Treceți offline cu aplicația Player FM !
Episode 59: Bug Bounty Gadget Hunting & Hacker's Intuition
Manage episode 402333447 series 3435922
Episode 59: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss the concept of gadgets and how they can be used to escalate the impact of vulnerabilities. We talk through things like HTML injection, image injection, CRLF injection, web cache deception, leaking window location, self-stored XSS, and much more.
Follow us on twitter at: @ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!
------ Links ------
Follow your hosts Rhynorater & Teknogeek on twitter:
------ Ways to Support CTBBPodcast ------
Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Resources:
Timestamps:
(00:00:00) Introduction
(00:03:31) Caido's New Features
(00:15:20) Nahamcon News and 5 week Bootcamp and pentest opportunity
(00:19:54) HTML Injection, CSS Injection, and Clickjacking
(00:33:11) Image Injection
(00:37:19) Open Redirects, Client-side path traversal, and Client-side Open Redirect
(00:49:51) Leaking window.location.href
(00:57:15) Cookie refresh gadget
(01:01:40) Stored XXS
(01:09:01) CRLF Injection
(01:13:24) 'A Place To Stand' in GraphQL and ID Oracle
(01:18:23) Auth gadgets, Web Cache Deception, & LocalStorage poisoning
(01:27:46) Cookie Injection & Context Breaks
87 episoade
Manage episode 402333447 series 3435922
Episode 59: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel discuss the concept of gadgets and how they can be used to escalate the impact of vulnerabilities. We talk through things like HTML injection, image injection, CRLF injection, web cache deception, leaking window location, self-stored XSS, and much more.
Follow us on twitter at: @ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!
------ Links ------
Follow your hosts Rhynorater & Teknogeek on twitter:
------ Ways to Support CTBBPodcast ------
Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Resources:
Timestamps:
(00:00:00) Introduction
(00:03:31) Caido's New Features
(00:15:20) Nahamcon News and 5 week Bootcamp and pentest opportunity
(00:19:54) HTML Injection, CSS Injection, and Clickjacking
(00:33:11) Image Injection
(00:37:19) Open Redirects, Client-side path traversal, and Client-side Open Redirect
(00:49:51) Leaking window.location.href
(00:57:15) Cookie refresh gadget
(01:01:40) Stored XXS
(01:09:01) CRLF Injection
(01:13:24) 'A Place To Stand' in GraphQL and ID Oracle
(01:18:23) Auth gadgets, Web Cache Deception, & LocalStorage poisoning
(01:27:46) Cookie Injection & Context Breaks
87 episoade
Alle afleveringen
×Bun venit la Player FM!
Player FM scanează web-ul pentru podcast-uri de înaltă calitate pentru a vă putea bucura acum. Este cea mai bună aplicație pentru podcast și funcționează pe Android, iPhone și pe web. Înscrieți-vă pentru a sincroniza abonamentele pe toate dispozitivele.