TikTok Security Vulnerability Report - Username Change Exploit by Sj Almayahi 

@@zeyadmoustafakamal the bug is to change your username as you like, like a special characters “#,%,^,*?+?=?_,\,|,~,,€,£,¥,•,,?,!,’” And any language you want

@@BraveSj Oh thanks. and also it seems that they are validating the username in the frontend only which seems to be crazy for engineers who take like more than 100k per year.

What special characters will do lol nothing change..

@@tpevers1048 Looks cool to just put special characters when you cant normally

@@zeyadmoustafakamal they check it backend, some old endpoints dont have that check, i used to a lot of tiktok autoclaimer work, and some old endpoints just had no security what so ever except signature checks

yes it is. this is a thing since like 2 weeks and changes the USERNAME, not Nickname, to whatever u want (can use special characters) and bypasses the 2 week waiting time. its called the "font method" and lots of people have been doing it

@@ifrostxy Using specific characters on TikTok names is a thing already. But claiming someone else’s username is not possible unless u mean with the font method

​its not a thing bruh? only if u use an exploit like in this vid@@SIurps

⁠@@SIurpswho said anything about claiming someone else’s username?

@@knight808. It’s with the font characters though

يمكنك حقنها ولكن موجوده حدود وفلاتر، اليوزر غيرته وسويت غيره

you do not know how changing a value via inspect element works right? basically if you reload a page anything you change via inspect element will go back to its original value so it has nothing to do with changing values via inspect element. don't know if it actually works I didn't try it but it seems fun

@@xsar5440 it didn't changed value via reload in the video because it initiates the sessions of the browser in python program which keep alive the values during reload.

@@xsar5440 it didn't changed value via reload in the video because it initiates the sessions of the browser in python program which keep alive the values during reload.

@@xsar5440 it didn't changed value via reload in the video because it initiates the sessions of the browser in python program which keep alive the values during reload.

@@xsar5440 it didn't changed value via reload in the video because it initiates the sessions of the browser in python program which keep alive the values during reload.

how is it not

@@irwys ok change my username to fuckboy69 that's a vulnerability

changing your username is something you can already do? Wether you do it via the app that calls the API or call the API through python, it's the same.

@@Hugos68 bro just discovered APIs lool

@@aziz9488 the point is that he can put any characters he want as his username

Its one in the payload

What did you get?

​@@ௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌஹi had a YT account thats blanked display lol

the exploit is that he can put special characters in the username

​@@riccardozappitelli450bro it doesn't change his original name, he's just able to change in frontend but after refreshing the old username appears😂.

@@riccardozappitelli450that’s his display name doofus

@@logansmlisbackthegamerno ist Not 💀💀💀👍

@@ZestyV8 it is

You can check my channel and see the usernames 😉 t.me/z3skrpro

@@BraveSj oh.

It isn’t patched

@@AlA-bd5bg it is lol

@@AlA-bd5bg yeah he got patched

No i posted accounts that i edit and you can visit em T.me/z3skrPro

sure, just send HTTP requests to interact with APIs, similar to what the Python script does.

@@гексо no, for everyone visit my username, i shared the users i got in my tg t.me/z3skrpro

​@@BraveSjprove it with another video

Dummy he is change it on the backend

@@picoarsya-chan2903 its propably patched, but for someone who knows how this works i can confirm that everyone sees it

@@picoarsya-chan2903 bro he called the api how tf should it only be visible for him

0:41 doing a request with customed headers to the tiktok api

and he was just getting his session id

this bug is populor now in arabs its working

bro

@@hlcd-7191 yep

@@BraveSj script please ?

@@hlcd-7191 t.me/z3sbot

instagram.com/ss_j

t.me/BraveSj