Loading video...

Video Failed to Load

Go Home

RCE Bug On T-Mobile's Custom Header Vulnerable Header: X-Export-Format: pdf ; Payload Tip: Always test your payloads on custom headers, as the header may be vulnerable, as in this case #BugBounty #bugbountytips #redteam #cybersecurity #Developers #pentest

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

CSS Tip! 🐳 You can add little details like this scale down on scroll effect with scroll-driven animations and some sticky positioning 🤙 section { animation: scale-down; animation-timeline: view(); animation-range: exit; } @​keyframes scale-down { to { scale 0.8; } ] In this smaller example, you can lean into using the position to drive an animation that scales itself down as it leaves the viewport (Seen on the Apple Vision Pro site 🍏) The nice thing here is that if you don't have scroll-driven animations, the user still gets a good experience ✨ So how do you do it? There isn't much to it header { transform-origin: 50% 0%; animation: scale-down both ease-in; animation-timeline: view(); animation-range: exit; view-timeline: --header; } @​keyframes scale-down { to { scale: 0.8 0.8; } } That's it. The layout makes use of position: sticky so that the element stays in the shot whilst you scroll the page. As it leaves the page, it scales down inside the 🫶 The other smol animation here is fading the overlay on the video out 😎 Real easy. You may notice the view-timeline you defined above for the 👀 header { view-timeline: --header; } You have a pseudoelement on the text content of the header that lives inside a header > section::before { background: hsl(0 0% 0% / 0.75); opacity: 1; animation: fade both linear; animation-timeline: --header; animation-range: exit-crossing 0% exit 0%; } @​keyframes fade { to { opacity: 0; } } You use a slightly smaller range on this with exit-crossing to fade it out before you start the scale down animation 🤏 That's it! Thought this smaller example would be easier to grok for people 🙏 It's also covered with JavaScript if you really want it for your sites 🤙 CodePen.IO link below 👇

jhey ʕ•ᴥ•ʔ

146,270 views • 2 years ago

🚨 POC for CVE-2025-55182 that works on Next.js 16.0.6 Here are the exact, battle-tested queries you need — Censys, Shodan, FOFA, ZoomEye, Quake, BinaryEdge, and Nuclei matchers — all tuned specifically to find Next.js RSC / React Server Components instances vulnerable to CVE-2025-55182 (React2Shell). ⸻ ✅ 1. SHODAN QUERY (380K+ ASSETS) Find all servers leaking RSC Server Actions: Basic Query "Vary: RSC, Next-Router-State-Tree" More Aggressive Variant http.headers.vary:"RSC" AND http.headers.vary:"Next-Router-State-Tree" Superwide Coverage "Next-Router-State-Tree" OR "x-nextjs-cache" OR "server-actions" OR "__RSC__" Focused on Vulnerable Cache Indicators "x-nextjs-cache: HIT" "Next-Router-State-Tree" ⸻ ✅ 2. CENSYS QUERY (270K+ ASSETS) (match the screenshot you posted) Exact Censys Search services.http.response.headers.vary: "RSC, Next-Router-State-Tree" Safer Multi-Matcher services.http.response.headers.vary: "RSC" AND services.http.response.headers.vary: "Next-Router-State-Tree" Detect RSC Payload Exposure (critical) services.http.response.body: "__RSC__" Detect Flight Data Leaks services.http.response.body: "server-reference-manifest" ⸻ ✅ 3. FOFA QUERY (CHINA’S OSINT GIANT) (VERY POWERFUL for RSC/Next.js) Exact Header Based header="Next-Router-State-Tree" && header="RSC" Alternative (match screenshot patterns) "Next-Router-State-Tree" && "x-nextjs-cache" For massive result count body="__RSC__" || header="server-actions" ⸻ ✅ 4. ZOOMEYE QUERY ZoomEye scans often catch Node.js apps Shodan misses. Exact Unicode-Ready Query "Next-Router-State-Tree" && "RSC" Advanced app:"Next.js" && header:"RSC" ⸻ ✅ 5. QUAKE SEARCH (360K+ MATCHES) header:"Next-Router-State-Tree" AND header:"RSC" ⸻ ✅ 6. BINARYEDGE QUERY http.response.headers.vary:"Next-Router-State-Tree" ⸻ ✅ 7. QUERY headers:"Next-Router-State-Tree" && headers:"RSC" ⸻ 🎯 8. NUCLEI MATCHER (to detect RSC without scanning payloads) If you want a nuclei detector you can plug into your scanner: matchers: - type: word part: header words: - "RSC" - "Next-Router-State-Tree" - "server-actions" - "__RSC__" ⸻ 🚩 BONUS — THE MOST ADVANCED CROSS-ENGINE QUERY Use this when you want maximum global coverage: "Next-Router-State-Tree" OR "RSC" OR "__RSC__" OR "server-actions" OR "x-nextjs-cache" OR "Next-Server-Action" This identifies: •Next.js App Router •RSC endpoints •Server Actions •Flight data APIs •Pages exposing cache HITs (required for exploitation) •Systems likely vulnerable to CVE-2025-55182 (React2Shell)

