Exploiting unsanitised user inputs in Django ORM filter methods to exfiltrate sensitive data. Shout out to @elttam for this HOT research! 🔥 #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers
iOS auth flaw ala evanconnelly and mrtuxracer 1. Install malicious app and register victim's scheme 2. User approves the evil app to login with attacker.com (ofc, why not) 3. Web view opens, attacker forces redirect to vuln auth flow for victim app w/ prompt=none 4. Auth code sent to attackers…
One-click account takeover: Deep link to Open redirect to XSS on subdomain to Attacker-controlled URL. Victim clicks chat link, attacker gets auth token. Simple.
Episode 79: In this episode of Critical Thinking - Bug Bounty Podcast we deepdive CSS injection, and explore topics like sequential import chaining, font ligatures, and attribute exfiltration. Follow us on twitter at: https://twitter.com/ctbbpodcast We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io…
Unwrapping wrappers to get to the real function that is actually being triggered with Frans Rosen's postMessage-tracker!
Here's an interesting one folks! Frans discovered state validation was happening before you acquire the code so you can get the victim to use your state instead.
Episode 78: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about writing reports. We share some tips that we’ve learned, and discuss ways that AI can (and can’t) help with that process. We also talk about the benefit of incorporating tools like Fabric, Loom, and ShareX.…
That time Frans Rosen roasted Justin live on the pod when discussing Frans' sick poster of Google's /etc/passwd file!
Another great example of the importance of gadget hunting as well as bug hunting!
Found a gadget where X-Forwarded-For was blocked, but x-forwarded-for was allowed. Tools like ffuf actually auto-capitalize headers so you would easily miss this without manually testing!
Episode 77: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin discuss some fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting into a conversation about staying motivated and avoiding burnout while hunting. Follow us on twitter at: https://twitter.com/ctbbpodcast We're…
Some seriously good research dropped on the pod last week. Shout out to Piotr Bazydło and The Zero Day Initiative for this crazy XXE in Microsoft Sharepoint!
Joel's tip of the week: Keep it simple. It's easy to overcomplicate things. Sometimes all you need is a simple match and replace instead of some next level regex!
H4R3L's "Cookie XSS" affecting almost every Zoom page and subdomain demonstrates the effectiveness of experimenting with escape characters in cookie values. It all started when @H4R3L discovered a CSP Nonce cookie that was being used in every page with a CSP policy. Because Zoom takes their security seriously, there was…
When unmotivated, reset. Ignore excuses, just start small. Just remember it's hard to begin but easy once you're rolling.
Episode 76: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about Match and Replace and the often overlooked use cases for it, like bypassing paywalls, modifying host headers, and storing payloads. We also talk about the HackerOne Ambassador World Cup and the issues with dupe submissions,…
Joel's top tips for staying motivated in bug bounty.
Lupin discovered that many companies were mistakenly calling a package that didn't exist. So what did he do? He claimed it so they downloaded his package instead.
From the peak of happiness to the pit of despair and back again.
Episode 75: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are sick, So instead of a new full episode, we're going back 30 episodes to review. Follow us on twitter at: https://twitter.com/ctbbpodcast We're new to this podcasting thing, so feel free to send us any…
How deep do you go when looking for secrets in CI/CD Pipelines? That's the question. Lupin discusses how devs are exposing orgs via insecure private CI/CD pipelines using their own npm tokens.
It's one thing when your script works first time. It's whole other thing when it works on the biggest public registry out there!
Whenever you see a pop-up or change happening in an iframe, look to see the window.open call that's doing it and check the name on that. If using a guessable iframe name, you might be able to hijack it and control the flow!
