Episode 73: In this episode of Critical Thinking - Bug Bounty Podcast we give a brief recap of Nahamcon and then touch on some topics like WAF bypass tools, sandboxed iframes, and programs redacting your reports. Follow us on twitter at: https://twitter.com/ctbbpodcast We're new to this podcasting thing, so feel…
Templating is huge for RCE when looking at source code. Stay on the look out for interactions with files, external APIs, Redis, deserialization of binary formats, YAML, JSON etc. They could lead to unintended RCE or prototype pollution.
Seen a trend recently where vulns are the result of indirect method invocation and there are LOADS of ways to do this. Ruby: obj.send(method, args) PHP: $obj -► $method Python: globals()[method]() Java: Method.invoke(), callable.call() JS: obj[method](), .apply()
The guys discussing the issue of affordability in starting and maintaining a bug bounty program.
Episode 72: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information…
AI bias bugs can be subjective and tricky to prove actual impact. @securingdev shared a great tip on the pod which you may remember from science class: "Keep as many things consistently the same for your inputs with select independent variables."
Joel enters the idea of government subsidies into the VDP debate.
Things getting hot and spicy on the pod last week when @securingdev brought up the idea of "Security as a Feature"!
Nothing adds value like $50,000, right!? Nahamsec dropped some exciting news on the pod last week when talking bonuses for NahamCon.
Dropped this simple but effective recon tip on the pod last week.
Dang, dude, the Meta program is insane. Their biggest bounty is $300k. That's as much as an entire hacking event back in the day! Here's @nahamsec's explaining how crazy this is for hunting.
Episode 71: In this episode of Critical Thinking - Bug Bounty Podcast Keith Hoodlet joins us to weigh in on the VDP Debate. He shares some of his insights on when VDPs are appropriate in a company's security posture, and the challenges of securing large organizations. Then we switch gears…
Got schooled by @NahamSec when we showed him this common CSP bypass.
Script gadgets can be gold when normal script execution is blocked! Often applications will bind functionality to the action of adding elements with specific classes to the DOM. These can be leveraged as gadgets to build an exploit for your target.
Johan Carlsson takes proving impact to the extreme by showing that a GitLab bug could've resulted in an attacker being able to: - Trigger new and existing pipelines - Overwrite variables - Upload images for RCE - Gain full access to all CI variables - [INSERT IMAGINATION]
There's a first time for everything! Here's how @joaxcar discovered his first XSS (by accident) followed swiftly by his first experience with a CSP. Sorry Johan! #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers
Episode 70: In this episode of Critical Thinking - Bug Bounty Podcast we’re once again joined by Ben Sadeghipour to talk about some Nahamcon news, as well as discuss a couple other LHE’s taking place. Then they cover CI/CD and drop some cool CSP Bypasses. Follow us on twitter at:…
WOW. Some next level chaining by @joaxcar for this CSP bypass in GitHub! Drag and drop triggers HTML injection which injects a form which triggers a hash change which triggers a button click which injects more and triggers another click gadget which triggers a hash change again which finally triggers…
When the pod guests brings a path-based 307 semi-open redirect gadget that affects a large portion of the internet to share on the pod - you know you've found the one. 😍 example[.]com/cdn-cgi/image/onerror=redirect/http://hello[.]example[.]com
Another one of Mathias' HTMX bugs from the pod. This one is an HTMX trigger attribute injection into an HTML element leading to XSS!
HTMX uses certain headers to help instruct the framework for certain behaviours. This can be abused via HX-Redirect: javascript:alert(1) for XSS if you can inject a response header. Mathias Karlsson explains how...
Episode 69: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Johan Carlsson to hear about some updates on his bug hunting journey. We deep-dive a CSP bypass he found in GitHub, a critical he found in GitLab's pipeline, and also talk through his approach to…
.@avlidienbrunn blew our minds with his latest HTMX research including this tasty CSP bypass. See Twitter for payload.
Shots fired on the pod last week on whether programs are incentivised NOT to pay. #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers
