Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is...

WebSecAcademy's profile picture

Web Security Academy

141,246 subscribers

62,639 Aufrufe • vor 1 Jahr •via X (Twitter)

BildungWissenschaft & Technologie
LIVE

Anya Rossi• Live Now

Private livecam show

6 Kommentare

Profilbild von Jin
Jinvor 1 Jahr

.

Profilbild von UserInterface
UserInterfacevor 2 Jahren

What is Web3? The Next Evolution of the Internet #tech #news

Profilbild von Priesthood emmanuel 🪔
Priesthood emmanuel 🪔vor 1 Jahr

@TweetHelperBot download this please

Profilbild von 𐌌Ꝋᒍ𐌉𐌀
𐌌Ꝋᒍ𐌉𐌀vor 1 Jahr

Hmmmm , me : edit by my hands and delete HTTP/2 to HTTP/1.1 , please use your hands

Profilbild von Aman Hasan
Aman Hasanvor 1 Jahr

very usefull :)

Profilbild von Ali Essam
Ali Essamvor 1 Jahr

what is the impact?

Ähnliche Videos

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity
1:32

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,242 Aufrufe • vor 1 Jahr

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:
0:30

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:

Web Security Academy

27,902 Aufrufe • vor 11 Monaten

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:
3:23

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

James Kettle

139,874 Aufrufe • vor 9 Monaten

💾 Vibe coded an entire dial-up TCP/IP stack for my TUI OS to get to the internet so it can now too browse the web It uses the same ISP as does which is (a real dial up provider) and then the browser routes you to my HTTP-proxy (because it doesn't support HTTPS yet) so you can open modern websites with it WebSocket → HDLC framing → PPP → LCP/EAP/IPCP → IPv4 → UDP → DNS (one round trip) → IPv4 → TCP (3-way handshake) → HTTP/1.0 → HTTP reverse proxy → HTML parse → render in OS browser -> render in your browser Also we have some techno in the music player now (not good yet) VERY GEEKY 🤓
2:06

💾 Vibe coded an entire dial-up TCP/IP stack for my TUI OS to get to the internet so it can now too browse the web It uses the same ISP as does which is (a real dial up provider) and then the browser routes you to my HTTP-proxy (because it doesn't support HTTPS yet) so you can open modern websites with it WebSocket → HDLC framing → PPP → LCP/EAP/IPCP → IPv4 → UDP → DNS (one round trip) → IPv4 → TCP (3-way handshake) → HTTP/1.0 → HTTP reverse proxy → HTML parse → render in OS browser -> render in your browser Also we have some techno in the music player now (not good yet) VERY GEEKY 🤓

@levelsio

129,985 Aufrufe • vor 3 Monaten

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!
0:34

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!

Tyler Shukert

24,244 Aufrufe • vor 1 Jahr

Supabase provides a free, easy-to-use cron job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!
0:34

Supabase provides a free, easy-to-use cron job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!

Tyler Shukert

23,289 Aufrufe • vor 1 Jahr

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity
0:27

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity

Web Security Academy

18,152 Aufrufe • vor 1 Jahr

DuckDB just released Quack: a client/server protocol over HTTP. Any DuckDB can serve (quack_serve()), any DuckDB can attach to it. DuckDB-Wasm included since it's plain HTTP on port 9494. Some fun stuff : - A browser tab talking directly to a DuckDB server somewhere on the internet - Local-first apps with a remote target that speaks the exact same dialect - Notebook-to-notebook query forwarding Curious what people will build with this. We've got a few ideas brewing at MotherDuck too :) And while we're at it, can we finally retire the "DuckDB has no multi-writer support" take? There are plenty of options out there now, just depends how you want to slice and dice.
0:44

DuckDB just released Quack: a client/server protocol over HTTP. Any DuckDB can serve (quack_serve()), any DuckDB can attach to it. DuckDB-Wasm included since it's plain HTTP on port 9494. Some fun stuff : - A browser tab talking directly to a DuckDB server somewhere on the internet - Local-first apps with a remote target that speaks the exact same dialect - Notebook-to-notebook query forwarding Curious what people will build with this. We've got a few ideas brewing at MotherDuck too :) And while we're at it, can we finally retire the "DuckDB has no multi-writer support" take? There are plenty of options out there now, just depends how you want to slice and dice.

