Episode 140: Crit Research Lab Update & Client-Side Tricks Galore

Episode 140: Crit Research Lab Update & Client-Side Tricks Galore

Episode 140: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph give an update from The Crit Research Lab, as well as some writeups on postMessage vulnerabilities, Cookie Chaos, and more.

Follow us on X at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Send us feedback at info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord!

Get some hacker swag here!

====== This Week in Bug Bounty ======

Cross-site request forgery

HackerOne New Milestone Program

Email santerra.holler@bugcrowd.com for media opportunities

====== Resources ======

Exploiting Web Worker XSS with Blobs

Critical Research Lab

Rez0's Tweet

CVE-2022-21703: cross-origin request forgery against Grafana

Conversation about Forcing Quirks Mode

AI Busniess Logic & POC or GTFO

Hunting postMessage Vulnerabilities – Part 1

Hunting postMessage Vulnerabilities – Part 2

Executive Offense

Cookie Chaos: How to bypass Host and Secure cookie prefixes

====== Timestamps ======

(00:00:00) Introduction

(00:05:48) Crit Research Update

(00:13:00) Encouragement & Collaboration

(00:19:37) Cross-origin request forgery & Anthropic's web fetch

(00:29:17) Quirks Mode, AI Business Logic & POC or GTFO

(00:44:21) Hunting postMessage & Claude Code browserbase

(00:51:25) Community story, Executive Offense, & Cookie Chaos

Jaksot(161)

Episode 81: Crushing Client-Side on Any Scope with MatanBer

Episode 81: Crushing Client-Side on Any Scope with MatanBer

Episode 81: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by MatanBer to go over some recent bug reports, as well as share some tips and tricks on client-side hacking and ...

25 Heinä 20242h 4min

Episode 80: Pwn2Own VS H1 Live Hacking Event (feat SinSinology)

Episode 80: Pwn2Own VS H1 Live Hacking Event (feat SinSinology)

Episode 80: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Sina Kheirkhah to talk about the start of his hacking journey and explore the differences between the Pwn2Own ...

18 Heinä 20242h 49min

Episode 79: The State of CSS Injection - Leaking Text Nodes & HTML Attributes

Episode 79: The State of CSS Injection - Leaking Text Nodes & HTML Attributes

Episode 79: In this episode of Critical Thinking - Bug Bounty Podcast we deepdive CSS injection, and explore topics like sequential import chaining, font ligatures, and attribute exfiltration.Follow u...

11 Heinä 20241h 10min

Episode 78: Less Writing, More Hacking - Reporting Efficiency Techniques

Episode 78: Less Writing, More Hacking - Reporting Efficiency Techniques

Episode 78: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about writing reports. We share some tips that we’ve learned, and discuss ways that AI can (and can’t) help with tha...

4 Heinä 20241h 6min

Episode 77: Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

Episode 77: Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

Episode 77: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin discuss some fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting...

27 Kesä 20241h 50min

Episode 76: Match & Replace - HTTP Proxies' Most Underrated Feature

Episode 76: Match & Replace - HTTP Proxies' Most Underrated Feature

Episode 76: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about Match and Replace and the often overlooked use cases for it, like bypassing paywalls, modifying host headers, ...

20 Kesä 20241h 34min

Episode 75: *Rerun* of The OG Bug Bounty King - Frans Rosen

Episode 75: *Rerun* of The OG Bug Bounty King - Frans Rosen

Episode 75: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are sick, So instead of a new full episode, we're going back 30 episodes to review.Follow us on twitter at: @ctbb...

13 Kesä 20242h 44min

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Roni "Lupin" Carta for a deep dive into supply chain attacks and dependency confusion. We explore the supply...

6 Kesä 20241h 38min