Episode
17 May 2022 Official episode · Official transcript
black hat cybercrime botnet
The episode features Daniel Kelley describing his progression from gaming-related DDoS activity and website intrusions to criminal hacking and extortion, followed by responsible vulnerability disclosure and bug bounty work.
Topics: Xbox parental-control bypass, Distributed denial-of-service attacks, Booter services, Skype IP-address resolution, Google dorking, Exposed private keys and misconfigured administrative portals, Cross-site scripting, SQL injection, Privilege escalation and network pivoting, Botnets and Mirai, Cryptocurrency extortion, Tor and VPN use in cybercrime investigations, Responsible vulnerability disclosure, Bug bounty programs, CVE assignment and vulnerability coordination, CyberChef security vulnerabilities
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Xbox parental controls vulnerability AFFECTS Xbox Live
The Xbox parental-controls vulnerability allowed a user to bypass the child account restrictions and access games on the father's account.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“there was a vulnerability in the Xbox parental controls that allowed someone to just type in all spaces to get out of the kid’s account”
Xbox parental controls vulnerability DISCOVERED_BY Kid
The five-year-old identified the Xbox parental-controls bypass and demonstrated it to his father.
Explicit Confidence 98% · Jack Rhysider EP 117 Details
“they even credited the kid in the bug report as a security researcher involved with identifying it”
Daniel Kelley USES World of Warcraft
Daniel says he was obsessed with World of Warcraft and spent thousands of hours playing it competitively.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I used to be obsessed with a certain game called World of Warcraft”
Daniel Kelley USES booter
As a teenager, Daniel used a booter to conduct a DDoS attack against another player's connection.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“So, I had a booter and Skype Resolver, and I decided to test this theory”
Daniel Kelley USES Skype Resolver
Daniel used the Skype Resolver to obtain another player's IP address before DDoSing him.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“So, I had a booter and Skype Resolver, and I decided to test this theory”
A booter is described as a tool used to carry out DDoS attacks.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“a booter was, which is a type of hacking tool that does this kind of DDoS attack”
Skype Resolver USES Skype
The Skype Resolver used a Skype username and attempted to call the user to obtain their IP address.
Explicit Confidence 98% · Jack Rhysider EP 117 Details
“they created a little tool called the Skype Resolver, and with this little tool, all you had to do is enter someone’s Skype username”
Daniel Kelley USES Google dorking
Daniel learned and used Google dorking to find potentially vulnerable websites.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“This is where he learned about Google dorking”
Google dorking USES Google
Google dorking is described as using Google searches to identify exposed files and potentially vulnerable websites.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“Google dorking is where you use Google as a vulnerability scanner”
cross-site scripting DISCOVERED_BY Daniel Kelley
Daniel found a cross-site scripting vulnerability on a Microsoft subdomain.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I found a cross-site scripting vulnerability in – on a subdomain in this login panel”
Daniel Kelley USES responsible disclosure
Daniel submitted the proof of concept for the Microsoft XSS vulnerability through Microsoft's responsible disclosure process.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I basically took the proof of concept and submitted it to Microsoft’s security team”
Daniel Kelley USES Mirai
Daniel was given access to a Mirai botnet and used it to attack his college's network.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I basically had access to this botnet. It was essentially a Mirai botnet”
Mirai is described as being effective at flooding an IP address and carrying out DDoS attacks.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“It’s very good at doing DDoS attacks”
Mirai botnet attack on college network INVOLVES Mirai
The college-network attack involved Daniel using a Mirai botnet.
Explicit Confidence 96% · Daniel Kelley EP 117 Details
“I essentially DDossed that college”
Mirai botnet attack on college network INVOLVES DDoS
The incident consisted of repeated DDoS attacks that disrupted the college network and coursework access.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“by DDossing that website, in effect, nobody could log in and nobody could really access their work”
Daniel Kelley USES blackmail and extortion campaign
Daniel describes conducting a hacking spree involving blackmail and extortion of website owners.
Explicit Direction flagged Confidence 99% · Daniel Kelley EP 117 Details
“my criminality essentially escalated from low-level offending to blackmail, fraud, and computer hacking”
Daniel Kelley USES Bitcoin
Daniel demanded Bitcoin in exchange for not publishing stolen data or vulnerability information.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“What Daniel was asking was anywhere between five and forty Bitcoin”
TalkTalk incident COMPROMISES TalkTalk
The TalkTalk incident involved unauthorized access to TalkTalk's network and theft of substantial amounts of data.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“get into TalkTalk’s network and start moving around and stealing data”
TalkTalk incident INVOLVES SQL injection
The incident began with an SQL injection vulnerability on a TalkTalk subdomain.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“What he’s effectively found is an SQL injection on a subdomain”
TalkTalk incident INVOLVES Daniel Kelley
Daniel was involved in the incident by using data obtained from the TalkTalk breach to send a ransom demand, although he says a friend carried out the database download.
Explicit Confidence 98% · Daniel Kelley EP 117 Details
“I had access to this data and I basically decided to gather all of the e-mails from the data”
Daniel Kelley USES Tor
Daniel says he used Tor when sending the TalkTalk extortion email.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“when I sent the extortion e-mail to TalkTalk, I used Tor”
Daniel Kelley USES VPN
Daniel used a VPN for another extortion operation and reused its Bitcoin address in the TalkTalk case, allowing investigators to link the offenses.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I had hacked and blackmailed another company without using Tor; I only used a VPN”
GCHQ published CyberChef as an open-source project.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“GCHQ basically published this open-source project called CyberChef”
cross-site scripting AFFECTS CyberChef
Daniel found a Git-based XSS vulnerability in CyberChef when it was first published.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“when they first published it, there was a git based XSS in it”
Daniel Kelley USES bug bounty program
After his conviction and while on bail, Daniel began participating in bug bounty programs.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I started engaging in all of these bug bounty programs”
Daniel Kelley USES responsible disclosure
Daniel reports that he spent two years responsibly disclosing vulnerabilities rather than exploiting or extorting companies.
Explicit Confidence 99% · Daniel Kelley EP 117 Details
“I started engaging in responsible disclosure”
Daniel Kelley USES MITRE CVE program
Daniel reported vulnerabilities through MITRE's CVE program and sought publication of CVE identifiers after vendors patched the issues.
Explicit Confidence 99% · Jack Rhysider EP 117 Details
“One place he liked reporting bugs to was MITRE’s CVE program”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:36:37.977443+00:00