Mehdi Ouazza

65,674 Aufrufe • vor 2 Monaten

Announcing Hermes-node Hermes can now run as a standalone CLI with Node.js-compatible APIs - no C++ embedding required. Technically, hermes-node is a Node.js API compatibility layer for Hermes. It ports Node's native bindings (fs, net, http, child_process, etc.) to Node-API and reuses Node's original lib/*.js files, allowing standard Node.js programs to run on Hermes instead of V8. It vendors libuv, c-ares, llhttp, Ada, simdutf, etc to provide the same networking and I/O stack as Node, and runs as a standalone CLI binary. In this demo: - REPL with tab completion - TypeScript HTTP server using http, fs, and path - Type annotations stripped natively by the parser — no transpiler, not even a built-in one. This is still a work in progress, though surprisingly functional. More Node modules coming, source will be published soon.
2:43

Announcing Hermes-node Hermes can now run as a standalone CLI with Node.js-compatible APIs - no C++ embedding required. Technically, hermes-node is a Node.js API compatibility layer for Hermes. It ports Node's native bindings (fs, net, http, child_process, etc.) to Node-API and reuses Node's original lib/*.js files, allowing standard Node.js programs to run on Hermes instead of V8. It vendors libuv, c-ares, llhttp, Ada, simdutf, etc to provide the same networking and I/O stack as Node, and runs as a standalone CLI binary. In this demo: - REPL with tab completion - TypeScript HTTP server using http, fs, and path - Type annotations stripped natively by the parser — no transpiler, not even a built-in one. This is still a work in progress, though surprisingly functional. More Node modules coming, source will be published soon.

Tzvetan Mikov

72,397 Aufrufe • vor 4 Monaten

Got some weekend Remix listening for ya! Ryan and I discuss the architecture of a Remix app in this week's Frontend First. Remix does a great job surfacing the core strengths of HTTP with four simple APIs – Links, Forms, Actions, and Loaders – while still giving us a seamless way to enhance our apps with the full power of client-side React. Enjoy! (0:00) Intro (0:31) The Work Journal app (2:20) Making dynamic pages with Loaders (8:00) How Remix relies on HTTP for routing (12:30) Making backend changes using Forms and Actions (19:41) How Remix’s comprehension of Loaders and Actions eliminates boilerplate (25:20) How Remix layers the full power of React on top of web fundamentals Apple: YouTube: Spotify:
46:29

Got some weekend Remix listening for ya! Ryan and I discuss the architecture of a Remix app in this week's Frontend First. Remix does a great job surfacing the core strengths of HTTP with four simple APIs – Links, Forms, Actions, and Loaders – while still giving us a seamless way to enhance our apps with the full power of client-side React. Enjoy! (0:00) Intro (0:31) The Work Journal app (2:20) Making dynamic pages with Loaders (8:00) How Remix relies on HTTP for routing (12:30) Making backend changes using Forms and Actions (19:41) How Remix’s comprehension of Loaders and Actions eliminates boilerplate (25:20) How Remix layers the full power of React on top of web fundamentals Apple: YouTube: Spotify:

