POC for CVE-2024-34102 Magento / Adobe Commerce | Bug bounty poc

[@cobaltstrik3]

Please explain shodan ip grabbing method ❤❤

[@lostsecc]

telegram channel: t.me/lostsec

[@tpevers1048]

Bro where to find free bounty's like they don't pay you you are just training

[@tpevers1048]

Free bug bounty programs?

[@3bbodal-obaidi602]

can you make a video how to CVE-2024-3136?

[@lostsecc]

ok

[@kenjikakashi]

I always wondered how you have that customized terminal in Win11. Is that WSL?

[@lostsecc]

yes its wsl2 kali

[@kenjikakashi]

@@lostsecc Also, after analyzing your shodan script. I think your reason may be because you have your api key with it. P.S. Feel free to remove this comment if I said too much, but if I am correct, I would appreciate an affirmation. Thanks again for another awesome vid, been a subscriber and follower since your early videos.

[@Pallavii29]

❤❤❤❤❤ unstoppable man 😊😘

[@lostsecc]

thnq 🤗😇

[@histoire-de-blackhat3346]

Very very strong bro

[@deathsilva1890]

Could you share the payload you used to download the shodan result on the console?

[@lostsecc]

soon share in telegram

[@teknas2157]

I am new in cyber security, plzz help in learning,resources , path

[@lostsecc]

i shared the path in telegram channel must check out

[@LEOSTRIBE]

pls provide the console command to download the results (pls I beg you)

[@lostsecc]

shodan will patch immidately if i publish

hey man, could you upload some of your templates for nuclei? greetings from brazil.

[@lostsecc]

sure uploading soon..

@@lostsecc thank you bro!

[@saptamdutta]

How do i start my career in bug bounty like You and what type of terminal is that(skulls).

[@lostsecc]

wsl2 kali window terminal

[@saptamdutta]

@@lostsecc how did u get the skulls in the terminal

[@wazawanaIT]

My best channel this year, thanks for the content

[@lostsecc]

my pleasure brother 😇☺️❤️

[@sarans119]

Can u share ip extract from shodan I won't leak it bro pls

[@lostsecc]

soon

[@viresh222]

Bro how can i get combose list free for lecher openbullet

[@lostsecc]

i did'nt tried it

[@ayushmanngupta7027]

bro can you share that template bro?

[@lostsecc]

i shared in telegram

[@anuzravat]

how will u find which of the domain will bounty and which will not?

[@lostsecc]

use ip to org name convertor tool that i shared in telegram

[@menakapathirana5681]

what is the software used as terminal

[@lostsecc]

wsl kali

[@usasecuritygoni]

❤❤❤❤❤

[@tpevers1048]

Why you disappeared

[@lostsecc]

just busy in some other things i will active soon..

[@58statment]

3:26 brother, can u pls provide this code that u used here...

[@lostsecc]

shodan will patch it immidately if its leak

[@58statment]

@@lostsecc Okay no problem.

[@cameronribeiro9660]

Example of little key thing: I don’t like to run w11 bare metal because it has black/blue screened on me too many times in the past. So: I like to run everything from a VM so that I can make an updated clone each week. I noticed there is a lot of WSL happening now. If you running w11 as a VM, you’re not gonna get WSL Kali running/working on w11 in any VM software that I know of. If you run w10 in parallels on Mac i9 you can get wsl Kali running if you try 2 or 3 times. Other than that: specifically wsl2 Kali in a w11 VM? Nope.

[@harshads6327]

Hi bro can I get the masterpiece 3:26

[@lostsecc]

upcomming video ❤️

[@harshads6327]

@@lostsecc Bro finally i got it How u did that. U gave a hint in the video. Wrks well for me thank u so much.

[@ZahraNayab-j3f]

sir Allow pasting k bd kya likhna

[@lostsecc]

its hidden bcz of policy

[@ShaistaFarukh]

Sir please Mera nuclei ka issue clear kr den .. how can I contact you

[@lostsecc]

in telegram channel t.me/lostsec

[@madhavanrio3210]

Awesome ❤❤😊😊😊 and one more it vulnerable also for RCE ?

[@hexormc5164]

U know how to do it?

[@lostsecc]

❤️🤗

[@madhavanrio3210]

@@hexormc5164 not in master level just intermediate, I doesn't even find a single eligible bug in hackerone but in other private program find many bugs but not bounty , I am only one who have 99.9% of unlucky🥲

[@hexormc5164]

@@lostsecc u know how to perform RCE with exploit?

