Player FM 앱으로 오프라인으로 전환하세요!
Episode 72: Research TLDRs & Smuggling Payloads in Well Known Data Types
Manage episode 419795079 series 3435922
Episode 72: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!
Follow us on twitter at: @ctbbpodcast
Shoutout to YTCracker for the awesome intro music!
------ Links ------
Follow your hosts Rhynorater & Teknogeek on twitter:
------ Ways to Support CTBBPodcast ------
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Today's Sponsor - Project Discovery: https://nux.gg/podcast
Resources:
PDF.JS Bypass to XSS
https://github.com/advisories/GHSA-wgrm-67xf-hhpq
https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/
Better Bounty Transparency for hackers
Smuggling payloads in phone numbers
Github Enterprise send() bug
https://x.com/creastery/status/1787327890943873055
https://x.com/Rhynorater/status/1788598984572813549
Timestamps:
(00:00:09) Introduction
(00:03:20) PDF.JS XSS and NextJS SSRF
(00:12:52) Better Bounty Transparency
(00:20:01) IPV6 Research and Phone Number Payloads
(00:28:20) Community Highlight and Automatic Plugin CVE-2024-27956
(00:33:26) DomPurify Bypass and Github Enterprise send() bug
(00:46:12) Caido cookie and header extension updates
94 에피소드
Manage episode 419795079 series 3435922
Episode 72: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!
Follow us on twitter at: @ctbbpodcast
Shoutout to YTCracker for the awesome intro music!
------ Links ------
Follow your hosts Rhynorater & Teknogeek on twitter:
------ Ways to Support CTBBPodcast ------
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Today's Sponsor - Project Discovery: https://nux.gg/podcast
Resources:
PDF.JS Bypass to XSS
https://github.com/advisories/GHSA-wgrm-67xf-hhpq
https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/
Better Bounty Transparency for hackers
Smuggling payloads in phone numbers
Github Enterprise send() bug
https://x.com/creastery/status/1787327890943873055
https://x.com/Rhynorater/status/1788598984572813549
Timestamps:
(00:00:09) Introduction
(00:03:20) PDF.JS XSS and NextJS SSRF
(00:12:52) Better Bounty Transparency
(00:20:01) IPV6 Research and Phone Number Payloads
(00:28:20) Community Highlight and Automatic Plugin CVE-2024-27956
(00:33:26) DomPurify Bypass and Github Enterprise send() bug
(00:46:12) Caido cookie and header extension updates
94 에피소드
Alle afleveringen
×플레이어 FM에 오신것을 환영합니다!
플레이어 FM은 웹에서 고품질 팟캐스트를 검색하여 지금 바로 즐길 수 있도록 합니다. 최고의 팟캐스트 앱이며 Android, iPhone 및 웹에서도 작동합니다. 장치 간 구독 동기화를 위해 가입하세요.