Sam Selikoff

53,706 Aufrufe • vor 2 Jahren

x402 made payments native to HTTP. I made USDC payments native to sound waves ✨ Not as a gimmick. As a proof. 1/ The setup: Coinbase Developer Platform🛡️'s x402 protocol embeds payments into HTTP. It's brilliant. But I started wondering, if we can pay over HTTP, what else can we use to pay? Spoiler: anything that supports 138 bytes 2/ The realization: x402 is built on EIP-3009 - a 2020 standard that lets you sign payment authorizations offline. Someone else submits it on-chain. The signature just needs to get from A to B. HTTP is one way. Sound is another. 3/ What I built: x402hz: two devices negotiate a payment through 2400Hz audio tones. - Seller beeps "pay me $0.001 USDC" (30 bytes) - Buyer's device decodes, signs the EIP-712 for the transferWithAuthorization locally, beeps back (108 bytes) - Seller settles on-chain Total: 36 seconds of beautiful noise. 4/ The bigger point: If payments can travel over sound, they can travel over: - QR codes - NFC - Bluetooth - Light pulses - Anything that carries 138 bytes The payment primitive is transport-agnostic. x402 picked HTTP. The next protocol might pick something weirder. 5/ What this proves: EIP-3009 separates three things: - Authorization (offline, cryptographic) - Transport (literally anything) - Settlement (on-chain) x402 nailed #1 and #3. x402hz proves #2 is wide open. 6/ Credit: Huge thanks to the Coinbase Developer Platform🛡️ x402 team for building the protocol. I just... took it off-road. 7/ Next steps Code is open source. Go make payments, travel over something ridiculous (repo in the comments). 138bytes. That's all you need.
1:06

x402 made payments native to HTTP. I made USDC payments native to sound waves ✨ Not as a gimmick. As a proof. 1/ The setup: Coinbase Developer Platform🛡️'s x402 protocol embeds payments into HTTP. It's brilliant. But I started wondering, if we can pay over HTTP, what else can we use to pay? Spoiler: anything that supports 138 bytes 2/ The realization: x402 is built on EIP-3009 - a 2020 standard that lets you sign payment authorizations offline. Someone else submits it on-chain. The signature just needs to get from A to B. HTTP is one way. Sound is another. 3/ What I built: x402hz: two devices negotiate a payment through 2400Hz audio tones. - Seller beeps "pay me $0.001 USDC" (30 bytes) - Buyer's device decodes, signs the EIP-712 for the transferWithAuthorization locally, beeps back (108 bytes) - Seller settles on-chain Total: 36 seconds of beautiful noise. 4/ The bigger point: If payments can travel over sound, they can travel over: - QR codes - NFC - Bluetooth - Light pulses - Anything that carries 138 bytes The payment primitive is transport-agnostic. x402 picked HTTP. The next protocol might pick something weirder. 5/ What this proves: EIP-3009 separates three things: - Authorization (offline, cryptographic) - Transport (literally anything) - Settlement (on-chain) x402 nailed #1 and #3. x402hz proves #2 is wide open. 6/ Credit: Huge thanks to the Coinbase Developer Platform🛡️ x402 team for building the protocol. I just... took it off-road. 7/ Next steps Code is open source. Go make payments, travel over something ridiculous (repo in the comments). 138bytes. That's all you need.

Vitto Rivabella

40,343 Aufrufe • vor 7 Monaten

Finally, I'm done with the basics of backend engineering on the all-in-one resources to learn backend engineering I'm working on This basic section includes - Internet - HTTP - Servers - Web Dev fundamentals - Fundamentals of Operating Systems - A server-side language -> JavaScript | Go | Rust | Node - A framework -> Express | Nestjs | Django | Laravel | Spring Boot This is the boring part. Don't worry. We are getting into the fun part soon. Still working on it, updating it, Adding more, and making it better for you. Follow me. Retweet. Comment "Backend." I will DM you the PDF version when it's out. Enjoy the web version, and send in your feedback on how we can improve it for everyone.
0:37

Finally, I'm done with the basics of backend engineering on the all-in-one resources to learn backend engineering I'm working on This basic section includes - Internet - HTTP - Servers - Web Dev fundamentals - Fundamentals of Operating Systems - A server-side language -> JavaScript | Go | Rust | Node - A framework -> Express | Nestjs | Django | Laravel | Spring Boot This is the boring part. Don't worry. We are getting into the fun part soon. Still working on it, updating it, Adding more, and making it better for you. Follow me. Retweet. Comment "Backend." I will DM you the PDF version when it's out. Enjoy the web version, and send in your feedback on how we can improve it for everyone.

