Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)
Critical Thinking - Bug Bounty Podcast6 Juni 2024

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Roni "Lupin" Carta for a deep dive into supply chain attacks and dependency confusion. We explore the supply chain attacks, the ethical considerations surrounding maintainers and hosting packages on public registries, and chat about the vision and uses of his new tool Depi.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today's Sponsor - Project Discovery: https://nux.gg/podcast

Today’s Guest: https://x.com/0xLupin

Resources:

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

git-dump

https://github.com/tomnomnom/dotfiles/blob/master/scripts/git-dump

Depi

https://www.landh.tech/depi

Weak links of Supply Chain

https://arxiv.org/pdf/2112.10165

Timestamps:

(00:00:00) Introduction

(00:07:13) Overveiw of Supply Chain Flow

(00:15:14) Getting our Scope

(00:23:46) Depi

(00:29:12) Types of attacks and finding the 80/20

(00:45:06) Maintainer attacks

(01:10:40) Regestries, artifactories, and an npm bug

(01:31:51) Grafana NPX Confusion

Avsnitt(166)

Episode 46: The SAML Ramble

Episode 46: The SAML Ramble

Episode 46: In this episode of Critical Thinking - Bug Bounty Podcast, Justin is deep diving the topic of SAML (Security Assertion Markup Language), and walks through what it is and why it can be inti...

23 Nov 202343min

Episode 45: The OG Bug Bounty King - Frans Rosen

Episode 45: The OG Bug Bounty King - Frans Rosen

Episode 45: In this episode of Critical Thinking - Bug Bounty Podcast, we're thrilled to welcome Frans Rosén, an OG bug bounty hunter and co-founder of Detectify. We kick off with Frans sharing his jo...

16 Nov 20232h 36min

Episode 44: URL Parsing & Auth Bypass Magic

Episode 44: URL Parsing & Auth Bypass Magic

Episode 44: In this episode of Critical Thinking - Bug Bounty Podcast, the topic is URL structure, and Justin and Joel break down the elements that make up a URL and some common tips and tricks surrou...

9 Nov 20231h 11min

Episode 43: Caido - The Up-And-Coming HTTP Proxy

Episode 43: Caido - The Up-And-Coming HTTP Proxy

Episode 43: In this episode of Critical Thinking - Bug Bounty Podcast, we're joined by Emile from Caido, who shares his journey into the bug bounty and ethical hacking world. We kick off with a hilari...

2 Nov 20231h

Episode 42: Renniepak Interview & Intigriti LHE Recap

Episode 42: Renniepak Interview & Intigriti LHE Recap

Episode 42: In this episode of Critical Thinking - Bug Bounty Podcast, we're live from a hacking event in Portugal, and joined by the extremely talented René de Sain! He helps us cover a host of topic...

26 Okt 202359min

Episode 41: Mini Masterclass: Attack Vector Ideation

Episode 41: Mini Masterclass: Attack Vector Ideation

Episode 41: In this episode of Critical Thinking - Bug Bounty Podcast, Justin takes a break from his busy travel schedule to walk us through a few of his Attack Vector formulation strategies. We’re ke...

19 Okt 202317min

Episode 40: Bug Bounty Mentoring

Episode 40: Bug Bounty Mentoring

Episode 40: In this episode of Critical Thinking - Bug Bounty Podcast, it’s all about mentorships! Justin sits down with Kodai and So, two hackers he helped mentor, to discuss what worked and what did...

12 Okt 20231h 31min

Episode 39: The Art of Architectures

Episode 39: The Art of Architectures

Episode 39: In this episode of Critical Thinking - Bug Bounty Podcast, We're catching up on news, including new override updates from Chrome, GPT-4, SAML presentations, and even a shoutout from Live O...

5 Okt 20231h 21min

Populärt inom Teknik

uppgang-och-fall
elbilsveckan
market-makers
rss-elektrikerpodden
bilar-med-sladd
skogsforum-podcast
rss-veckans-ai
har-vi-akt-till-mars-an
natets-morka-sida
gubbar-som-tjotar-om-bilar
developers-mer-an-bara-kod
rss-laddstationen-med-elbilen-i-sverige
rss-technokratin
rss-uppgang-och-fall
rss-it-sakerhetspodden
ai-sweden-podcast
bli-saker-podden
rss-powerboat-sverige-podcast
rss-snacka-om-ai
rss-ai-med-katarina-gospic-och-viggo-cavling