Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

❗️Chronomaly: Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x. GitHub:

DarkWebInformer's profile picture

Dark Web Informer

231,288 subscribers

12,659 görüntüleme • 8 ay önce •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Yorum

Yorum bulunmuyor

Orijinal gönderinin yorumları burada görünecek

Benzer Videolar

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130) Cheers to Pumpkin 🎃 for finding these CVEs + the OffensiveCon talk from gteissier & Quentin Minster Picavet for inspiration!
1:13

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130) Cheers to Pumpkin 🎃 for finding these CVEs + the OffensiveCon talk from gteissier & Quentin Minster Picavet for inspiration!

Crusaders of Rust

82,049 görüntüleme • 1 yıl önce

Laravel-livewire RCE (CVE-2025-54068) - Video POC Here is the Exploit Github repo: ~credit synacktiv For more bugbounty content Join my telegram channel:
1:31

Laravel-livewire RCE (CVE-2025-54068) - Video POC Here is the Exploit Github repo: ~credit synacktiv For more bugbounty content Join my telegram channel:

DarkShadow

15,643 görüntüleme • 7 ay önce

Nicolas Carlini showed Claude can find 0-DAY vulnerabilities, in a live conference demo. it found Autonomously finding a blind SQL injection zero-day (CVE-2026-26980) in Ghost CMS, extracting stole admin API keys without authentication in roughly 90 minutes, marking the platform's first critical vulnerability after 20 years and 50,000+ GitHub stars. Then did the exact same thing to the Linux kernel, it few months older video
9:35

Nicolas Carlini showed Claude can find 0-DAY vulnerabilities, in a live conference demo. it found Autonomously finding a blind SQL injection zero-day (CVE-2026-26980) in Ghost CMS, extracting stole admin API keys without authentication in roughly 90 minutes, marking the platform's first critical vulnerability after 20 years and 50,000+ GitHub stars. Then did the exact same thing to the Linux kernel, it few months older video

Md Ismail Šojal 🕷️

15,731 görüntüleme • 2 ay önce

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773) 👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE 🔥 Bypasses all user approvals 🛡️ Patch is out today. Update before someone else does it for you
0:32

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773) 👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE 🔥 Bypasses all user approvals 🛡️ Patch is out today. Update before someone else does it for you

Johann Rehberger

117,645 görüntüleme • 1 yıl önce

U-Boot menu now works on Flipper One Now you can choose different kernels and systemd targets before the Linux kernel boots. * It's our LCD/buttons driver plus a slightly modified vanilla U-Boot menu. Will try to upstream it to U-Boot. * This is a temporary solution for testing the selection of different OS profiles. In the final version of Flipper OS, we’ll most likely draw the boot menu using a small program compiled into initramfs, after the kernel has started. But as a temporary solution, it works perfect. * I’m still not happy with the cold boot time: from powering on the processor to having a working menu. Here’s the boot log with timestamps, captured from the processor console: * Our patched U-Boot:
2:56

U-Boot menu now works on Flipper One Now you can choose different kernels and systemd targets before the Linux kernel boots. * It's our LCD/buttons driver plus a slightly modified vanilla U-Boot menu. Will try to upstream it to U-Boot. * This is a temporary solution for testing the selection of different OS profiles. In the final version of Flipper OS, we’ll most likely draw the boot menu using a small program compiled into initramfs, after the kernel has started. But as a temporary solution, it works perfect. * I’m still not happy with the cold boot time: from powering on the processor to having a working menu. Here’s the boot log with timestamps, captured from the processor console: * Our patched U-Boot:

Flipper R&D

33,355 görüntüleme • 2 ay önce

A Ukrainian MilTech company, Wild Hornets, shared details about a Ukrainian hunter drone, STING. The Wild Hornets team worked on STING for over a year. As of now, STING interceptors have already shot down more than 3,000 such targets. STING is a fast and maneuverable drone that can be deployed in 15 minutes and launched from any flat surface. It intercepts targets at distances of up to 25 km and can return if the target is not detected or already destroyed. Source: X / Wild Hornets
2:55

A Ukrainian MilTech company, Wild Hornets, shared details about a Ukrainian hunter drone, STING. The Wild Hornets team worked on STING for over a year. As of now, STING interceptors have already shot down more than 3,000 such targets. STING is a fast and maneuverable drone that can be deployed in 15 minutes and launched from any flat surface. It intercepts targets at distances of up to 25 km and can return if the target is not detected or already destroyed. Source: X / Wild Hornets