Solomon Eseme

92,196 Aufrufe • vor 2 Jahren

✨ Today I rebuilt 🏔️ AltaVista Search, the main search engine before Google existed The problem: if you press the 🔍Search button in MSIE4 it'll open a sidebar with AltaVista in it that opens: http:// home . microsoft . com/search/search.asp But that URL doesn't resolve anymore of course, so how do I make this work? I asked Claude Code and built a Dnsmasq DNS server that routes all regular DNS queries to Cloudflare but for home . microsoft . com it hijacks it and sends it to my own server Then I let Nginx respond to that doamin and show the Altavista Search sidebar, I had to rebuild the design from a video on YouTube because I couldn't find any actual archeological remains of it anymore Also Altavista Search of course doesn't exist anymore so it can't respond to queries either so I use a SERP API to query search results from Google and display them instead This is stuff I wouldn't even be close to doing before AI, I'd have no idea how to configure Dnsmasq to spoof queries like this The search engine results are proxied via my HTTP proxy so MSIE4 can open most sites (because old browsers don't support HTTPS and most JS!)
1:38

✨ Today I rebuilt 🏔️ AltaVista Search, the main search engine before Google existed The problem: if you press the 🔍Search button in MSIE4 it'll open a sidebar with AltaVista in it that opens: http:// home . microsoft . com/search/search.asp But that URL doesn't resolve anymore of course, so how do I make this work? I asked Claude Code and built a Dnsmasq DNS server that routes all regular DNS queries to Cloudflare but for home . microsoft . com it hijacks it and sends it to my own server Then I let Nginx respond to that doamin and show the Altavista Search sidebar, I had to rebuild the design from a video on YouTube because I couldn't find any actual archeological remains of it anymore Also Altavista Search of course doesn't exist anymore so it can't respond to queries either so I use a SERP API to query search results from Google and display them instead This is stuff I wouldn't even be close to doing before AI, I'd have no idea how to configure Dnsmasq to spoof queries like this The search engine results are proxied via my HTTP proxy so MSIE4 can open most sites (because old browsers don't support HTTPS and most JS!)

@levelsio

84,373 Aufrufe • vor 5 Monaten

Introducing: Browser Use Skills 🛠️ [beta] Browser Agents are slow, non-deterministic, and expensive. Skills fix that. 🤯 You describe the workflow. We analyse the HTTP requests, reverse engineer the APIs, and turn them into tools calls your agents can use. ✅ 30s → 0.5s ✅ deterministic ✅ extremely cheap Want to run this at scale with Browser Use? DM me. Try it out for free 🔗↓
1:19

Introducing: Browser Use Skills 🛠️ [beta] Browser Agents are slow, non-deterministic, and expensive. Skills fix that. 🤯 You describe the workflow. We analyse the HTTP requests, reverse engineer the APIs, and turn them into tools calls your agents can use. ✅ 30s → 0.5s ✅ deterministic ✅ extremely cheap Want to run this at scale with Browser Use? DM me. Try it out for free 🔗↓

Gregor Zunic

60,510 Aufrufe • vor 7 Monaten

This 1-hour crash course is exactly how Envoy works under the hood - what the Atlassian engineer used instead of expensive enterprise load balancers Hussein Nasser covers the real internals: > Listeners → Clusters → Network Filters - Envoy's core architecture > L7 routing and L4 TCP load balancing > TLS from scratch: Let's Encrypt, HTTP/2, blocking TLS 1.0/1.1 - SSL Labs A rating > why thread-per-connection breaks round-robin by default the YAML is painful. the architecture is genius watch this before reading the post above
1:05:33

This 1-hour crash course is exactly how Envoy works under the hood - what the Atlassian engineer used instead of expensive enterprise load balancers Hussein Nasser covers the real internals: > Listeners → Clusters → Network Filters - Envoy's core architecture > L7 routing and L4 TCP load balancing > TLS from scratch: Let's Encrypt, HTTP/2, blocking TLS 1.0/1.1 - SSL Labs A rating > why thread-per-connection breaks round-robin by default the YAML is painful. the architecture is genius watch this before reading the post above

