July 7, 2024
The BEST time to stop hacking!?
Some gold nuggets from Frans Rosen on the pod!
Sign up to get updates from us
Unwrapping wrappers to get to the real function that is actually being triggered with Frans Rosen's postMessage-tracker!
Here's an interesting one folks! Frans discovered state validation was happening before you acquire the code so you can get the victim to use your state instead.
Episode 78: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about writing reports. We share some tips that we’ve learned, and discuss ways that AI can (and can’t) help with that process. We also talk about the benefit of incorporating tools like Fabric, Loom, and ShareX.…
That time Frans Rosen roasted Justin live on the pod when discussing Frans' sick poster of Google's /etc/passwd file!
Another great example of the importance of gadget hunting as well as bug hunting!
Found a gadget where X-Forwarded-For was blocked, but x-forwarded-for was allowed. Tools like ffuf actually auto-capitalize headers so you would easily miss this without manually testing!
Episode 77: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin discuss some fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting into a conversation about staying motivated and avoiding burnout while hunting. Follow us on twitter at: https://twitter.com/ctbbpodcast We're…
Some seriously good research dropped on the pod last week. Shout out to Piotr Bazydło and The Zero Day Initiative for this crazy XXE in Microsoft Sharepoint!
Joel's tip of the week: Keep it simple. It's easy to overcomplicate things. Sometimes all you need is a simple match and replace instead of some next level regex!
H4R3L's "Cookie XSS" affecting almost every Zoom page and subdomain demonstrates the effectiveness of experimenting with escape characters in cookie values. It all started when @H4R3L discovered a CSP Nonce cookie that was being used in every page with a CSP policy. Because Zoom takes their security seriously, there was…
When unmotivated, reset. Ignore excuses, just start small. Just remember it's hard to begin but easy once you're rolling.
Episode 76: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about Match and Replace and the often overlooked use cases for it, like bypassing paywalls, modifying host headers, and storing payloads. We also talk about the HackerOne Ambassador World Cup and the issues with dupe submissions,…
Joel's top tips for staying motivated in bug bounty.
Lupin discovered that many companies were mistakenly calling a package that didn't exist. So what did he do? He claimed it so they downloaded his package instead.
From the peak of happiness to the pit of despair and back again.
Episode 75: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are sick, So instead of a new full episode, we're going back 30 episodes to review. Follow us on twitter at: https://twitter.com/ctbbpodcast We're new to this podcasting thing, so feel free to send us any…
How deep do you go when looking for secrets in CI/CD Pipelines? That's the question. Lupin discusses how devs are exposing orgs via insecure private CI/CD pipelines using their own npm tokens.
It's one thing when your script works first time. It's whole other thing when it works on the biggest public registry out there!
Whenever you see a pop-up or change happening in an iframe, look to see the window.open call that's doing it and check the name on that. If using a guessable iframe name, you might be able to hijack it and control the flow!
Leaking the top-level window.location.href by accessing the document.baseURI of a sandboxed iframe with a srcdoc! Credit for this one goes to the one and only Johan Carlsson!
Episode 74: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Roni "Lupin" Carta for a deep dive into supply chain attacks and dependency confusion. We explore the supply chain attacks, the ethical considerations surrounding maintainers and hosting packages on public registries, and chat about…
It's possible to bypass WAFs by adding as little as 8KB of padding to your requests! Props to Assetnote for creating the O.G nowafspls and Justin for recreating the Caido version!
Did you know the optional chaining operator "?." can be used to bypass blacklists? Justin didn't but luckily Johan was there to call him out on it. Original tweet here: https://loom.ly/-KVqwlM