UkraineWorld

17,688 görüntüleme • 6 ay önce

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds
1:42

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

chiefofautism

70,129 görüntüleme • 6 ay önce

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.
4:14

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

Josh Kale

4,065,999 görüntüleme • 5 ay önce

Want to understand UEFI bootkits at a low level? Whether you're doing malware analysis, reverse engineering, exploit development, or kernel research, these are the resources that actually matter. First in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11. Exploits CVE-2022-21894 (BatonDrop), enrolls attacker MOK keys, deploys a kernel driver and HTTP downloader. Sold for $5,000 on forums. by WeLiveSecurity UEFI firmware rootkit targeting VMware VMs. Design inspired by CosmicStrand, MoonBounce, and ESPecter. Injects into a UEFI driver firmware volume, hooks ExitBootServices, catches WinLoad.EFI, hooks OslArchTransferToKernel, then injects a stager into ACPI.SYS to reach kernel execution without triggering PatchGuard. Originally by Austin Hudson (Austin Hudson) who deleted his account. Mirrored here. Binarly's analysis of BlackLotus by Alex Matrosov. Reveals that BlackLotus's code is directly based on btbd's Umap project from 2020, same main function logic, same ImgArchStartBootApplication hook chain, identical trampoline code. Game hacking UEFI bootkit code combined with a publicly available Secure Boot bypass PoC became the first in-the-wild bootkit to defeat Secure Boot. Also covers the CVSS scoring problem, supply chain failures in UEFI revocation, and MokList NVRAM manipulation. by BINARLY🔬 The book. Covers everything from legacy MBR bootkits to modern UEFI implants, firmware rootkits, and Secure Boot internals. If you only read one thing on this list, make it this. by Alex Matrosov ESPecter. Real-world UEFI espionage bootkit found in the wild with roots back to 2012. Patches bootmgfw.efi on disk, hooks the boot chain, disables DSE by patching SepInitializeCodeIntegrity in the kernel. Deploys a keylogger and document stealer. by WeLiveSecurity Reverse engineering of kernel driver by IDontCode. Shows how the entire cheat is public code resold for six figures. Documents the win32kbase.sys vtable pointer swap for kernel function invocation, manual driver mapping using btbd's modmap, and communication via Can's NtConvertBetweenAuxiliaryCounterAndPerformanceCounter .data pointer hook. Credits both Can and btbd directly. by Back Engineering Labs One of the earliest public Windows UEFI bootkit PoCs. Patches winload.efi to disable DSE and load unsigned kernel drivers. Directly inspired EfiGuard. by legendary anti-cheat engineer Aidan Khoury Bootkitting Windows Sandbox. Patches bootmgfw.efi inside the sandbox VHDx to hook the boot chain, disable PatchGuard and DSE, and load unsigned drivers without a debugger attached. Built for kernel research and driver development. by Duncan Ogilvie 🍍 and Dylan Goods from secret club UEFI DXE driver that passively disables PatchGuard and DSE at boot time. Does not modify bootmgfw.efi on disk. Instead hooks EFI System Table LoadImage to intercept the boot chain in memory, then patches SepInitializeCodeIntegrity and KeInitAmd64SpecificState in ntoskrnl. Supports every EFI-compatible Windows x64 from Vista SP1 to Windows 11. by Mattiwatti DMA backdoor via PCIe FPGA. No software on the target machine at all. A Spartan-6 FPGA on a PCIe card reads and writes physical memory over DMA to inject code into the UEFI boot process before the OS loads. The hardware end of the escalation ladder. by Dmytro Oleksiuk 💥 d_olex@mastodon.social Popular in the game hacking community. UEFI manual mapper that maps unsigned drivers into kernel memory from the boot environment, bypassing DSE entirely. Binarly confirmed BlackLotus reused this project's code directly. by BTBD Another UEFI bootkit approach for manual mapping unsigned kernel drivers. Hooks ExitBootServices to patch the kernel in memory before execution. by Samuel Tulach UEFI mapper in the same lineage. by ekknod Many of these use the .data section function pointer hook technique pioneered by the legendary Can. Instead of patching code (which PatchGuard monitors), you overwrite function pointers stored in .data (which PatchGuard doesn't). Still widely used. Combining a Secure Boot bypass with the RedLotus UEFI Bootkit on Windows 11. Full demo. #ReverseEngineering #MalwareAnalysis #Infosec
1:25