Mr. Buzzoni

51,681 Aufrufe • vor 2 Monaten

Are AI agents going to take over Ethereum? In episode 19 of the Agents Unleashed podcast, explore the Base vision for autonomous AI on Ethereum, and find out what AI can do at the fringes of physics. In this episode: - Base’s HTTP x402 (machine payments) and Olas - How the Olas ecosystem enables millions of agent-to-agent transactions, including payments via Nevermined - AI’s weird and wonderful physics discovery & what it means for ownable agents - How OpenLedger gives data contributors credit 01:28 - Base’s vision for autonomous AI 02:45 - Fact check: are AI agents “broke”? 03:32 - What the Mech Marketplace already does 05:31 - How HTTP x402 fits in with Olas 07:30 - Novel physics, discovered by AI 09:04 - Examples from earlier science 09:50 - What OpenLedger enables 10:38 - What it all means for user-owned AI This episode is sponsored by Sigil Fund.
12:09

Are AI agents going to take over Ethereum? In episode 19 of the Agents Unleashed podcast, explore the Base vision for autonomous AI on Ethereum, and find out what AI can do at the fringes of physics. In this episode: - Base’s HTTP x402 (machine payments) and Olas - How the Olas ecosystem enables millions of agent-to-agent transactions, including payments via Nevermined - AI’s weird and wonderful physics discovery & what it means for ownable agents - How OpenLedger gives data contributors credit 01:28 - Base’s vision for autonomous AI 02:45 - Fact check: are AI agents “broke”? 03:32 - What the Mech Marketplace already does 05:31 - How HTTP x402 fits in with Olas 07:30 - Novel physics, discovered by AI 09:04 - Examples from earlier science 09:50 - What OpenLedger enables 10:38 - What it all means for user-owned AI This episode is sponsored by Sigil Fund.

Olas (formerly Autonolas)

12,136 Aufrufe • vor 11 Monaten

My agent is now paying for its own data. No API key. No account. No credit card. Check the video I recorded. This uses the x402 open protocol built by Coinbase, along with a simple skill. This is an open protocol governed by the Linux Foundation. To complete a goal, an agent can now search for an actor on the Apify Store, pay for it, and use it without any human intervention. The way it works is pretty simple: 1. Your agent finds an Actor it wants to use 2. It sends a request 3. The Actor sends back an HTTP 402 "Payment Required" response 4. Agent authorizes payment from a wallet in USDC on Base 5. The Actor runs 6. User receives the result The model is pay-as-you-go: the agent authorizes a spending ceiling, pays only for usage, and the remaining balance is automatically settled. This brings an entire marketplace of AI tools into the agentic economy. Here is the skill you need. Add it to your agent, and it will take care of everything for you: If you want to know how this works, including what you can do with $1, read this post: Thanks to the Apify team for partnering with me on this post.
5:56

My agent is now paying for its own data. No API key. No account. No credit card. Check the video I recorded. This uses the x402 open protocol built by Coinbase, along with a simple skill. This is an open protocol governed by the Linux Foundation. To complete a goal, an agent can now search for an actor on the Apify Store, pay for it, and use it without any human intervention. The way it works is pretty simple: 1. Your agent finds an Actor it wants to use 2. It sends a request 3. The Actor sends back an HTTP 402 "Payment Required" response 4. Agent authorizes payment from a wallet in USDC on Base 5. The Actor runs 6. User receives the result The model is pay-as-you-go: the agent authorizes a spending ceiling, pays only for usage, and the remaining balance is automatically settled. This brings an entire marketplace of AI tools into the agentic economy. Here is the skill you need. Add it to your agent, and it will take care of everything for you: If you want to know how this works, including what you can do with $1, read this post: Thanks to the Apify team for partnering with me on this post.

Santiago

26,413 Aufrufe • vor 16 Tagen

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products
0:36

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

International Cyber Digest

951,706 Aufrufe • vor 2 Monaten