ecriminal/discord-exploit-collection

👾 A collection of Discord bugs and exploits

Discord Exploit Collection

A collection of both patched and unpatched bugs, exploits, API abuses and other strange and exploitable features and illusions in the Discord app.

CBA to make an overview. Just browse the repo.

Look forward to

Unpatched:

• Spoofed (fake) mute/deafen
• Unmentionable empty message (rather an illusion)
• Public guild spoofer
• Glitched channel description

Patched:

• Private group chat crasher
• Account disabler
• All platforms client crasher (image/GIF)
• All platforms client crasher (contact connection)
• All platforms client crasher (unicode)
• IOS client crasher (GIF)
• IOS client lagger (markdown)
• Android client crasher (GIF)
• Force disable 2FA
• Guild outage v1 (RPC exploit)
• Guild outage v2
• Guild outage v3
• Spoofed connections
• Double HypeSquad houses
• Desktop crasher (URL highlight)

Some other unpatched exploits I haven't figured out how works yet

• E-mail verification remover (probably client-side spoof)
• Anti disable (prevent Discord staff from disabling your account)
• Anti Phone Lock (prevent Discord's security system from phone locking your account)
• Anti Disconnect (prevent other users from disconnecting you from any public voice channel)

Let me know, if anything is missing or if you have any exploits, on my Discord Server

discord-exploit-collection's Issues

Mask Message without selfbotting

is this possible? how would I do it???

Guild voice channel denial of service not working

Guild voice channel denial of service not working, at least not for me.
It changes the server location but then it instantly goes back to US.

Where is the ddos voice call file? i was searching a tool for ddos any voice call.

Bannable?

Can I get banned for this?

Import requests issue

everytime i use an exploit with import requests in it i get an error when i run it, it says Traceback (most recent call last):
File "example.py", line 6, in
import requests
ModuleNotFoundError: No module named 'requests' im using python 3.8 btw

.

Wdym by "Glitched channel description"

can you suggest bugs here?

a friend found a character that if you put the url encoded version of it in a url it makes that url unclickable, dont know if this only works on desktop tho
%E4 <- this is the character (decoded version is ä)
(example) https://a.%E4.com

Exploit for analysis

Hey can you give me rce exploit that is unpatched for studying if you dont want to give give half code only

Updates

Exploit: An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic.

[Account Disabler] -> Patched sadly
[Block Bypass] -> Not an exploit since this isn't exploiting a bug or vuln since its an accessible portion of the api.
[Delete Webhook] -> Also not an exploit... its in there documentation please read it https://discord.com/developers/docs/resources/webhook
[Glitched mention] -> Also not an exploit since this is how user ids are currently implemented regardless of if they point to valid users.
[Mask Message] -> Patched
[DOS Exploit] -> Very interesting had no idea this was possible 👍 I look forward to seeing this repo updated.

discord gone

just realized that i wasnt in the server anymore and that the invite expired, did the server get banned by discord?

duplicate: wtf?

is your rce patched yet?

referring to this
if it's not, what level of bullshit-that-should-definitely-already-be-patched is it?

Remote Code Execution Outdated

i know you didnt posted it but i think its patched

bruh new exploit patched

discord patched account disabler by this way, but you can block an account by spamming requests to join a server, some times it delete account if the victim didn't spend any money on discord (no joke i saw it and did it like 9999 times)

re = requests.patch('https://discordapp.com/api/v6/users/@me', headers={"Authorization": token}, json={'date_of_birth': '2019-2-11'})

print(re.status_code)
400
print(re.text)
{"date_of_birth": ["You can't edit your date of birth"]}

discord invite is invalid

title