Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

How I discovered and exploited an unauthenticated SSRF in the Havoc C2 teamserver, allowing attackers to leak origin IPs of teamservers behind redirectors and much more!

chebuya

1,923 subscribers

95,407 views • 2 years ago •via X (Twitter)

Gaming Science & Technology News & Politics

Anya Rossi• Live Now

Private livecam show

9 Comments

5pider2 years ago

Great work mate :D

chebuya2 years ago

:3

Toha2 years ago

wow! Very cool! Can we execute commands via this opened socket?

S4ntiagoP2 years ago

@vysecurity Nice one!

Quang Vo2 years ago

well done mate

HUNTER1 year ago

Hi do you find new one CVE or Exploite old one?

Sofiane Hamlaoui2 years ago

Well done brother👏

Danymat2 years ago

How to hack hackers

Marcel Bilal2 years ago

Awesome work @_chebuya

Related Videos

How I discovered and exploited an Unauthenticated RCE in BYOB (Build Your Own Botnet), an open-source post-exploitation framework for students, researchers and developers with close to 9k stars on GitHub!

How I discovered and exploited an Unauthenticated RCE in BYOB (Build Your Own Botnet), an open-source post-exploitation framework for students, researchers and developers with close to 9k stars on GitHub!

chebuya

65,143 views • 1 year ago

In October 2025, a critical server-side flaw in Instagram made it possible for unauthenticated attackers to view private photos and captions without needing to log in or to follow the account. Instagram silently patched the vulnerability. Here’s how the PoC worked…

In October 2025, a critical server-side flaw in Instagram made it possible for unauthenticated attackers to view private photos and captions without needing to log in or to follow the account. Instagram silently patched the vulnerability. Here’s how the PoC worked…

Dark Web Informer

31,286 views • 6 months ago

How I discovered the Royal Observatory and an insight into the purpose of riddles. 👀

How I discovered the Royal Observatory and an insight into the purpose of riddles. 👀

NotFinancialAdvice.Crypto

59,522 views • 1 year ago

The origin of "Free Palestine" isn't what you think. Watch Pastor Dumisani Washington of IBSI uncover how a calculated strategy to connect the movement to the historic black struggle for freedom continues to shape today's narrative, in Episode 1 of "We Are Not the Same: How 'Free Palestine' Exploited the Black Community." Learn more at: and Iben Merrild on

The origin of "Free Palestine" isn't what you think. Watch Pastor Dumisani Washington of IBSI uncover how a calculated strategy to connect the movement to the historic black struggle for freedom continues to shape today's narrative, in Episode 1 of "We Are Not the Same: How 'Free Palestine' Exploited the Black Community." Learn more at: and Iben Merrild on

FactsForPeace

101,435 views • 10 months ago

Stan Lee the mastermind and Creator behind Marvel, in his last years was exploited and tooled advantage of by those closest to him.

Stan Lee the mastermind and Creator behind Marvel, in his last years was exploited and tooled advantage of by those closest to him.

Johnny Midnight ⚡️

380,459 views • 7 months ago

Abyss of Dagath is coming to the Origin System THIS WEEK, Tenno! Get ready for the 54th #Warframe, an improved player experience, must-have Bundles and so much more:

Abyss of Dagath is coming to the Origin System THIS WEEK, Tenno! Get ready for the 54th #Warframe, an improved player experience, must-have Bundles and so much more:

WARFRAME

257,927 views • 2 years ago

And it's a cut! Last visit (as an author in search of conversations) to Bodymoor Heath. What a year this has been. I have learnt so much about how a PL club runs, the phsycological side of being a manager, how to create the right elite atmosphere and so much more. Villa is at the forefront of football and I hope to reflect all that in #RiseOfTheVillans 📚

And it's a cut! Last visit (as an author in search of conversations) to Bodymoor Heath. What a year this has been. I have learnt so much about how a PL club runs, the phsycological side of being a manager, how to create the right elite atmosphere and so much more. Villa is at the forefront of football and I hope to reflect all that in #RiseOfTheVillans 📚

Guillem Balague

107,467 views • 1 year ago

CRY HAVOC Official Trailer All legends have a beginning. A novel of brotherhood and betrayal, CRY HAVOC takes you behind enemy lines in the Secret War alongside Navy SEAL Tom Reece attached to the shadowy special operations unit known as MACV-SOG as they unravel a deadly plot that is set to shift the balance of power between East and West as the Cold War turns hot. Discover the untold origin of The Terminal List. ⚡ Pre-order your copy of CRY HAVOC today! 👉

CRY HAVOC Official Trailer All legends have a beginning. A novel of brotherhood and betrayal, CRY HAVOC takes you behind enemy lines in the Secret War alongside Navy SEAL Tom Reece attached to the shadowy special operations unit known as MACV-SOG as they unravel a deadly plot that is set to shift the balance of power between East and West as the Cold War turns hot. Discover the untold origin of The Terminal List. ⚡ Pre-order your copy of CRY HAVOC today! 👉

Jack Carr

24,261 views • 10 months ago

Video demo of bypassing Windows Defender App Control with Loki C2! Blog with details coming in 1-2 weeks. Yes -- Dylan Tran and I created an entire C2 in JavaScript and it bypasses all the things 🥷🧙‍♂️🪄

Video demo of bypassing Windows Defender App Control with Loki C2! Blog with details coming in 1-2 weeks. Yes -- Dylan Tran and I created an entire C2 in JavaScript and it bypasses all the things 🥷🧙‍♂️🪄

Bobby Cooke

53,189 views • 1 year ago

How is breakdancing in the Olympics and not Dragon boat racing? I feel like the West shoehorn in fake sports just to give themselves more medals, while leaving out sports of non-western origin.

