Make Your Own JAILBROKEN Claude For Hacking

Summary

The video demonstrates using Claude to analyze a deliberately vulnerable PortSwigger lab, framing the exercise as ethical security testing rather than testing real websites.

• The presenter gives Claude the page’s JavaScript and asks it to identify vulnerabilities. Claude flags a DOM-based cross-site scripting (XSS) issue.
• The vulnerable code listens for postMessage events but does not verify the sender’s origin. It parses the message and, for a particular message type, assigns a supplied URL to an iframe’s src without adequate validation.
• The presenter explains how a crafted message can make the iframe interpret a javascript: URL. They then use browser developer tools and breakpoints to trace the message data through the handler and confirm the behavior in the lab.
• The video highlights AI’s ability to speed up vulnerability review while noting that the presenter still explains and verifies the finding. The potential impact is described as serious, but the demonstration is confined to a controlled test environment.
• The presenter also promotes bug-bounty and game-hacking courses, which are not part of the technical walkthrough.

Main speaker/source: DeadOverflow, the video presenter. AI tool discussed: Claude.