Want to understand UEFI bootkits at a low level? Whether you're doing malware analysis, reverse engineering, exploit development, or kernel research, these are the resources that actually matter. First in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11. Exploits CVE-2022-21894 (BatonDrop), enrolls attacker MOK keys, deploys a kernel driver and HTTP downloader. Sold for $5,000 on forums. by WeLiveSecurity UEFI firmware rootkit targeting VMware VMs. Design inspired by CosmicStrand, MoonBounce, and ESPecter. Injects into a UEFI driver firmware volume, hooks ExitBootServices, catches WinLoad.EFI, hooks OslArchTransferToKernel, then injects a stager into ACPI.SYS to reach kernel execution without triggering PatchGuard. Originally by Austin Hudson (Austin Hudson) who deleted his account. Mirrored here. Binarly's analysis of BlackLotus by Alex Matrosov. Reveals that BlackLotus's code is directly based on btbd's Umap project from 2020, same main function logic, same ImgArchStartBootApplication hook chain, identical trampoline code. Game hacking UEFI bootkit code combined with a publicly available Secure Boot bypass PoC became the first in-the-wild bootkit to defeat Secure Boot. Also covers the CVSS scoring problem, supply chain failures in UEFI revocation, and MokList NVRAM manipulation. by BINARLY🔬 The book. Covers everything from legacy MBR bootkits to modern UEFI implants, firmware rootkits, and Secure Boot internals. If you only read one thing on this list, make it this. by Alex Matrosov ESPecter. Real-world UEFI espionage bootkit found in the wild with roots back to 2012. Patches bootmgfw.efi on disk, hooks the boot chain, disables DSE by patching SepInitializeCodeIntegrity in the kernel. Deploys a keylogger and document stealer. by WeLiveSecurity Reverse engineering of kernel driver by IDontCode. Shows how the entire cheat is public code resold for six figures. Documents the win32kbase.sys vtable pointer swap for kernel function invocation, manual driver mapping using btbd's modmap, and communication via Can's NtConvertBetweenAuxiliaryCounterAndPerformanceCounter .data pointer hook. Credits both Can and btbd directly. by Back Engineering Labs One of the earliest public Windows UEFI bootkit PoCs. Patches winload.efi to disable DSE and load unsigned kernel drivers. Directly inspired EfiGuard. by legendary anti-cheat engineer Aidan Khoury Bootkitting Windows Sandbox. Patches bootmgfw.efi inside the sandbox VHDx to hook the boot chain, disable PatchGuard and DSE, and load unsigned drivers without a debugger attached. Built for kernel research and driver development. by Duncan Ogilvie 🍍 and Dylan Goods from secret club UEFI DXE driver that passively disables PatchGuard and DSE at boot time. Does not modify bootmgfw.efi on disk. Instead hooks EFI System Table LoadImage to intercept the boot chain in memory, then patches SepInitializeCodeIntegrity and KeInitAmd64SpecificState in ntoskrnl. Supports every EFI-compatible Windows x64 from Vista SP1 to Windows 11. by Mattiwatti DMA backdoor via PCIe FPGA. No software on the target machine at all. A Spartan-6 FPGA on a PCIe card reads and writes physical memory over DMA to inject code into the UEFI boot process before the OS loads. The hardware end of the escalation ladder. by Dmytro Oleksiuk 💥 [email protected] Popular in the game hacking community. UEFI manual mapper that maps unsigned drivers into kernel memory from the boot environment, bypassing DSE entirely. Binarly confirmed BlackLotus reused this project's code directly. by BTBD Another UEFI bootkit approach for manual mapping unsigned kernel drivers. Hooks ExitBootServices to patch the kernel in memory before execution. by Samuel Tulach UEFI mapper in the same lineage. by ekknod Many of these use the .data section function pointer hook technique pioneered by the legendary Can. Instead of patching code (which PatchGuard monitors), you overwrite function pointers stored in .data (which PatchGuard doesn't). Still widely used. Combining a Secure Boot bypass with the RedLotus UEFI Bootkit on Windows 11. Full demo. #ReverseEngineering #MalwareAnalysis #Infosec

cr3ghost

12,641 görüntüleme • 1 ay önce

Nebula Security is now backed by Y Combinator. We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone. This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 and all Linux distros in 15 years. "IonStack" demonstrates how bad actors can control your phone by sending a malicious URL, but good news, Nebula Security found it before attackers do. Both 0-day were found by our code scanning agent, VEGA, overshadowing any vulnerabilities found by Mythos or any scanner you name it. VEGA has demonstrated its extraordinary capability in finding critical bugs in the world’s most complicated software: operating systems and browsers. It can spot the same vulnerabilities in your codebase too. VEGA support full scan and incremental scan that can integrated into your CI/CD flow. We launched VEGA within YC companies and received overwhelmingly positive feedback. Now it is open to all enterprise customers in private beta. Book a demo with us:
1:00

