03-05-26, 07:42 PM
Hello DarkForums Community,
Today I am releasing a private Kuaishou mass-reporting weapon designed to obliterate any account or video through coordinated fake-report swarming.
What this tool does:
Target Info:
- Platform: kuaishou.com (Chinese TikTok competitor, 600M+ users)
- Endpoint: POST https://www.kuaishou.com/graphql (ReportSubmitMutation)
- Secondary: POST https://v.kuaishou.com/ short-link resolver
- Country: China
- Vulnerability: Trust-and-safety GraphQL mutation accepts bulk reports with stolen session cookies and zero CAPTCHA validation
Capabilities:
- Input: Kuaishou video/profile short-link
- Output: Account/video ban success/fail counters
- Method: Session-cookie authenticated GraphQL mutations with rotating User-Agent pools
- Cookie source: Remote CDN dump (wpan.cdndns.site/down/JB666) loaded dynamically at runtime
Use Case:
- Swarm-ban competitor accounts or influencers
- Silence whistleblowers or rival sellers
- Test Kuaishou trust-and-safety resilience
- Burn through disposable account farms for mass censorship
- Monetize as a service: "Guaranteed Kuaishou takedown"
Tool Features:
[+] Dual-mode: report specific VIDEO or entire USER profile
[+] Auto short-link expansion (v.kuaishou.com to photoId/userId)
[+] Multi-threaded cookie rotation (10-20 workers)
[+] Remote cookie list auto-updates without restart
[+] Pre-configured report codes (214 = other / generic reason)
[+] Color-coded CLI output (green success / red fail)
[+] Round-based reporting (set how many waves)
Cookie Source:
- http://wpan.cdndns.site/down/JB666
- Loads live session dumps (login_sid, kuaishou.server.web_st)
- Cookie list refreshed every run
Note:
- Cookies are shared/session-binned -- they expire fast, refresh from source
- Works best with fresh Chinese mobile IP + WeChat/Kuaishou headers
- Report reason hardcoded to 214 (other) with text "别说话掉"
- For stress-testing and red-team only
Deliverables included:
[+] 2.0.py - clean Python script
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)
Today I am releasing a private Kuaishou mass-reporting weapon designed to obliterate any account or video through coordinated fake-report swarming.
What this tool does:
Target Info:
- Platform: kuaishou.com (Chinese TikTok competitor, 600M+ users)
- Endpoint: POST https://www.kuaishou.com/graphql (ReportSubmitMutation)
- Secondary: POST https://v.kuaishou.com/ short-link resolver
- Country: China
- Vulnerability: Trust-and-safety GraphQL mutation accepts bulk reports with stolen session cookies and zero CAPTCHA validation
Capabilities:
- Input: Kuaishou video/profile short-link
- Output: Account/video ban success/fail counters
- Method: Session-cookie authenticated GraphQL mutations with rotating User-Agent pools
- Cookie source: Remote CDN dump (wpan.cdndns.site/down/JB666) loaded dynamically at runtime
Use Case:
- Swarm-ban competitor accounts or influencers
- Silence whistleblowers or rival sellers
- Test Kuaishou trust-and-safety resilience
- Burn through disposable account farms for mass censorship
- Monetize as a service: "Guaranteed Kuaishou takedown"
Tool Features:
[+] Dual-mode: report specific VIDEO or entire USER profile
[+] Auto short-link expansion (v.kuaishou.com to photoId/userId)
[+] Multi-threaded cookie rotation (10-20 workers)
[+] Remote cookie list auto-updates without restart
[+] Pre-configured report codes (214 = other / generic reason)
[+] Color-coded CLI output (green success / red fail)
[+] Round-based reporting (set how many waves)
Cookie Source:
- http://wpan.cdndns.site/down/JB666
- Loads live session dumps (login_sid, kuaishou.server.web_st)
- Cookie list refreshed every run
Note:
- Cookies are shared/session-binned -- they expire fast, refresh from source
- Works best with fresh Chinese mobile IP + WeChat/Kuaishou headers
- Report reason hardcoded to 214 (other) with text "别说话掉"
- For stress-testing and red-team only
Deliverables included:
[+] 2.0.py - clean Python script
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)
