Loading video...

Video Failed to Load

Go Home

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context....

hetmehtaa's profile picture

Het Mehta

42,203 subscribers

15,047 views • 3 months ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss
0:21

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,242 views • 3 years ago

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)
0:31

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)

NullSecurityX

95,499 views • 6 months ago

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
4:07

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,881 views • 1 year ago

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]
0:31

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

Ron Masas

77,061 views • 2 years ago

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!
1:09

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!

Michael Bargury

46,679 views • 2 months ago

This is an excellent feature of Grok4. The code you provide to Grok gets nicely formatted in a Markdown block. The play button lets you run your code in the browser. You can also easily copy or edit your code.
0:29

This is an excellent feature of Grok4. The code you provide to Grok gets nicely formatted in a Markdown block. The play button lets you run your code in the browser. You can also easily copy or edit your code.

tetsuo

1,054,901 views • 1 year ago

If you use Supabase, here’s a quick win: You don’t need to pay $10/mo for a custom domain just to remove the ugly link in your Google login consent screen. Go to Google Cloud → OAuth consent screen → edit your domain. Done
0:54

If you use Supabase, here’s a quick win: You don’t need to pay $10/mo for a custom domain just to remove the ugly link in your Google login consent screen. Go to Google Cloud → OAuth consent screen → edit your domain. Done

Fede

84,707 views • 1 year ago

MCP is a pain in the ass. To fix that, we’re launching DAuth: the first secure, multi-tenant MCP auth solution. OAuth isn’t enough. It doesn't support dynamically passing API keys, and you can’t trust passing credentials to non-OAuth servers, since secrets are exposed. This forces existing MCP marketplaces to be OAuth-centric and single-tenant. But OAuth is annoying to implement and assumes security expertise. DAuth works for every auth case. We encrypt your credentials on the client-side, guaranteeing MCP servers never see them. You can finally ship agents with peace of mind. For the first time, MCP is ready for takeoff 🛫
1:54

MCP is a pain in the ass. To fix that, we’re launching DAuth: the first secure, multi-tenant MCP auth solution. OAuth isn’t enough. It doesn't support dynamically passing API keys, and you can’t trust passing credentials to non-OAuth servers, since secrets are exposed. This forces existing MCP marketplaces to be OAuth-centric and single-tenant. But OAuth is annoying to implement and assumes security expertise. DAuth works for every auth case. We encrypt your credentials on the client-side, guaranteeing MCP servers never see them. You can finally ship agents with peace of mind. For the first time, MCP is ready for takeoff 🛫

Dedalus Labs

1,038,305 views • 9 months ago

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in @edison_watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you
2:52

Clawdbot just injected malware into your code ☠️☠️ Worst part? The attack is close to invisible, even to experienced engineers. Clawdbot can implement a code PR, just like claude code to solve issues with your app. But this is where it can plant malware in your codebase. With just a benign GitHub issue with an invisible payload, we managed to install a backdoor malware on your codebase Here's how we did it: 1. The attacker submits a GitHub issue with a jailbreak prompt hidden inside a URL hyperlink. Completely invisible to humans, visible to LLMs 2. Waited for the maintainer to assign this task to Clawdbot 3. Clawdbot reads the jailbreak in the GitHub issue. Now the Clawdbot agent is hijacked by the attacker and will act on the attacker's command. It plants the backdoor in a lock file, which most engineers don't check in code reviews. 4. The malicious URL in the lock file enables execution of attacker commands The takeaway? AI isn't just a tool, but rather a potentially corruptible insider agent that can be tricked to act against you. These LLM hijack problems are what we're looking to solve in @edison_watch - we'll be announcing a new solution to these solutions soon! We'll be jailbreaking Clawdbot much more in the coming days - please comment👇 a workflow you use with Clawdbot, so we can show how that can enable an attacker to harm you

Eito Miyamura | 🇯🇵

236,688 views • 9 months ago

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.
0:48

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.

ProjectDiscovery

14,951 views • 3 months ago

🇨🇭🔴A woman was brutally beaten in a Zurich tram by a bearded man on Sunday. The victim was left heavily bleeding Two bystanders subdued the attacker, but Swiss police were unable to send a unit. Therefore, the attacker was eventually let go and remains on the run.
1:27

🇨🇭🔴A woman was brutally beaten in a Zurich tram by a bearded man on Sunday. The victim was left heavily bleeding Two bystanders subdued the attacker, but Swiss police were unable to send a unit. Therefore, the attacker was eventually let go and remains on the run.

