Episode 97: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel jump into some cool news items, including a recent Okta Bcrypt vulnerability, insights into crypto bugs, and some intricacies of Android and Chrome security. They also explore the latest research from Portswigger on payload concealment techniques, and the introduction of the Lightyear tool for PHP exploits.
Follow us on twitter at: https://twitter.com/ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to https://twitter.com/realytcracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater & Teknogeek on twitter:
https://twitter.com/0xteknogeek
https://twitter.com/rhynorater
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Today’s Sponsor - ThreatLocker: Check out Network Control!
https://www.criticalthinkingpodcast.io/tl-nc
Resources:
Okta bcrypt
https://x.com/bcrypt/status/1852575080989257893
Android Web Attack Surface Writeups
https://ndevtk.github.io/writeups/2024/08/01/awas/
Concealing payloads in URL credentials
https://portswigger.net/research/concealing-payloads-in-url-credentials
Dumping PHP files with Lightyear
https://x.com/ambionics/status/1853358125283152207
Limit maximum number of filter chains
https://github.com/php/php-src/issues/10453
Dom-Explorer tool launched
https://www.yeswehack.com/learn-bug-bounty/dom-explorer-tool-parse-html?utm_source=twitter&utm_medium=social&utm_campaign=dom-explorer-tool
MultiHTMLParse
https://github.com/avlidienbrunn/multihtmlparse
JSON Crack
https://x.com/tom_doerr/status/1852810041339896314
Caido/Burp notes plugin
https://github.com/Static-Flow
Timestamps:
(00:00:00) Introduction
(00:02:43) Okta Release and bcrypt
(00:10:26) Android Web Attack Surface Writeups
(00:20:21) More Portswigger Research
(00:28:29) Lightyear and PHP filter chains
(00:35:09) Dom-Explorer
(00:45:24) The JSON Debate
(00:49:59) Notes plugin for Burp and Caido
