TikTok: IDOR in report download functionality on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Ads endpoint within the report download functionality. We thank @fm for reporting this to our team...

TikTok: IDOR on Tagged People

An Insecure Direct Object Reference IDOR vulnerability was found on the TikTok app where a user was able to tag any other user on videos that don't belong to them. We thank @apapedulimu for reporting this to our team. Write-Up:...

TikTok: XSS Payload on TikTok Seller Center endpoint

Stored Cross-Site Scripting XSS was found on the "Edit Product" page of a TikTok Seller Center endpoint via the "Product Name" field. We thank @aidilarf2000 for reporting this to our team...

TikTok: DOM XSS on ads.tiktok.com

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "settings" parameter, caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. We thank @0x7 for reporting this to our team...

TikTok reset account password Exploit

Exploit can reset password and get full control any TikTok account. You can change target mobile phone without any problems, because exploit use bypass 2fa vulnerability...

TikTok: CSRF protection bypass on TikTok Webcast Endpoints

Vulnerability description not provided...

TikTok: Stored XSS on TikTok Live Form

A Cross-Site Scripting XSS vulnerability was found on a restricted endpoint by an authenticated user inputting a payload in the "Description" form when creating a LIVE event on the TikTok mobile app. We thank @aidilarf2000 for reporting this to our team...

TikTok: Stored XSS Payload when sending videos

A Cross-Site Scripting XSS payload was found via the text used when sending videos to a friend, which could have resulted in session hijacking, user impersonation, or client-side attacks. We thank aidilarf2000 for reporting this to our team. Don't forget Vacation and Have Fun.. Write up :...

TikTok: CSRF in Changing User Verification Email

A Cross-Site Request Forgery CSRF was found on a TikTok Ads endpoint, which could have resulted in a malicious user adding a new user verification email address. We thank @fm for reporting this to our team...

TikTok: IDOR on TikTok Ads Endpoint

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...

Socid-Extractor - Extract Accounts Info From Personal Pages On Various Sites For OSINT Purpose

Extract information about a user from profile webpages / API responses and save it in machine-readable format. Usage As a command-line tool: $ socidextractor --url https://www.deviantart.com/muse1908 country: France createdat: 2005-06-16 18:17:41 gender: female username: Muse1908 website:...

Vortex - VPN Overall Reconnaissance, Testing, Enumeration And eXploitation Toolkit

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit Overview A very simple Python framework, inspired by SprayingToolkit, that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints like Cisco, Citrix, Fortinet, Pulse,...

TikTok: XSS and iframe injection on tiktok ads portal using redirect params

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "redirect" parameter. We thank @cancerz for reporting this to our team...

TikTok: IDOR on TikTok Seller

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Seller endpoint via the "promotionid" parameter, which could have resulted in a promotion being remover from a user's account. We thank @aidilarf2000 for reporting this to our team...

TikTok: Privilege Escalation on TikTok for Business

An IDOR Insecure Direct Object Reference vulnerability was found on the "orgid" and "accountid" parameters on a Business.TikTok.com endpoint, which could have resulted in an authenticated user with "Analyst" level permissions to close another user's ads accounts. We thank @naaash for reporting th...

TikTok: Impersonation of tiktok account via Broken Link in TikTok Newsroom

A broken link was found on TikTok Newsroom, which could have allowed an attacker to claim the associated username and hijack the link. We thank @bushidobrown200 for reporting this to our team and confirming its resolution...

TikTok: Stored XSS on TikTok Ads

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via a SVG file containing an xss payload. We thank @sinayeganeh for reporting this to our team...

TikTok: One Click Account Hijacking via Unvalidated Deeplink

A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team...

TikTok: View thumbnail of any private video (friends or followers only) of Private/Public account

Vulnerability description not provided...

WordPress Add Tiktok Pixel for Tiktok ads (+Woocommerce) plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin versions = 1.2.1. Solution Update the WordPress Add Tiktok Pixel for Tiktok ads +Woocommerce plugin to the latest available version at least 1.2.2...