Videos

Dropped this simple but effective recon tip on the pod last week.

Dang, dude, the Meta program is insane. Their biggest bounty is $300k. That's as much as an entire hacking event back in the day! Here's @nahamsec's explaining how crazy this is for hunting.

Episode 71: In this episode of Critical Thinking - Bug Bounty Podcast Keith Hoodlet joins us to weigh in on the VDP Debate. He shares some of his insights on when VDPs are appropriate in a company's security posture, and the challenges of securing large organizations. Then we switch gears…

Got schooled by @NahamSec when we showed him this common CSP bypass.

Script gadgets can be gold when normal script execution is blocked! Often applications will bind functionality to the action of adding elements with specific classes to the DOM. These can be leveraged as gadgets to build an exploit for your target.

Johan Carlsson takes proving impact to the extreme by showing that a GitLab bug could've resulted in an attacker being able to: - Trigger new and existing pipelines - Overwrite variables - Upload images for RCE - Gain full access to all CI variables - [INSERT IMAGINATION]

There's a first time for everything! Here's how @joaxcar discovered his first XSS (by accident) followed swiftly by his first experience with a CSP. Sorry Johan! #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers

Episode 70: In this episode of Critical Thinking - Bug Bounty Podcast we’re once again joined by Ben Sadeghipour to talk about some Nahamcon news, as well as discuss a couple other LHE’s taking place. Then they cover CI/CD and drop some cool CSP Bypasses. Follow us on twitter at:…

WOW. Some next level chaining by @joaxcar for this CSP bypass in GitHub! Drag and drop triggers HTML injection which injects a form which triggers a hash change which triggers a button click which injects more and triggers another click gadget which triggers a hash change again which finally triggers…

When the pod guests brings a path-based 307 semi-open redirect gadget that affects a large portion of the internet to share on the pod - you know you've found the one. 😍 example[.]com/cdn-cgi/image/onerror=redirect/http://hello[.]example[.]com

Another one of ­Mathias' HTMX bugs from the pod. This one is an HTMX trigger attribute injection into an HTML element leading to XSS!

HTMX uses certain headers to help instruct the framework for certain behaviours. This can be abused via HX-Redirect: javascript:alert(1) for XSS if you can inject a response header. Mathias Karlsson explains how...

Episode 69: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Johan Carlsson to hear about some updates on his bug hunting journey. We deep-dive a CSP bypass he found in GitHub, a critical he found in GitLab's pipeline, and also talk through his approach to…

.@avlidienbrunn blew our minds with his latest HTMX research including this tasty CSP bypass. See Twitter for payload.

Shots fired on the pod last week on whether programs are incentivised NOT to pay. #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers

Joel getting fired up about the leaderboard problem in bug bounties. #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers

Episode 68: In this episode of Critical Thinking - Bug Bounty Podcast Mathias is back with some fresh HTMX research, including CSP bypass using HTMX triggers, converting client-side response header injection to XSS, bypassing HTMX disable, and the challenges of using HTMX in larger applications and the potential performance trade-offs.…

Things getting spicy on the pod when the VDP debate cropped up! #infosec #bugbounty #bugbounties #cybersecurity #criticalthinking #CTBBpodcast #bugbountytips #bugbountyhunters #hacking #hackers

Engineering blogs can be a gold mine of juicy info about a company's internal infrastructure, how it works, how it communicates and even problems they're encountering! Pretty much no one reads them... until now!

Joel dropped some truth bombs on the pod last week! Here's one of 'em!

Set up a Discord channel so we know what the Blink Dev Google Group are up to. Whenever they post about new features they're planning to ship, we'll know!

Here's one y'all been waiting for: @CaidoIO is dropping global workflows this week!

Episode 67: In this episode of Critical Thinking - Bug Bounty Podcast we deep-dive on the topic of Vulnerability Disclosure Programs (VDPs) and whether they are beneficial or not. We also touch on the topic of leaderboard accuracy, and continue the Program VS Hacker debate regarding allocating funds for bounties.…

Used a "?" before "@" to terminate an OAuth flow redirect URI, control the redirect location, and leak the oauth code.