[@madhavanrio3210]

@@hexormc5164 i dont know bro, but i think it is posssible when do this refer some youtube channel they do it

[@moamenyasser6397]

is running kali or any linux distro on wsl better than a VM ? I see you use it alot

[@lostsecc]

i use wsl kali

[@moamenyasser6397]

@@lostsecc if you can make a video for your configuration on WSL would be awesome

[@lostsecc]

i need to delete all this for that ok o will try on old laptop after delete

[@moamenyasser6397]

@@lostsecc maybe do a writeup instead of video that would be efficient too

[@HackShiv]

Dm me that shodan method you have bro if possible. I won't leak it, and good vid 👍

[@lostsecc]

ok

[@Saganax]

what did you use for the linux terminal in windows

[@lostsecc]

kali wsl

[@Saganax]

@@lostsecc thanks dawg

[@konigrasse9476]

Can you do a manual discovery and vulnerability analysis on a site with a firewall and a website firewall? The videos and content are very original and strange, there are no limits, my friend, I expect this from you

[@lostsecc]

sure ❤️

[@cameronribeiro9660]

Hi Lostsec and community: wanted to mention: I love new laptops just like everyone else: But if you’re just running W10 or w11 with wsl2: and you’re trying to save time and speed things up: you probably just need one of these in your current laptop:

[@lostsecc]

what i did'nt get u bro

[@PhvexSeven]

what systme u are using ?

[@lostsecc]

wsl2 kali

[@IDmeSpecialist]

Love you , love your lectures

[@huncking]

So this is only possible for website running majento and Adobe only?

[@lostsecc]

yws

[@darkmix4192]

Song name please

[@lostsecc]

dark beach

[@darkmix4192]

@@lostsecc Are you very busy man? I'm so many qus and doubts asked to you in telm but didn't response you but, it's ok i don't worry because I'm lostsec family member so spread love....

[@lostsecc]

sorry bro i am testing other stufss so not checked i will check all

[@محمدحاتم-ه1ض3ه]

Great work 🎉🎉🎉🎉🎉🎉❤❤❤❤❤❤

[@lostsecc]

❤️🤗

[@Rebelhunters-o3o]

Bro, how do you find target for bug bounty!! are you in any bug bounty program?? BTW Very nice video.Keep doing it🙂🙂

[@lostsecc]

use hak2ip tool and find these ip org names and report

[@Fractal_reComm]

Can you play this dork from the shodan console, it would save a lot of time or tell me where I can learn how to direct my js to get the ips in .txt you are really cool

[@lostsecc]

shodan will patch it if its viral

[@ShaistaFarukh]

Sir Allow pasting k bd console men ky kia. please tip share kr den

[@lostsecc]

shodan will patch immidately if i leak

[@cameronribeiro9660]

Hi all: sometimes an easy quick way to learn is an opinion question comparison: Tell me: what is your favorite scanner (amass, dirsearch, aquatone)? Why/why not? What is your favorite proxy (burp, mtmproxy, Caido, zap) why/why not? The idea with question like this: when everyone responds they will probably mention some little key thing that others didn’t know. Hell: what is your favorite platform (hackerone, bugcrowd, intigriti, Immunefi) why/why not?

[@niketpopat]

Can you share Console command to download ips from Shodan Facet 3:25 ?

[@lostsecc]

shodan will patch that immidately

[@sarion007]

in the browser on the shodan website u blurred some command will u share it? :)

[@lostsecc]

shodan will patch it immidately bro

[@Sidharthas89]

What is allow pasting. How we can use it. Dies it required subscription.

[@lostsecc]

no it does'nt require suscription

[@cybershadow007]

thanks man

[@Sidharthas89]

Thanks for the video bro❤❤ You are awesome ❤❤❤

[@lostsecc]

❤️🤗

[@bugbouty]

what is the trick to get all ips from shodan

[@lostsecc]

shodan will patch if i explose

[@NethaxStark]

Nice Bro!

[@algorethm_]

Learning a lot from you bro

[@lostsecc]

my pleasure bro ❤️😇

[@onlyfybyXING]

thanx

[@uttarkhandcooltech1237]

First

[@akroidofficial]

man, never thought of recon in that way. nice!

[@lostsecc]

❤️🤗

[@mdjeionmia4118]

Bro, can you clarify how I found organizations? I know it like org:Meta http.html:blah blah. And one-by-one searches are so time-consuming. Any other method for it? How are you doing it?

[@lostsecc]

i shared in telegram that tool must check there

[@mdjeionmia4118]

@@lostsecc hackip2host is it?

[@ekanshjaiswal9976]

@@lostsecc can you share your telegram group link ?

[@nonidentified89]

You are GOAT bro 💯🔥

[@lostsecc]

😇❤️🤗

[@Learning.Something.New.Daily.]

👍🏻

[@Sowhiski]

You are the best, Friend.

[@lostsecc]

🤗❤️

[@aatankbadboy3941]

Bro how we gonna earn From this 😂

[@lostsecc]

use the ip to org comverter tool from my telegram and report to the org

[@hk416ak-47]

Bro you make a very good video, but no one says anything about the fact that you always have a new wallpaper

[@lostsecc]

☺️🫂❤️

[@lostsecc]

wait for nextt video ❤️🔥

[@RajanChoudhary12]

Hey brother! I want to ask how much time it took you to earn yr first bounty and tell me how much you earn from Bug Bounty.

[@lostsecc]

its totaly depend on your skills and hardwork for someone it takes 3-6 months for sometime it takes 1 year+

[@RajanChoudhary12]

@@lostsecc Yeah! Thanks bro.