Nebula Security is now backed by Y Combinator. We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone. This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 and all Linux distros in 15 years. "IonStack" demonstrates how bad actors can control your phone by sending a malicious URL, but good news, Nebula Security found it before attackers do. Both 0-day were found by our code scanning agent, VEGA, overshadowing any vulnerabilities found by Mythos or any scanner you name it. VEGA has demonstrated its extraordinary capability in finding critical bugs in the world’s most complicated software: operating systems and browsers. It can spot the same vulnerabilities in your codebase too. VEGA support full scan and incremental scan that can integrated into your CI/CD flow. We launched VEGA within YC companies and received overwhelmingly positive feedback. Now it is open to all enterprise customers in private beta. Book a demo with us:

NebuSec

225,352 görüntüleme • 2 ay önce

Here is yet another cruel display of how this administration preys on the weak and vulnerable. America’s wild horses are supposed to be protected. Instead, the federal government is rounding them up, selling some for as little as $25, and exploiting a loophole that can strip away their protections and leave them vulnerable to being shipped across our borders for slaughter. In 2025 alone, the government sold approximately 3,700 wild horses—more than double the number sold in previous years. These are magnificent animals that have roamed our public lands for generations. They are part of the history and beauty of the American West, and they belong to the American people. There is something deeply disturbing about a government that continually seems to find its greatest strength when targeting those with the least power to fight back. Whether it is people or animals, how we treat the vulnerable says something about who we are as a nation. Strength is not cruelty. Power is not demonstrated by hurting those who cannot defend themselves. And saving money is not an excuse for abandoning our humanity. Close the loophole. Protect our wild horses. Stop sending these beautiful animals into the slaughter pipeline. We are better than this. 🇺🇸🐎
0:46

Here is yet another cruel display of how this administration preys on the weak and vulnerable. America’s wild horses are supposed to be protected. Instead, the federal government is rounding them up, selling some for as little as $25, and exploiting a loophole that can strip away their protections and leave them vulnerable to being shipped across our borders for slaughter. In 2025 alone, the government sold approximately 3,700 wild horses—more than double the number sold in previous years. These are magnificent animals that have roamed our public lands for generations. They are part of the history and beauty of the American West, and they belong to the American people. There is something deeply disturbing about a government that continually seems to find its greatest strength when targeting those with the least power to fight back. Whether it is people or animals, how we treat the vulnerable says something about who we are as a nation. Strength is not cruelty. Power is not demonstrated by hurting those who cannot defend themselves. And saving money is not an excuse for abandoning our humanity. Close the loophole. Protect our wild horses. Stop sending these beautiful animals into the slaughter pipeline. We are better than this. 🇺🇸🐎

Tamie

20,568 görüntüleme • 19 gün önce

❗️🇺🇦 During September 2025, the air defense of the Defense Forces destroyed 10,215 air targets: ▪️ 1 Kh-47 M2 Kinzhal aeroballistic missile; ▪️ 79 Kh-101/Kh-55SM cruise missiles; ▪️ 2 Iskander-M/KN-23 ballistic missiles; ▪️ 20 Kalibr cruise missiles; ▪️ 9 Kh-59/69 guided aircraft missiles; ▪️ 15 Iskander-K cruise missiles ▪️ 2,724 Shahed attack UAVs; ▪️ 755 reconnaissance UAVs; ▪️ 6,610 UAVs of other types. ✈️ During September, the Air Force aviation carried out 327 flight missions, including: ▪️ about 270 - for fighter air cover; ▪️ more than 50 - for fire damage and air support of troops. 💥 In September 2025, the aviation of the Defense Forces of Ukraine destroyed 516 targets.
0:35

