Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check...

TodayCyberNews's profile picture

Today Cyber News

15,279 subscribers

34,242 Aufrufe • vor 3 Jahren •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

3 Kommentare

Profilbild von PhantomOwl
PhantomOwlvor 3 Jahren

@readwise save

Profilbild von Dhawal Suthar
Dhawal Sutharvor 3 Jahren

@SaveToNotion #Threads

Profilbild von Oluwakomiyo
Oluwakomiyovor 2 Jahren

i downloaded the program but i dont know how to install do i need to install npm first?

Ähnliche Videos

BeeXSS is an automated tool to detect Blind XSS vulnerabilities in web applications. It injects payload, bypasses WAFs, and identifies backend execution flaws. Check it out here: #CyberSecurity #BlindXSS #Pentesting #BugBounty #hackingtools #redteam
1:27

BeeXSS is an automated tool to detect Blind XSS vulnerabilities in web applications. It injects payload, bypasses WAFs, and identifies backend execution flaws. Check it out here: #CyberSecurity #BlindXSS #Pentesting #BugBounty #hackingtools #redteam

AnonKryptiQuz

13,226 Aufrufe • vor 1 Jahr

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.
0:48

Finding a potential XSS is only the first step. Neo automatically : -> opens a real browser -> executes the payload -> confirms JavaScript execution -> captures the alert screenshot as evidence -> Introducing Neo Browser Computer Use -- an autonomous PoC collector. Finding XSS is only half the job. Verifying it is the painful part.

ProjectDiscovery

14,951 Aufrufe • vor 3 Monaten

Exploiting a DOM-XSS vulnerability in a BBP with DorkixAI
1:15

Exploiting a DOM-XSS vulnerability in a BBP with DorkixAI

Gospel

15,425 Aufrufe • vor 6 Monaten

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]
0:31

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

Ron Masas

77,061 Aufrufe • vor 2 Jahren

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇
0:25

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

André Baptista

48,391 Aufrufe • vor 1 Jahr

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:
0:22

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:

Dark Web Informer

24,247 Aufrufe • vor 9 Monaten

Hacker Summer Camp Day 0: Today Arcanum Information Security is releasing WRAITH, our new browser hooking and blind XSS framework. Enjoy!
1:22

Hacker Summer Camp Day 0: Today Arcanum Information Security is releasing WRAITH, our new browser hooking and blind XSS framework. Enjoy!

JS0N Haddix

20,519 Aufrufe • vor 3 Monaten

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:
1:21

two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:

Het Mehta

15,047 Aufrufe • vor 4 Monaten

Discovered a new xss payload that bypasses cloudflare web application firewall!! Payload: <button%20popovertarget=x>Click%20me</button><img%20onbeforetoggle=alert(1)%20popover%20id=x>XSS #cybersecurity #ethicalhacking #bugbounty #bugbountytips #penetrationtesting
0:23

Discovered a new xss payload that bypasses cloudflare web application firewall!! Payload: <button%20popovertarget=x>Click%20me</button><img%20onbeforetoggle=alert(1)%20popover%20id=x>XSS #cybersecurity #ethicalhacking #bugbounty #bugbountytips #penetrationtesting

Faiyaz Ahmad

37,725 Aufrufe • vor 2 Jahren

🌟Find Broken Authentication in 30 seconds or less using Autorize🌟 ©️ Andrei Agape 📥 #bugbountytip #bugbountytips #ethicalhacking #CyberSecurity #Pentesting #sqli #xss #CyberSecurityAwareness #bugbounty #GitHub #oswe #offsec
0:24

🌟Find Broken Authentication in 30 seconds or less using Autorize🌟 ©️ Andrei Agape 📥 #bugbountytip #bugbountytips #ethicalhacking #CyberSecurity #Pentesting #sqli #xss #CyberSecurityAwareness #bugbounty #GitHub #oswe #offsec

Brut 🇮🇳

16,493 Aufrufe • vor 2 Jahren

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
4:07

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,881 Aufrufe • vor 1 Jahr

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)
0:31

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)

NullSecurityX

95,499 Aufrufe • vor 7 Monaten

XSS Scanner It will be hosted on a VPS and shared with the public once I finish working on it. The next step is to add parameter bruteforcing.
0:32

XSS Scanner It will be hosted on a VPS and shared with the public once I finish working on it. The next step is to add parameter bruteforcing.

Ibrahim Auwal

10,783 Aufrufe • vor 1 Jahr

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE
0:33

🚨PoC for CVE-2024-46538 PfSense Stored XSS lead to RCE

Dark Web Informer

64,458 Aufrufe • vor 2 Jahren

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:
0:51

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

60,420 Aufrufe • vor 4 Monaten

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!
1:09

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!

Michael Bargury

46,679 Aufrufe • vor 3 Monaten

Injectra is a Python tool for injecting custom payloads into files using their magic numbers. It supports file types like zip, jpg, docx, and more. Check it out: #CyberSecurity #Pentesting #PayloadInjection #hackingtools #RedTeam #infosec #bugbounty
1:21

Injectra is a Python tool for injecting custom payloads into files using their magic numbers. It supports file types like zip, jpg, docx, and more. Check it out: #CyberSecurity #Pentesting #PayloadInjection #hackingtools #RedTeam #infosec #bugbounty

AnonKryptiQuz

24,079 Aufrufe • vor 1 Jahr