X

10,469 views • 7 months ago

How do you create your payloads in 2025? At MSec Operations we prefer to use DLL sideloading for EDR evasion. This technique allows our malicious code to run within a signed, legitimate executable. Combining this technique with other useful techniques will provide stable execution to fly under the radar. 🛸 The following video demonstrates the use of #RustPack to create such a payload in just a few seconds. The command line usage shows that our input payload is a simple unmodified Apollo C2 executable. We want to clone all the exported functions from the original Windows wininet.dll to create our own library with the same name. The execution of the payload will be delayed by ~5 seconds in this case, without using the Win32 sleep function, but by performing random calculations. ⏲️ Hardware breakpoints are used to bypass the Antimalware Scan Interface (AMSI). Without an AMSI bypass, Apollo would be flagged as a C# assembly when loaded. 🎓 Our payload will only fire on a domain joined system, this basically prevents it from running in e.g. sandbox environments. 🤠 Last but not least, in this example, the encrypted payload itself is stored in a separate file on the target system and not even in the same folder as our malicious DLL. Anyone analysing just the DLL will never be able to find out what the payload is. Automatic sample submissions for cloud analysis usually only upload the executable or DLL, emulators won't see the real payload either. 🤠 Tired of creating such payloads yourself? With #RustPack it's really easy, and payloads always look completely different, even if the same payload is packed twice to avoid signature-based detection Contact us via info[at] for more information! 👍

MSec Operations

26,003 views • 1 year ago

A closer look on the GSAP powered animations in Webflow. Just from my perspective. In short, it’s way more powerful than I first thought. The more I use it, the more I like it. Of course, there are some parts missing. But it's the first version. There's still a lot to come. For example, custom ease would already make a huge difference. Breakpoints. Maybe a way to add custom functions as sometimes you need to calculate stuff in JavaScript to get complex animations. The biggest part for me is that you can just build the animation inside a timeline. This makes it so much easier than writing it as code. You can fine tune it so much more. When there would be a way to export the tween as code to add some more functionality would be awesome. You can also add custom classes with the timeline, which can then be used in custom CSS to add more functionality. With a bit of custom code you can also use breakpoints for your animations. By using the custom event the animation can be used in custom code which can also be pretty powerful. Didn’t test it so much yet, but would be cool if you could just take the event and use for example the onComplete() from GSAP or other stuff. For example. let mm = gsap.matchMedia(); const module = Webflow.require("ix3"); module.ready().then(() => { mm.add( { isMobile: "(max-width: 992px)", }, (context) => { let { isMobile } = context.conditions; if (isMobile) { module.emit("Mobile Animation"); } } ); }); "Mobile Animation" is the name of your custom event. I hope that part will get more powerful. Something I miss on the timeline is that when you select more actions you can just drag all actions. It would be cool if you could move it frame by frame with the arrow keys, like in Jitter for example. Or just write a specific point like when you have one selected. For now I would further write the code myself, but I’m excited to see where it’s going. Maybe there will be a time where you could animate most parts inside Webflow 🙂 Can’t wait for the next GSAP update!

Eduard Bodak

12,590 views • 11 months ago

TradingView to Screener & Marketsmith Extension ⚠️Please before asking in comment or DM, how to install, please read the full post, i have given the instructions also, and if you still cant follow it, You will find plenty of video on youtube on how to install the plugin, or ask AI⚠️ 🙏This was a killer timesaver tool for me, Hope it helps all, please share your feedbacks or gratitude in comments, will be sharing more plugin like this in future as well ☑️Overview This Chrome Extension natively integrates with TradingView, adding quick-access buttons to your top chart header. These buttons allow you to instantly view fundamental financial data for the currently active stock symbol on or evaluate it on MarketSmith India. > Features : > Screener New Tab: Opens the consolidated financials page for the current active TradingView symbol in a new browser tab. > Screener Splitscreen: Toggles a bottom-half split screen (iframe) inside the TradingView tab to load the page directly over your charts, letting you perform fundamental and technical analysis synchronously. > Marketsmith New Tab: Opens the stock evaluation page on MarketSmith India for the active symbol in a new tab. > This extension utilizes the Manifest V3 standard APIs and works smoothly across all modern Chromium-based browsers, including: Google Chrome Microsoft Edge Brave Browser Vivaldi Opera Arc Browser ⭐ Installation Instructions (Local/Unpacked) -> 1)Download or keep this entire extension folder on your computer. 1) Download or keep this entire extension folder on your computer: For Google Chrome: type chrome://extensions/ in the address bar. For Microsoft Edge: type edge://extensions/ in the address bar. For Brave: type brave://extensions/ in the address bar. Enable Developer mode using the toggle switch (usually located in the top-right corner). 3) Click the Load unpacked button that appears. 4) In the file explorer popup, choose this exact directory (the folder containing the manifest.json file). 5) The extension is now successfully installed! Open up TradingView to play around with the newly injected buttons in the top header. Github Repo ->

Roshan Kumar

14,810 views • 4 months ago