bug Bounty] $3,000 Instagram delete highlight cover IDOR Credit: Write-up:

[Bug Bounty] $3,000 Instagram delete highlight cover IDOR Credit: Write-up:

Dark Web Informer

32,576 次观看 • 1 年前

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

Ron Masas

76,731 次观看 • 2 年前

What would you do with $16,000,000? Today, Usual is announcing the largest bug bounty in the history of the world: A $16,000,000 reward for discovering a single critical vulnerability in Usual's codebase. Hosted on Sherlock, in partnership with Nexus Mutual.

What would you do with $16,000,000? Today, Usual is announcing the largest bug bounty in the history of the world: A $16,000,000 reward for discovering a single critical vulnerability in Usual's codebase. Hosted on Sherlock, in partnership with Nexus Mutual.

SHERLOCK

3,818,685 次观看 • 1 年前

Integrity flow vulnerability in "microsoft teams" poll 3000$ bounty Sometimes, overlooked isuue can create significant vulnerability. In the "displayname" field, we send the name of the person we want the message to be send. #bugbounty

Integrity flow vulnerability in "microsoft teams" poll 3000$ bounty Sometimes, overlooked isuue can create significant vulnerability. In the "displayname" field, we send the name of the person we want the message to be send. #bugbounty

Moslem Haghighian

11,998 次观看 • 3 年前

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,216 次观看 • 2 年前

New writeup from ꙅɿɘƚɔɘqꙅ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate. Full disclosure:

New writeup from ꙅɿɘƚɔɘqꙅ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate. Full disclosure:

Sam Curry

344,668 次观看 • 1 年前

Responsible disclosure and community contributions to security are critical for safeguarding zkSync Era. We’re excited to announce that the Immunefi bug bounty reward has been increased to $1.1M, with all L2 assets now in scope. Help secure zkSync Era:

Responsible disclosure and community contributions to security are critical for safeguarding zkSync Era. We’re excited to announce that the Immunefi bug bounty reward has been increased to $1.1M, with all L2 assets now in scope. Help secure zkSync Era:

ZKsync

229,310 次观看 • 3 年前

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Nebula Security

91,104 次观看 • 1 个月前

Iranians from of Varamin (an hour drive from Tehran) have placed a bounty on the heads of Netanyahu and/or Trump. The reward is 100 kg of gold

Iranians from of Varamin (an hour drive from Tehran) have placed a bounty on the heads of Netanyahu and/or Trump. The reward is 100 kg of gold

Arya Yadeghaar (Backup)

64,875 次观看 • 25 天前

Over $100,000💵 for reporting for a bug🔥⚡️ Cyber samurai, you are officially invited on a journey for a bug-free future of finance! Are you ready to take on your armour and battle with us? #CrossFi Foundation launches the Bug Bounty⚡️ The reward structure is in line with the Warrior Code 🔹Over $100,000 – critical bugs 🔹Over $50,000 – huge 🔹$5,000-$50,000 – medium 🔹Up to $7,500 – low 🔁There are no limits! You can report as many bugs as you can find!!! Read more about the Bug Bounty program on the official CrossFi Foundation website Have you already started your Way of the Crypto Samurai? 📣Submit the bug in this form and get your rewards! #money $XFI #crypto #defi #fintech #finance #blockchain #card #visa #cryptocard #decentralized #crosschain #token #technology #innovation #earn #reward #warrior

Over $100,000💵 for reporting for a bug🔥⚡️ Cyber samurai, you are officially invited on a journey for a bug-free future of finance! Are you ready to take on your armour and battle with us? #CrossFi Foundation launches the Bug Bounty⚡️ The reward structure is in line with the Warrior Code 🔹Over $100,000 – critical bugs 🔹Over $50,000 – huge 🔹$5,000-$50,000 – medium 🔹Up to $7,500 – low 🔁There are no limits! You can report as many bugs as you can find!!! Read more about the Bug Bounty program on the official CrossFi Foundation website Have you already started your Way of the Crypto Samurai? 📣Submit the bug in this form and get your rewards! #money $XFI #crypto #defi #fintech #finance #blockchain #card #visa #cryptocard #decentralized #crosschain #token #technology #innovation #earn #reward #warrior

CrossFi

10,253 次观看 • 2 年前

🏃‍♂️NEW CHALLENGE BOUNTY🏃‍♀️ VERDUDOUS BY CURSED 63% FROM 0, ID: 86522520 REWARD: $50 (Should be easy right?) SAME RULES AS ALWAYS GOOD LUCK DEMONS👿

🏃‍♂️NEW CHALLENGE BOUNTY🏃‍♀️ VERDUDOUS BY CURSED 63% FROM 0, ID: 86522520 REWARD: $50 (Should be easy right?) SAME RULES AS ALWAYS GOOD LUCK DEMONS👿

Hqmy

18,239 次观看 • 1 个月前

New video: dawgyg - WoH covered a lot, including: how AI-generated bug bounty reports are a burden on OSS (FFmpeg mentioned), transitioning from bug hunting to working in-house on an AppSec team, the early blackhat days, and multiple appearances of his cats. 30sec clip:

New video: dawgyg - WoH covered a lot, including: how AI-generated bug bounty reports are a burden on OSS (FFmpeg mentioned), transitioning from bug hunting to working in-house on an AppSec team, the early blackhat days, and multiple appearances of his cats. 30sec clip:

solst/ICE of Astarte

33,940 次观看 • 5 个月前

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:

NullSecurityX

19,539 次观看 • 3 个月前

Charlie Kirk was shot from behind and no expert in any field can prove me wrong. The Evidence Bounty is now close to $3,000. Why hasn't the original video come forward? Visit and take up the challenge or boost the bounty to help get to the bottom of this.

Charlie Kirk was shot from behind and no expert in any field can prove me wrong. The Evidence Bounty is now close to $3,000. Why hasn't the original video come forward? Visit and take up the challenge or boost the bounty to help get to the bottom of this.

Crowdsource The Truth

46,645 次观看 • 9 个月前

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,744 次观看 • 8 个月前

Codename MDASH is an agentic vulnerability discovery and remediation system built to help teams find issues, move faster on fixes, and create secure code from the start. Coming soon to GitHub Copilot CLI and the Microsoft Defender portal.

Codename MDASH is an agentic vulnerability discovery and remediation system built to help teams find issues, move faster on fixes, and create secure code from the start. Coming soon to GitHub Copilot CLI and the Microsoft Defender portal.

Microsoft Developer

10,952 次观看 • 1 个月前