❗️🇺🇦 During September 2025, the air defense of the Defense Forces destroyed 10,215 air targets: ▪️ 1 Kh-47 M2 Kinzhal aeroballistic missile; ▪️ 79 Kh-101/Kh-55SM cruise missiles; ▪️ 2 Iskander-M/KN-23 ballistic missiles; ▪️ 20 Kalibr cruise missiles; ▪️ 9 Kh-59/69 guided aircraft missiles; ▪️ 15 Iskander-K cruise missiles ▪️ 2,724 Shahed attack UAVs; ▪️ 755 reconnaissance UAVs; ▪️ 6,610 UAVs of other types. ✈️ During September, the Air Force aviation carried out 327 flight missions, including: ▪️ about 270 - for fighter air cover; ▪️ more than 50 - for fire damage and air support of troops. 💥 In September 2025, the aviation of the Defense Forces of Ukraine destroyed 516 targets.

MAKS 25 🇺🇦👀

15,262 görüntüleme • 11 ay önce

HOLY CRAP! RFK Jr. just announced the LARGEST autism fraud bust in U.S. HISTORY in Minnesota, with 2 arrested These people are absolutely EVIL. "This was organized theft that exploited the most VULNERABLE CHILDREN in America. Deceived families, stole taxpayer dollars meant to help children with autism access legitimate care and support" "Every fraudulent autism diagnosis steal time, care and resources from the children for whom this program was denied and who desperately need this care." "Fraud makes those barriers even steeper. America is facing a real autism crisis. Today, approximately one in every 31 children is diagnosed with autism spectrum disorder. Medicaid finances a significant share of autism related services nationwide and and spending has risen dramatically over the last decade. And a lot of that spending is because of fraud. When criminals exploit these programs, taxpayers lose billions and vulnerable children lose their access to care." Bury them UNDER the jail.
1:55

HOLY CRAP! RFK Jr. just announced the LARGEST autism fraud bust in U.S. HISTORY in Minnesota, with 2 arrested These people are absolutely EVIL. "This was organized theft that exploited the most VULNERABLE CHILDREN in America. Deceived families, stole taxpayer dollars meant to help children with autism access legitimate care and support" "Every fraudulent autism diagnosis steal time, care and resources from the children for whom this program was denied and who desperately need this care." "Fraud makes those barriers even steeper. America is facing a real autism crisis. Today, approximately one in every 31 children is diagnosed with autism spectrum disorder. Medicaid finances a significant share of autism related services nationwide and and spending has risen dramatically over the last decade. And a lot of that spending is because of fraud. When criminals exploit these programs, taxpayers lose billions and vulnerable children lose their access to care." Bury them UNDER the jail.

Nick Sortor

121,976 görüntüleme • 3 ay önce

🚨 POC for CVE-2025-55182 that works on Next.js 16.0.6 Here are the exact, battle-tested queries you need — Censys, Shodan, FOFA, ZoomEye, Quake, BinaryEdge, and Nuclei matchers — all tuned specifically to find Next.js RSC / React Server Components instances vulnerable to CVE-2025-55182 (React2Shell). ⸻ ✅ 1. SHODAN QUERY (380K+ ASSETS) Find all servers leaking RSC Server Actions: Basic Query "Vary: RSC, Next-Router-State-Tree" More Aggressive Variant http.headers.vary:"RSC" AND http.headers.vary:"Next-Router-State-Tree" Superwide Coverage "Next-Router-State-Tree" OR "x-nextjs-cache" OR "server-actions" OR "__RSC__" Focused on Vulnerable Cache Indicators "x-nextjs-cache: HIT" "Next-Router-State-Tree" ⸻ ✅ 2. CENSYS QUERY (270K+ ASSETS) (match the screenshot you posted) Exact Censys Search services.http.response.headers.vary: "RSC, Next-Router-State-Tree" Safer Multi-Matcher services.http.response.headers.vary: "RSC" AND services.http.response.headers.vary: "Next-Router-State-Tree" Detect RSC Payload Exposure (critical) services.http.response.body: "__RSC__" Detect Flight Data Leaks services.http.response.body: "server-reference-manifest" ⸻ ✅ 3. FOFA QUERY (CHINA’S OSINT GIANT) (VERY POWERFUL for RSC/Next.js) Exact Header Based header="Next-Router-State-Tree" && header="RSC" Alternative (match screenshot patterns) "Next-Router-State-Tree" && "x-nextjs-cache" For massive result count body="__RSC__" || header="server-actions" ⸻ ✅ 4. ZOOMEYE QUERY ZoomEye scans often catch Node.js apps Shodan misses. Exact Unicode-Ready Query "Next-Router-State-Tree" && "RSC" Advanced app:"Next.js" && header:"RSC" ⸻ ✅ 5. QUAKE SEARCH (360K+ MATCHES) header:"Next-Router-State-Tree" AND header:"RSC" ⸻ ✅ 6. BINARYEDGE QUERY http.response.headers.vary:"Next-Router-State-Tree" ⸻ ✅ 7. QUERY headers:"Next-Router-State-Tree" && headers:"RSC" ⸻ 🎯 8. NUCLEI MATCHER (to detect RSC without scanning payloads) If you want a nuclei detector you can plug into your scanner: matchers: - type: word part: header words: - "RSC" - "Next-Router-State-Tree" - "server-actions" - "__RSC__" ⸻ 🚩 BONUS — THE MOST ADVANCED CROSS-ENGINE QUERY Use this when you want maximum global coverage: "Next-Router-State-Tree" OR "RSC" OR "__RSC__" OR "server-actions" OR "x-nextjs-cache" OR "Next-Server-Action" This identifies: •Next.js App Router •RSC endpoints •Server Actions •Flight data APIs •Pages exposing cache HITs (required for exploitation) •Systems likely vulnerable to CVE-2025-55182 (React2Shell)
0:32

