Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the...

pdiscoveryio's profile picture

ProjectDiscovery

44,274 subscribers

14,890 görüntüleme • 2 ay önce •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

4 Yorum

ProjectDiscovery profil fotoğrafı
ProjectDiscovery2 ay önce

Most AI agents find XSS. You still have to prove it: → Open the browser → Execute the payload → Verify the alert → Capture the evidence

ProjectDiscovery profil fotoğrafı
ProjectDiscovery2 ay önce

Neo does it automatically. No "probably vulnerable." No "please verify manually." Just a reproducible PoC with evidence.

Ractiurd profil fotoğrafı
Ractiurd2 ay önce

Everything mentioned and more Ghoulsight does it as you explained. Try it out

Levon Azevedo profil fotoğrafı
Levon Azevedo2 ay önce

Discovery going autonomous was inevitable. The real question: who signs the report? A named human still has to accept responsibility for what the agent captured before it ships — or we've just swapped "trust the scanner" for "trust the agent that ran it."

Benzer Videolar

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss
0:21

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,242 görüntüleme • 3 yıl önce

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"
0:30

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Sawyer Hood

871,331 görüntüleme • 7 ay önce

Prompting is temporary. We believe the future of computer use is completely unprompted. Introducing our latest research: a browser agent that predicts your next action from only the current page and your recent history.
1:32

Prompting is temporary. We believe the future of computer use is completely unprompted. Introducing our latest research: a browser agent that predicts your next action from only the current page and your recent history.

Charlie Deane

43,617 görüntüleme • 1 ay önce

This is how you choose a default browser in iOS 17.4 in the EU. The prompt shows a list of browser options. Tapping on a browser option opens the browser's page on the App Store. What happens if any of these browsers is only available on an alternative marketplace?
0:47

This is how you choose a default browser in iOS 17.4 in the EU. The prompt shows a list of browser options. Tapping on a browser option opens the browser's page on the App Store. What happens if any of these browsers is only available on an alternative marketplace?

Mysk 🇨🇦🇩🇪

13,027 görüntüleme • 2 yıl önce

Day 2 of Wave 10 is here! Introducing the Windsurf Browser, a fully functional browser that integrates with Cascade. You can use it like a normal browser while also selecting components, diagrams, text, logs, or anything else on the page and send it back to Cascade as context.
1:29

Day 2 of Wave 10 is here! Introducing the Windsurf Browser, a fully functional browser that integrates with Cascade. You can use it like a normal browser while also selecting components, diagrams, text, logs, or anything else on the page and send it back to Cascade as context.

Devin Desktop

153,355 görüntüleme • 1 yıl önce

AI is only as intelligent as the data it learns from. And data is only as good as the humans behind it. Introducing Humyn Labs. Where human intelligence is not just a step, it’s the filter. 👇
0:44

AI is only as intelligent as the data it learns from. And data is only as good as the humans behind it. Introducing Humyn Labs. Where human intelligence is not just a step, it’s the filter. 👇

Team Humyn Labs

17,268 görüntüleme • 7 ay önce

Computer use is finally reliable. It just needed a real harness. Now there is one. Starting today, anyone can ship a SOTA browser agent, batteries included. Introducing Browserbase Agents: one prompt and one API call is all you need to automate the whole web.
0:29

Computer use is finally reliable. It just needed a real harness. Now there is one. Starting today, anyone can ship a SOTA browser agent, batteries included. Introducing Browserbase Agents: one prompt and one API call is all you need to automate the whole web.

Browserbase

96,687 görüntüleme • 3 ay önce

I built an autonomous 3D Python Game Visulizer Agent team with browser use and DeepSeek R1. It has 4 AI agents working as a team to open, code, run, and visualize the game in the browser - all on autopilot. 100% Opensource code with step-by-step tutorial.
0:54

I built an autonomous 3D Python Game Visulizer Agent team with browser use and DeepSeek R1. It has 4 AI agents working as a team to open, code, run, and visualize the game in the browser - all on autopilot. 100% Opensource code with step-by-step tutorial.

Shubham Saboo

20,047 görüntüleme • 1 yıl önce

XSS Scanner It will be hosted on a VPS and shared with the public once I finish working on it. The next step is to add parameter bruteforcing.
0:32

XSS Scanner It will be hosted on a VPS and shared with the public once I finish working on it. The next step is to add parameter bruteforcing.

