Discussion this week around Chrome's Sanitizer API, and bypassing firewalls with webhooks and 0days (ModSecurity bypass), and a pre-auth BitBucket RCE.
Links and summaries are available at https://dayzerosec.com/podcast/153.html
[00:00:00] Introduction
[00:00:31] Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library
[00:10:31] Breaking Bitbucket: Pre Auth Remote Command Execution [CVE-2022-36804]
[00:16:25] [Chrome] Sanitizer API bypass via prototype pollution
[00:23:02] How we Abused Repository Webhooks to Access Internal CI Systems at Scale
[00:35:03] WAF bypasses via 0days
[00:42:40] Cloning internal Google repos for fun and… info?
[00:43:19] How to turn security research into profit: a CL.0 case study
[binary] SoCs with Holes, Crow HTTP Bugs, and Bypassing Intel CET
[binary] An iOS Bug, Attacking Titan-M, and MTE Arrives
[bounty] Reading GitLab Hidden HackerOne Reports and Golang Parameter Smuggling
[binary] Fuchsia OS, Printer Bugs, and Hacking Radare2
[bounty] A Zoom RCE, VMware Auth Bypass, and GitLab Stored XSS
[binary] Pwn2Own, Parallels Desktop, and an AppleAVD Bug
[bounty] Stealing DropBox Google Drive Tokens, a GitLab Bug, and macOS "Powerdir" Vulnerability
[binary] Python 3 UAF and PS4/PS5 PPPoE Kernel Bug
[bounty] Deleting Rubygems, BIG-IP Auth Bypass, and a Priceline Account Takeover
[binary] Pwn2Owning Routers and Anker Eufy Bugs
[bounty] Cloudflare Pages, Hacking a Bank, and Attacking Price Oracles
[binary] NimbusPwn, a CLFS Vulnerability, and DatAFLow (Fuzzing)
[bounty] XSS for NFTs, a VMWare Workspace ONE UEM SSRF, and GitLab CI Container Escape
[binary] Getting into Vulnerability Research and a FUSE use-after-free
[bounty] A Struts RCE, Broken Java ECDSA (Psychic Signatures) and a Bad Log4Shell Fix
[binary] Another iOS Bug and Edge Chakra Exploitation
[bounty] Taking Over an Internal AWS Service and an Interesting XSS Vector
[binary] A subtle iOS parsing bug and a PHP use-after-free
[bounty] A Double-Edged SSRF, Pritunl VPN LPE, and a NodeBB Vuln
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
A Prairie Home Companion: News from Lake Wobegon