🚨 POC for CVE-2025-55182 that works on Next.js 16.0.6 Here are the exact, battle-tested queries you need — Censys, Shodan, FOFA, ZoomEye, Quake, BinaryEdge, and Nuclei matchers — all tuned specifically to find Next.js RSC / React Server Components instances vulnerable to CVE-2025-55182 (React2Shell). ⸻ ✅ 1. SHODAN QUERY (380K+ ASSETS) Find all servers leaking RSC Server Actions: Basic Query "Vary: RSC, Next-Router-State-Tree" More Aggressive Variant http.headers.vary:"RSC" AND http.headers.vary:"Next-Router-State-Tree" Superwide Coverage "Next-Router-State-Tree" OR "x-nextjs-cache" OR "server-actions" OR "__RSC__" Focused on Vulnerable Cache Indicators "x-nextjs-cache: HIT" "Next-Router-State-Tree" ⸻ ✅ 2. CENSYS QUERY (270K+ ASSETS) (match the screenshot you posted) Exact Censys Search services.http.response.headers.vary: "RSC, Next-Router-State-Tree" Safer Multi-Matcher services.http.response.headers.vary: "RSC" AND services.http.response.headers.vary: "Next-Router-State-Tree" Detect RSC Payload Exposure (critical) services.http.response.body: "__RSC__" Detect Flight Data Leaks services.http.response.body: "server-reference-manifest" ⸻ ✅ 3. FOFA QUERY (CHINA’S OSINT GIANT) (VERY POWERFUL for RSC/Next.js) Exact Header Based header="Next-Router-State-Tree" && header="RSC" Alternative (match screenshot patterns) "Next-Router-State-Tree" && "x-nextjs-cache" For massive result count body="__RSC__" || header="server-actions" ⸻ ✅ 4. ZOOMEYE QUERY ZoomEye scans often catch Node.js apps Shodan misses. Exact Unicode-Ready Query "Next-Router-State-Tree" && "RSC" Advanced app:"Next.js" && header:"RSC" ⸻ ✅ 5. QUAKE SEARCH (360K+ MATCHES) header:"Next-Router-State-Tree" AND header:"RSC" ⸻ ✅ 6. BINARYEDGE QUERY http.response.headers.vary:"Next-Router-State-Tree" ⸻ ✅ 7. QUERY headers:"Next-Router-State-Tree" && headers:"RSC" ⸻ 🎯 8. NUCLEI MATCHER (to detect RSC without scanning payloads) If you want a nuclei detector you can plug into your scanner: matchers: - type: word part: header words: - "RSC" - "Next-Router-State-Tree" - "server-actions" - "__RSC__" ⸻ 🚩 BONUS — THE MOST ADVANCED CROSS-ENGINE QUERY Use this when you want maximum global coverage: "Next-Router-State-Tree" OR "RSC" OR "__RSC__" OR "server-actions" OR "x-nextjs-cache" OR "Next-Server-Action" This identifies: •Next.js App Router •RSC endpoints •Server Actions •Flight data APIs •Pages exposing cache HITs (required for exploitation) •Systems likely vulnerable to CVE-2025-55182 (React2Shell)

X

10,544 görüntüleme • 9 ay önce