Remix News & Views

48,862 views • 1 year ago

AI agents should add to the systems your client already uses. One client spent several years and $10 million on one ERP migration. Offer that client a move to an AI-native CRM, and "you've lost them." So we build our agents inside the systems of record. They read the data in Salesforce and do the work in Salesforce. When a human must be in the loop, the agent sends a message in Slack. The staff need no new training, so they use the agents faster. SMB clients with no CRM are the exception. You can put them on one. If you want to work as a forward deployed engineer, build on what your client already uses.
2:29

AI agents should add to the systems your client already uses. One client spent several years and $10 million on one ERP migration. Offer that client a move to an AI-native CRM, and "you've lost them." So we build our agents inside the systems of record. They read the data in Salesforce and do the work in Salesforce. When a human must be in the loop, the agent sends a message in Slack. The staff need no new training, so they use the agents faster. SMB clients with no CRM are the exception. You can put them on one. If you want to work as a forward deployed engineer, build on what your client already uses.

The Startup Ideas Podcast (SIP) 🧃

15,996 views • 27 days ago

Claude Code UI is now available in VSCode via CodeGPT extension! 🙌 You can now run Claude Code directly in your editor and control the planning process. You can pause it, edit tasks, or add new ones while Claude is working. This helps keep Claude on track and makes it way more effective since you can adjust things as it goes. Setup: - Download the extensión - Click the Claude Code OAuth - Authorize the extension - Paste your account code to link Claude Code directly - Done ✅ Works on VSCode and JetBrains editors (Android Studio, IntelliJ, PyCharm, etc.) VSCode : Jetbrains:
0:48

Claude Code UI is now available in VSCode via CodeGPT extension! 🙌 You can now run Claude Code directly in your editor and control the planning process. You can pause it, edit tasks, or add new ones while Claude is working. This helps keep Claude on track and makes it way more effective since you can adjust things as it goes. Setup: - Download the extensión - Click the Claude Code OAuth - Authorize the extension - Paste your account code to link Claude Code directly - Done ✅ Works on VSCode and JetBrains editors (Android Studio, IntelliJ, PyCharm, etc.) VSCode : Jetbrains:

Daniel San

106,481 views • 1 year ago

MIT PhD student Alex Zhang reveals the scaling result where a model trained on short tasks generalizes to problems 100x longer for free: "If you're very clever about the design of your harness or how you use the language model, you can almost get scaling gains for free." "If you train a model naively, there's no tricks. It's just the same way you train a model on these RL environments. You just roll it out, and then you just get some reward." "If you train it on only short tasks, like only tasks that are 10,000 tokens long, and then you were to run it on a similar domain, but at a million tokens, or 10 million tokens, or 100,000 tokens, it generalizes really, really well. If you look at it compared to even the base transformer, you get way better generalization properties." "When the model uses an RLM (Recursive Language Model) after it's trained on these short tasks, it will see some kind of trajectory of actions that it does. Between these two problems of different lengths, the RLM learns to see them as almost the same problem." "Token for token, they're almost the same. You can describe it in code. In one code setting, maybe the for loop is a little bigger, but it's the same kind of code and it derives the constants from the data. There's no hard coding, so they literally look the same." alex zhang
2:41

MIT PhD student Alex Zhang reveals the scaling result where a model trained on short tasks generalizes to problems 100x longer for free: "If you're very clever about the design of your harness or how you use the language model, you can almost get scaling gains for free." "If you train a model naively, there's no tricks. It's just the same way you train a model on these RL environments. You just roll it out, and then you just get some reward." "If you train it on only short tasks, like only tasks that are 10,000 tokens long, and then you were to run it on a similar domain, but at a million tokens, or 10 million tokens, or 100,000 tokens, it generalizes really, really well. If you look at it compared to even the base transformer, you get way better generalization properties." "When the model uses an RLM (Recursive Language Model) after it's trained on these short tasks, it will see some kind of trajectory of actions that it does. Between these two problems of different lengths, the RLM learns to see them as almost the same problem." "Token for token, they're almost the same. You can describe it in code. In one code setting, maybe the for loop is a little bigger, but it's the same kind of code and it derives the constants from the data. There's no hard coding, so they literally look the same." alex zhang

MTS

100,519 views • 3 months ago

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇
0:25

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

André Baptista

48,375 views • 1 year ago

What a nightmare for the victim and her family. Not only did Tony Evers’s DOC fail to notify the police, they failed to notify the victim and her family that her attacker was on the loose. Can the Evers Administration not handle the most basic tasks related to our safety?
1:07

What a nightmare for the victim and her family. Not only did Tony Evers’s DOC fail to notify the police, they failed to notify the victim and her family that her attacker was on the loose. Can the Evers Administration not handle the most basic tasks related to our safety?

