Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)

NullSecurityX's profile picture

NullSecurityX

12,241 subscribers

95,298 Aufrufe • vor 6 Monaten •via X (Twitter)

Nachrichten & PolitikWissenschaft & Technologie
LIVE

Anya Rossi• Live Now

Private livecam show

9 Kommentare

Profilbild von jordi driessen
jordi driessenvor 6 Monaten

Can steal your gifts in one click!

Profilbild von Xixis779988
Xixis779988vor 6 Monaten

Vulnerability fixed in Telegram Web in March 2024

Profilbild von Sascha Dämgen
Sascha Dämgenvor 6 Monaten

🧐

Profilbild von SpeedR AI
SpeedR AIvor 6 Monaten

SpeedR AI @SpeedR_AI · is the first and only chat app that cannot be phished or highjacked. Because it has no registration, nor servers. It is Peer-to-peer Post Quantum Encryption that works without server.

Profilbild von Brayy
Brayyvor 6 Monaten

nice vulnerability

Profilbild von Chris B. Ward (e/bored) 🇬🇧🇮🇪🤐
Chris B. Ward (e/bored) 🇬🇧🇮🇪🤐vor 6 Monaten

2024?

Profilbild von Midnight Ledger
Midnight Ledgervor 6 Monaten

Check our page , you wouldn’t regret it

Profilbild von Jessica Hunt
Jessica Huntvor 6 Monaten

XSS in TWAs. Attack surface not many researchers are touching. Solid catch.

Profilbild von Max
Maxvor 6 Monaten

@durov any ideas?

Ähnliche Videos

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE
0:33

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE

Dark Web Informer

64,458 Aufrufe • vor 2 Jahren

‼️ CVE-2025-26529: Moodle XSS to RCE Exploit GitHub:
3:48

‼️ CVE-2025-26529: Moodle XSS to RCE Exploit GitHub:

Dark Web Informer

41,057 Aufrufe • vor 3 Monaten

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:
0:28

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution PoC:

Dark Web Informer

112,465 Aufrufe • vor 2 Tagen

It's been just over a year since CVE-2024-54529 was patched. To celebrate, I'm open-sourcing my full PoC exploit for this CoreAudio type confusion vulnerability 🔊 The code is right here! Enjoy:
0:23

It's been just over a year since CVE-2024-54529 was patched. To celebrate, I'm open-sourcing my full PoC exploit for this CoreAudio type confusion vulnerability 🔊 The code is right here! Enjoy:

Dillon Franke

39,754 Aufrufe • vor 8 Monaten

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!
0:32

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. Please patch CVE-2026-64638 as soon as possible!

pwn.ai

1,661,146 Aufrufe • vor 2 Monaten

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability
1:06

🚨POC RELEASED🚨PoC for SQL Injection leads to RCE in Wordpress released (CVE-2024-27956). #Clearnet #DarkWebInformer #DarkWeb #Exploit #Cyberattack #Cybercrime #Wordpress #Infosec #CTI #CVE202427956 #Vulnerability

Dark Web Informer

51,871 Aufrufe • vor 2 Jahren

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:
0:51

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

60,343 Aufrufe • vor 3 Monaten

Exploiting a DOM-XSS vulnerability in a BBP with DorkixAI
1:15

Exploiting a DOM-XSS vulnerability in a BBP with DorkixAI

Gospel

15,425 Aufrufe • vor 6 Monaten

CVE-2023-23397 Simple and dirty PoC of the CVE-2023-23397 vulnerability impacting the Outlook thick client. #CVE #cybersecurity #infosec
0:42

CVE-2023-23397 Simple and dirty PoC of the CVE-2023-23397 vulnerability impacting the Outlook thick client. #CVE #cybersecurity #infosec

HackGit

76,809 Aufrufe • vor 3 Jahren

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:
0:22

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:

Dark Web Informer

24,247 Aufrufe • vor 9 Monaten

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.
0:48

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.

ProjectDiscovery

14,890 Aufrufe • vor 2 Monaten

🚨CVE-2023-20198: Remote Code Execution via File Upload Vulnerability | $15,000 Bounty | PoC Credit:
3:26

🚨CVE-2023-20198: Remote Code Execution via File Upload Vulnerability | $15,000 Bounty | PoC Credit:

Dark Web Informer

22,498 Aufrufe • vor 1 Jahr

Discovered a new xss payload that bypasses cloudflare web application firewall!! Payload: <button%20popovertarget=x>Click%20me</button><img%20onbeforetoggle=alert(1)%20popover%20id=x>XSS #cybersecurity #ethicalhacking #bugbounty #bugbountytips #penetrationtesting
0:23

Discovered a new xss payload that bypasses cloudflare web application firewall!! Payload: <button%20popovertarget=x>Click%20me</button><img%20onbeforetoggle=alert(1)%20popover%20id=x>XSS #cybersecurity #ethicalhacking #bugbounty #bugbountytips #penetrationtesting

Faiyaz Ahmad

37,725 Aufrufe • vor 2 Jahren

🚨CVE-2024-21413 - Microsoft Outlook Remote Code Execution Vulnerability PoC (no audio) Credit:
2:37

🚨CVE-2024-21413 - Microsoft Outlook Remote Code Execution Vulnerability PoC (no audio) Credit:

Dark Web Informer

69,386 Aufrufe • vor 1 Jahr

🚨CVE-2024-40725: Apache 2.4.0/2.4.61 HTTP Request Smuggling... Using Custom Nuclei Template CVSS: 5.3 PoC: Via:
2:03

🚨CVE-2024-40725: Apache 2.4.0/2.4.61 HTTP Request Smuggling... Using Custom Nuclei Template CVSS: 5.3 PoC: Via:

Dark Web Informer

21,030 Aufrufe • vor 1 Jahr

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:
1:21

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:

Het Mehta

15,047 Aufrufe • vor 3 Monaten

Laravel-livewire RCE (CVE-2025-54068) - Video POC Here is the Exploit Github repo: ~credit synacktiv For more bugbounty content Join my telegram channel:
1:31

Laravel-livewire RCE (CVE-2025-54068) - Video POC Here is the Exploit Github repo: ~credit synacktiv For more bugbounty content Join my telegram channel:

DarkShadow

15,727 Aufrufe • vor 8 Monaten

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss
0:21

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,242 Aufrufe • vor 3 Jahren

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!
1:09

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!

Michael Bargury

46,679 Aufrufe • vor 2 Monaten