How is breakdancing in the Olympics and not Dragon boat racing? I feel like the West shoehorn in fake sports just to give themselves more medals, while leaving out sports of non-western origin.

Zhao DaShuai 东北进修🇨🇳 Commentary

182,140 views • 1 year ago

It’s time to change for the better planet. Let’s change together. . C2 น้ำดื่มที่ใสสะอาดแบบซีทรู Brand Ambassador of C2 Water . Join me and learn more about C2 water at . #C2water #JacksonXC2water #น้ำดื่มพี่แจ็ค

Jackson Wang

717,424 views • 3 years ago

The recording of my full 45-min talk on my vibe coding process is up! I go through the behind-the-scenes of how I get product ideas, how I talk to coding agents, how to prevent AI slop in design, and more (YouTube link in comment)

The recording of my full 45-min talk on my vibe coding process is up! I go through the behind-the-scenes of how I get product ideas, how I talk to coding agents, how to prevent AI slop in design, and more (YouTube link in comment)

Zara Zhang

32,815 views • 1 month ago

High cost of Petrol and Energy crisis in Nigeria consequence of allowing criminals run your country ❗️ Dear Nigerians how much more suffering are we willing to endure? 2027 = MOBILIZE❗️ #EndbadGovernanceinNigeria #ElectoralReform

High cost of Petrol and Energy crisis in Nigeria consequence of allowing criminals run your country ❗️ Dear Nigerians how much more suffering are we willing to endure? 2027 = MOBILIZE❗️ #EndbadGovernanceinNigeria #ElectoralReform

Peter Akah

15,417 views • 4 months ago

New podcast episode just dropped! Solana cofounder shares the origin and evolution of Solana; what sets the chain’s culture, values, and tech apart; how it has gotten to where it is today (despite several near-death brushes); and much more in conversation with a16z General Partner Ali Yahya. Tune in:

New podcast episode just dropped! Solana cofounder shares the origin and evolution of Solana; what sets the chain’s culture, values, and tech apart; how it has gotten to where it is today (despite several near-death brushes); and much more in conversation with a16z General Partner Ali Yahya. Tune in:

a16z crypto

113,833 views • 1 year ago

I Said I Would Get In Front Of The Camera More This Year So I’m Starting A Founder Series, Which I Will Explain The Inspiration Behind Designs & How Projects/Collaborations Came To Fruition. This Is Part 1 of 4 - “Origin Of Misplaced”, What “Misplaced” Is To Me🤞🏼🤞🏼

I Said I Would Get In Front Of The Camera More This Year So I’m Starting A Founder Series, Which I Will Explain The Inspiration Behind Designs & How Projects/Collaborations Came To Fruition. This Is Part 1 of 4 - “Origin Of Misplaced”, What “Misplaced” Is To Me🤞🏼🤞🏼

John Geiger

12,708 views • 12 days ago

Mr. Arnab Goswami, You ran an entire prime-time show on the basis of an unauthenticated, fake and fabricated video and WhatsApp chats. You owe an unconditional apology to CM Bhagwant Mann & the people of Punjab. #AkaliBJPCongressExposed

Mr. Arnab Goswami, You ran an entire prime-time show on the basis of an unauthenticated, fake and fabricated video and WhatsApp chats. You owe an unconditional apology to CM Bhagwant Mann & the people of Punjab. #AkaliBJPCongressExposed

Anmol Panwar

102,268 views • 1 month ago

The most remarkable story I have covered: the origin of oak mildews is astonishing. Also fascinated by how they make mature trees more susceptible to drought and hinder woodland regeneration. More videos:

The most remarkable story I have covered: the origin of oak mildews is astonishing. Also fascinated by how they make mature trees more susceptible to drought and hinder woodland regeneration. More videos:

Bill Sutherland

10,252 views • 1 year ago

If I were an enemy of the United States and discovered a loophole in the system that allowed me to organize large groups of pregnant women to give birth on U.S. soil—then return to their country of origin so their children would hold U.S. citizenship, vote in American elections, and eventually sponsor citizenship for other family members—I would absolutely exploit it. This is what's going on. Our 14th Amendment is being exploited by foreigners who do not share our values. In his new book, The Invisible Coup: How American Elites and Foreign Powers Use Immigration as a Weapon, Peter Schweizer reports that there are an estimated 700,000 to 1.5 million "anchor babies" from China who now hold U.S. citizenship.

If I were an enemy of the United States and discovered a loophole in the system that allowed me to organize large groups of pregnant women to give birth on U.S. soil—then return to their country of origin so their children would hold U.S. citizenship, vote in American elections, and eventually sponsor citizenship for other family members—I would absolutely exploit it. This is what's going on. Our 14th Amendment is being exploited by foreigners who do not share our values. In his new book, The Invisible Coup: How American Elites and Foreign Powers Use Immigration as a Weapon, Peter Schweizer reports that there are an estimated 700,000 to 1.5 million "anchor babies" from China who now hold U.S. citizenship.

Avery Daye

26,261 views • 5 months ago