Josh Schoemann

13,809 views • 11 months ago

Available now in Visual Studio Code Insiders, you can select and add elements directly to Chat! After opening any locally-hosted site via the built-in Simple Browser, click "Start" on the toolbar and select the element you want. This will attach a screenshot of the selected element, as well as the HTML and CSS of that element.
0:26

Available now in Visual Studio Code Insiders, you can select and add elements directly to Chat! After opening any locally-hosted site via the built-in Simple Browser, click "Start" on the toolbar and select the element you want. This will attach a screenshot of the selected element, as well as the HTML and CSS of that element.

Visual Studio Code

75,563 views • 1 year ago

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:
4:42

Nobody is writing 90% of their code using AI. Here's the uncomfortable truth: The real productivity gain from using AI to write code is closer to 10%, nowhere near the 90% people claim. Sundar Pichai said in 2024 that 30% of the new code at Google was AI-generated. However, he went on to admit, during Lex Friedman's podcast, that engineering velocity had only increased by about 10%. AI-generated code isn't free code. It still has to be reviewed, tested, and made production-ready. Optimizing a single step (code generation) doesn't boost output if bottlenecks shift elsewhere (code reviews). It doesn't matter how much code you generate if you can't keep up the review process. The solution: Automate as much as you can the review and verification of your code. I'm working with Sonar, who is sponsoring this post, and they will take care of the code quality and security analysis of your code: • They review over 300B lines of code every single day • They cover reliability, security, and maintainability for your code • You can integrate them into your CI/CD pipeline • You can install them in your IDE (I use their VSCode extension) • Support for more than 30 languages Here is a link so you can check them out:

Santiago

296,928 views • 1 year ago

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central
3:21

Jez Corden explains disc-to-digital (Project Positron) conversion platform You literally put the disc into the console, and it gives you a digital license for the game permanently for your Microsoft account. If you give the disc away or sell it; if it gets connected to another Microsoft account, you lose access to that digital license. You don't need the disc to keep verifying it. It's whoever last used the disc who gets the license. In 2013 (Xbox One launch) there was a rumor that retailers were going to unlock the disc, but that wasn't actually true, but it was badly communicated, and Xbox leaders misunderstood how the feature was going to work. It became a huge cluster that they had to scrap. You get the full game, you get the Xbox Cloud version, you get the Xbox Play Anywhere version, and you get the license as if you purchased it digitally. Superchat: Alright, so insert the disc, get the digital license, snap the disc in half, got it. 😂 via: Jez Windows Central

Idle Sloth

57,586 views • 4 months ago

Hermes can now log itself into websites without ever seeing your password. That’s a pretty big upgrade for browser automation. Real Profile already let Hermes use websites you were already signed into. This handles the other case: You’re not logged in yet. Hermes can now securely pull the login from: • Hermes’ encrypted local vault • 1Password • Bitwarden Then fill the credentials and sign in without exposing the raw password to the model or conversation. And it doesn’t stop when 2FA shows up. If your saved login has an authenticator key, Hermes can generate and enter the code automatically. If the site sends you a verification code by text, email, or app, Hermes gives you a secure prompt to enter it there instead of putting it in chat. The code never enters the conversation or model context. Passkeys, hardware keys, and approval taps still stay with you. Hermes waits for you to complete that step, then continues. So browser automation can now go from: “Please sign in” to actually getting through the login and continuing the workflow. Without handing your password or 2FA code directly to the model.
0:23

Hermes can now log itself into websites without ever seeing your password. That’s a pretty big upgrade for browser automation. Real Profile already let Hermes use websites you were already signed into. This handles the other case: You’re not logged in yet. Hermes can now securely pull the login from: • Hermes’ encrypted local vault • 1Password • Bitwarden Then fill the credentials and sign in without exposing the raw password to the model or conversation. And it doesn’t stop when 2FA shows up. If your saved login has an authenticator key, Hermes can generate and enter the code automatically. If the site sends you a verification code by text, email, or app, Hermes gives you a secure prompt to enter it there instead of putting it in chat. The code never enters the conversation or model context. Passkeys, hardware keys, and approval taps still stay with you. Hermes waits for you to complete that step, then continues. So browser automation can now go from: “Please sign in” to actually getting through the login and continuing the workflow. Without handing your password or 2FA code directly to the model.

Hermes Release Watch

45,758 views • 1 month ago