[@speedyfriend67]

😮

[@Hacker_ankit_2025]

Bhai ye konsa tool h jisse ye pata lage ki iss ip ka bug bounty h karke... ?? Tool name kya h

[@lostsecc]

i shared in my telegram hak2ip

[@cyberjunk777]

I like the look of your terminal, where can I get it? I use kali linux

[@lostsecc]

from microsoft store

[@cyberjunk777]

@@lostsecc Ooh, I thought you made the terminal yourself bro, WSL is really cool bro

[@user3549]

BRO whats the chrome extension you used

[@lostsecc]

link gopher

[@user3549]

@@lostsecc thxx

[@starlox0]

Just awesome 👌 🎉

[@lostsecc]

thnq bro ❤️

[@spramoda_8979]

Thanks for the content 🎉

[@lostsecc]

❤️🤗

[@JoopvdClips]

❤‍🔥❤‍🔥❤‍🔥❤‍🔥❤‍🔥

[@histoire-de-blackhat3346]

you are a top

[@lostsecc]

❤️

[@gr33nslim3]

Great content ❤

[@lostsecc]

❤️🤗

[@a-man2468]

luv u bro

[@lostsecc]

love u three bro ❤️🤗

[@tomiwafalade5480]

First!!

[@lostsecc]

❤️🙈

[@PrimePixel.444]

How to contact you if I want to talk to you or ask something???

[@lostsecc]

telegram

[@PrimePixel.444]

@@lostsecc okay But your Telegram group is already a group, how can I chat with you there?

[@lostsecc]

just msg me in bot link in discription of that channel

[@PrimePixel.444]

@@lostsecc okay

[@PrimePixel.444]

@@lostsecc By the way, you understand Hindi things.????

[@uttarkhandcooltech1237]

Give console cmd please

[@lostsecc]

shodan will be ban immidately bro

[@uttarkhandcooltech1237]

@@lostsecc it's ok bro give me na please

[@MohiUddin_Shakil]

bro, lots of love from Bangladesh. could you please share with us about bug bounty methodology?

[@lostsecc]

thnq mate ❤️yes u shared all things in telegram channel must check there..

[@YtShort-zone7]

😎😎

[@lostsecc]

😎🤏🏻

[@PhvexSeven]

can u give me advice about how learn about hacking ?

[@lostsecc]

check telegram bro i tell everything in details

[@PhvexSeven]

@@lostsecc ok tysm

[@P45PU7]

amazing..🥰

[@lostsecc]

❤️🤗

[@mohdhuzaifa5055]

@@lostsecc help me to solve this problem

[@whateveritis0]

Let me know how u scraping from shodan, just give me a hint! I guess its not a better idea to ask the complete script 😌 All i need is a hint ill take care apart👋🏻

[@maryjanechukwuma9707]

Bro I'll like to talk to you but your telegram bot I don't no how to go around it, is there another way that I could talk with you

[@lostsecc]

just msg anything its come to me there

[@tuyulmagelang]

please how to upload shell?

[@lostsecc]

i will post on telegram

[@janiparam7894]

which extension you are using for ip gathering...?

[@lostsecc]

link gopher

[@janiparam7894]

@@lostsecc ohhkkey...!👍🫡

[@mossadgaming9359]

Bro , Totally bounced you are extracting some ips which are vulnerable to the cve and performing the exploit on it , is it correct? if wrong please explain me . thank you

[@lostsecc]

not all vulnerable some are only..

[@mossadgaming9359]

@@lostsecc ok

[@dineshdhanasekar8982]

Extracting ips are Using That Application vulnerable to cve. Not every ips is vulnerable some of them are patched already.

[@therightvoice6570]

Thank u❤

[@lostsecc]

❤️🤗

[@falanavictor1986]

Hello bro , please I run dirsearch when following your guide on approaching a target in bug bounty but I get a lot of 403 in few mins ..is there any mitigations I could apply pls 😢😢

[@lostsecc]

-fc 403

[@falanavictor1986]

@@lostsecc what does that do please..it kinna look like my requests get dropped and forbidden..I noticed whenever I switch vpn location it works normally but starts malfunctioning after a few secs ..I tried using proxy chains but I couldn't get it to work

[@PersonalDetails-ig5ex]

It's due to continuous bruting. The site is protected from Dos​@@falanavictor1986

[@Not_Just_a_Fan]

​@@lostseccbro can you tell anyway other than payloads to bypass 403 forbidden error ? Please bro ?

[@IBO.ATTACKS]

🤑🤑🤑

[@yousdouse6354]

can you provide exploit.

[@lostsecc]

check telegram channel bro

[@yahai_]

awesome ❤❤❤ name extantion extract only domain

[@lostsecc]

link Gopher

[@netor-3y4]

how many can you make money in month?? ❤❤

[@lostsecc]

i love my work more then money

[@netor-3y4]

​@@lostsecc money is important to be alive

[@lostsecc]

when u work on your passion money will be automatic comes..

[@netor-3y4]

@@lostsecc yeah exactly why my first question 🙋 🙋

[@Krypt0Nu11]

We want voice over bro 💀

[@lostsecc]

when setup readyy sure