Episode 140: Crit Research Lab Update & Client-Side Tricks Galore

Episode 140: Crit Research Lab Update & Client-Side Tricks Galore

Episode 140: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph give an update from The Crit Research Lab, as well as some writeups on postMessage vulnerabilities, Cookie Chaos, and more.

Follow us on X at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Send us feedback at info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord!

Get some hacker swag here!

====== This Week in Bug Bounty ======

Cross-site request forgery

HackerOne New Milestone Program

Email santerra.holler@bugcrowd.com for media opportunities

====== Resources ======

Exploiting Web Worker XSS with Blobs

Critical Research Lab

Rez0's Tweet

CVE-2022-21703: cross-origin request forgery against Grafana

Conversation about Forcing Quirks Mode

AI Busniess Logic & POC or GTFO

Hunting postMessage Vulnerabilities – Part 1

Hunting postMessage Vulnerabilities – Part 2

Executive Offense

Cookie Chaos: How to bypass Host and Secure cookie prefixes

====== Timestamps ======

(00:00:00) Introduction

(00:05:48) Crit Research Update

(00:13:00) Encouragement & Collaboration

(00:19:37) Cross-origin request forgery & Anthropic's web fetch

(00:29:17) Quirks Mode, AI Business Logic & POC or GTFO

(00:44:21) Hunting postMessage & Claude Code browserbase

(00:51:25) Community story, Executive Offense, & Cookie Chaos

Jaksot(161)

Episode 9: Headless Browser SSRF & RebindMultiA Tool Release + Web3 Bug

Episode 9: Headless Browser SSRF & RebindMultiA Tool Release + Web3 Bug

Episode 9: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Headless Browser SSRF and drop a tool called RebindMultiA. Joel also walks us through a web3 bug and we cover some bu...

2 Maalis 20231h 8min

Episode 8: PostMessage Bugs, CSS Injection, and Bug Drops

Episode 8: PostMessage Bugs, CSS Injection, and Bug Drops

Episode 8: In this episode of Critical Thinking - Bug Bounty Podcast we drop some critical bugs which leak raw credit card info. We also discuss some CSS Injection & PostMessage related techniques. It...

22 Helmi 202335min

Episode 7: PortSwigger Top 10, TruffleSecurity Drama, and More!

Episode 7: PortSwigger Top 10, TruffleSecurity Drama, and More!

Episode 7: In this episode of Critical Thinking - Bug Bounty Podcast we talk about PortSwigger's Top 10 Web Hacking Techniques of 2022 (link below), some drama surrounding TruffleSecurity's XSS Hunter...

16 Helmi 202356min

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis)

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis)

Episode 6: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with mobile hacking legend Joel Margolis and get the scoop on his approach to popping bugs on Android.Follow us on twit...

9 Helmi 20231h 39min

Episode 4: H1-407 Event Madness & Takeaways Part 2 w/ Special Guest Spaceraccoon

Episode 4: H1-407 Event Madness & Takeaways Part 2 w/ Special Guest Spaceraccoon

Episode 4: In this episode of Critical Thinking - Bug Bounty Podcast we have part two of our series on the H1-407 HackerOne Live Hacking Event. This time, we have a special guest SpaceRaccoon (@spacer...

2 Helmi 202345min

Episode 5: AI Security, Hacking WiFi, the New XSS Hunter, and more

Episode 5: AI Security, Hacking WiFi, the New XSS Hunter, and more

Episode 5: In this episode of Critical Thinking - Bug Bounty Podcast we talk about the new XSS Hunter, MD5 collisions and using ChatGPT for security, and much more!Follow us on twitter at: @ctbbpodcas...

2 Helmi 202353min

Episode 3: H1-407 Event Madness & Takeaways Part 1

Episode 3: H1-407 Event Madness & Takeaways Part 1

Episode 3: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some of the interesting things we’ve learned from participating in HackerOne's H1-407 Live Hacking event. We cover de...

26 Tammi 202345min

Episode 2: Exploit Writing & Automation / Do you need to know how to program to hack?

Episode 2: Exploit Writing & Automation / Do you need to know how to program to hack?

Episode 2: In this episode of Critical Thinking - Bug Bounty Podcast we talk about exploit writing/automation, some new tools released in the industry (Of-CORS), the age old question of "Do you have t...

18 Tammi 20231h 14min