Episode 72: Research TLDRs & Smuggling Payloads in Well Known Data Types

Episode 72: Research TLDRs & Smuggling Payloads in Well Known Data Types

Episode 72: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!

Follow us on twitter at: @ctbbpodcast

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today's Sponsor - Project Discovery: https://nux.gg/podcast

Resources:

PDF.JS Bypass to XSS

https://github.com/advisories/GHSA-wgrm-67xf-hhpq

https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/

PDFium

NextJS SSRF by AssetNote

Better Bounty Transparency for hackers

Slonser IPV6 Research

Smuggling payloads in phone numbers

Automatic Plugin SQLi

DomPurify Bypass

Bug Bounty JP Podcast

Github Enterprise send() bug

https://x.com/creastery/status/1787327890943873055

https://x.com/Rhynorater/status/1788598984572813549

Timestamps:

(00:00:09) Introduction

(00:03:20) PDF.JS XSS and NextJS SSRF

(00:12:52) Better Bounty Transparency

(00:20:01) IPV6 Research and Phone Number Payloads

(00:28:20) Community Highlight and Automatic Plugin CVE-2024-27956

(00:33:26) DomPurify Bypass and Github Enterprise send() bug

(00:46:12) Caido cookie and header extension updates

Episoder(166)

Episode 150: ASP.NET MVC Patterns, Popping Oracle Identity, and Esoteric Subdomain Enumeration

Episode 150: ASP.NET MVC Patterns, Popping Oracle Identity, and Esoteric Subdomain Enumeration

Episode 150: In this episode of Critical Thinking - Bug Bounty Podcast we're highlighting some cool news and research, but not before expressing our gratitude to the Hacker community. We are so thankf...

27 Nov 202557min

Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.Follow us on XGot any ideas and suggestions?...

20 Nov 20251h 2min

Episode 148: MCP Hacking Guide

Episode 148: MCP Hacking Guide

Episode 148: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us a crash course on Model Context Protocol.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and sugg...

13 Nov 202532min

Episode 147: Stupid Simple Hacking Workflow Tips

Episode 147: Stupid Simple Hacking Workflow Tips

Episode 147: In this episode of Critical Thinking - Bug Bounty Podcast we're talking tips and tricks that help us in hacking that we really should’ve learned sooner.Follow us on twitter at: https://x....

6 Nov 202558min

Episode 146: Hacking Horror Stories

Episode 146: Hacking Horror Stories

Episode 146: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Joseph, and Brandyn all sit down to celebrate the spooky season by swapping their scariest bug stories. From frightening ...

30 Okt 20251h 50min

Episode 145: Gr3pme's Secret: Bug Bounty Note Taking Methodology

Episode 145: Gr3pme's Secret: Bug Bounty Note Taking Methodology

Episode 145: In this episode of Critical Thinking - Bug Bounty Podcast Brandyn lets us in on some of his notetaking tips, including his Templates, Threat Modeling, and ways he uses notes to help with ...

23 Okt 202528min

Episode 144: Google’s Top AI Hackers: Busfactor and Monke

Episode 144: Google’s Top AI Hackers: Busfactor and Monke

Episode 144: In this episode of Critical Thinking - Bug Bounty Podcast Joseph is joined by Vitor Falcão and Ciarán Cotter to discuss their success at the recent Mexico LHE, as well as their journey an...

16 Okt 202552min

Episode 143: New Cohost + Client-Side Gadgets, LHE Meta — Instant Global Admin in Entra!

Episode 143: New Cohost + Client-Side Gadgets, LHE Meta — Instant Global Admin in Entra!

Episode 143: In this episode of Critical Thinking - Bug Bounty Podcast Justin brings Brandyn back to announce him as our newest co-host. We chat about recent LHE experiences, and then break down some ...

9 Okt 20251h 4min

Populært innen Teknologi

lydartikler-fra-aftenposten
romkapsel
smart-forklart
teknisk-sett
elektropodden
energi-og-klima
nasjonal-sikkerhetsmyndighet-nsm
rss-ki-praten
rss-impressions-2
shifter
tomprat-med-gunnar-tjomlid
fornybaren
i-loopen
teknologi-og-mennesker
rss-heis
rss-ai-forklart
rss-digitaliseringspadden
rss-alt-som-gar-pa-strom
rss-alt-vi-kan
rss-anleggspraten