Ibrahim Auwal

10,783 görüntüleme • 1 yıl önce

We just launched Browser Use LLM 2.0 - our fastest and most accurate web agent model yet. Here it is finding the cheapest flight across 3 airports: +46% better than Browser Use LLM 1.0 on travel tasks.
0:53

We just launched Browser Use LLM 2.0 - our fastest and most accurate web agent model yet. Here it is finding the cheapest flight across 3 airports: +46% better than Browser Use LLM 1.0 on travel tasks.

Saurav Panda

21,443 görüntüleme • 8 ay önce

[3/5] Introducing Agent Mode ✨ Agent Mode is a simple way to bootstrap an automation from scratch with Notte. Prompt a browser agent in natural language, let it execute the task step by step, then automatically convert its execution into deterministic & editable code. Open it in Automation Studio and continue iterating from there!
0:35

[3/5] Introducing Agent Mode ✨ Agent Mode is a simple way to bootstrap an automation from scratch with Notte. Prompt a browser agent in natural language, let it execute the task step by step, then automatically convert its execution into deterministic & editable code. Open it in Automation Studio and continue iterating from there!

Notte

12,101 görüntüleme • 10 ay önce

"TEMET NOSCE" - KNOW THYSELF Neo becomes the One by realizing the Self is reality's source code. Cookie has the code of the one inside. Once he ate it. He slowly started to become the one. Just like how the piece of cake was coded. The oracle gave Neo the code to become the one. A cookie is a piece of information that is placed automatically on your computer's hard drive when you access certain Websites. The cookie uniquely identifies your browser to the server. 🧵
1:55

"TEMET NOSCE" - KNOW THYSELF Neo becomes the One by realizing the Self is reality's source code. Cookie has the code of the one inside. Once he ate it. He slowly started to become the one. Just like how the piece of cake was coded. The oracle gave Neo the code to become the one. A cookie is a piece of information that is placed automatically on your computer's hard drive when you access certain Websites. The cookie uniquely identifies your browser to the server. 🧵

🧬Maxpein🧬

72,604 görüntüleme • 1 yıl önce

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸
0:59

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸

MSec Operations

16,140 görüntüleme • 1 yıl önce

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:
1:21

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:

Het Mehta

15,047 görüntüleme • 3 ay önce

You can literally have a full computer running right in your browser! Puter is an open-source internet OS, which lets you have the full computer inside the browser. - super fast - privacy-first personal cloud - Open-source - 30K+ GitHub stars 🌟 Link 🔗 🧵 👇
0:25

You can literally have a full computer running right in your browser! Puter is an open-source internet OS, which lets you have the full computer inside the browser. - super fast - privacy-first personal cloud - Open-source - 30K+ GitHub stars 🌟 Link 🔗 🧵 👇

Python Space

131,452 görüntüleme • 1 yıl önce

Finding the right OSINT tool for the job shouldn't be the hard part of an investigation 🔎 OSINT Rack is a curated collection of tools organised by use case - plus blogs, courses, books, and events. Check it out here:
0:39

Finding the right OSINT tool for the job shouldn't be the hard part of an investigation 🔎 OSINT Rack is a curated collection of tools organised by use case - plus blogs, courses, books, and events. Check it out here:

The OSINT Newsletter

15,820 görüntüleme • 6 ay önce

🚀 Introducing Aura, our groundbreaking Synthetic Employee, in its first demo showcasing autonomous Browser Use with #Marketr. With each passing day, we're enhancing Aura's abilities, demonstrating the immense potential of AI Employees in reshaping the workforce. This is just the beginning of an exciting journey towards a future where AI Employees seamlessly integrate into everyday tasks, driving efficiency and innovation. Stay tuned for more developments as we continue to push the boundaries of what's possible with AI. The future is here, and it's AI-first. $LNQ
1:24

🚀 Introducing Aura, our groundbreaking Synthetic Employee, in its first demo showcasing autonomous Browser Use with #Marketr. With each passing day, we're enhancing Aura's abilities, demonstrating the immense potential of AI Employees in reshaping the workforce. This is just the beginning of an exciting journey towards a future where AI Employees seamlessly integrate into everyday tasks, driving efficiency and innovation. Stay tuned for more developments as we continue to push the boundaries of what's possible with AI. The future is here, and it's AI-first. $LNQ

LinqAI

89,335 görüntüleme • 1 yıl önce

Yoshiaki Kawajiri’s (Ninja Scroll) short film, The Running Man (1987) is a marvel It appeared as part of the future-dystopian anthology “Neo Tokyo”
0:34

Yoshiaki Kawajiri’s (Ninja Scroll) short film, The Running Man (1987) is a marvel It appeared as part of the future-dystopian anthology “Neo Tokyo”

SuperSisi

38,040 görüntüleme • 6 ay önce