DEF CON moves venues, the Canadian government moves to ban Flipper Zero, and some XSS issues affect Microsoft Whiteboard and Meta's Excalidraw.
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/241.html
[00:00:00] Introduction
[00:00:33] DEF CON was canceled.
[00:16:42] Federal action on combatting auto theft
[00:39:03] Jenkins Arbitrary File Leak Vulnerability, CVE-2024-23897, Can Lead To RCE
[00:43:27] Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140)
[00:52:26] SSRF on a Headless Browser Becomes Critical!
[00:59:04] ChatGPT Account Takeover - Wildcard Web Cache Deception
[01:05:14] Differential testing and fuzzing of HTTP servers and proxies
[01:10:14] Hunting for Vulnerabilities that are ignored by most of the Bug Bounty Hunters
[01:19:38] Analyzing AI Application Threat Models
The DAY[0] Podcast episodes are streamed live on Twitch twice a week:
-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.
We are also available on the usual podcast platforms:
-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063
-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt
-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz
-- Other audio platforms can be found at https://anchor.fm/dayzerosec
You can also join our discord: https://discord.gg/daTxTK9
[binary] SoCs with Holes, Crow HTTP Bugs, and Bypassing Intel CET
[bounty] Web3 Universal XSS, Breaking BitBucket, and WAF Bypasses
[binary] An iOS Bug, Attacking Titan-M, and MTE Arrives
[bounty] Reading GitLab Hidden HackerOne Reports and Golang Parameter Smuggling
[binary] Fuchsia OS, Printer Bugs, and Hacking Radare2
[bounty] A Zoom RCE, VMware Auth Bypass, and GitLab Stored XSS
[binary] Pwn2Own, Parallels Desktop, and an AppleAVD Bug
[bounty] Stealing DropBox Google Drive Tokens, a GitLab Bug, and macOS "Powerdir" Vulnerability
[binary] Python 3 UAF and PS4/PS5 PPPoE Kernel Bug
[bounty] Deleting Rubygems, BIG-IP Auth Bypass, and a Priceline Account Takeover
[binary] Pwn2Owning Routers and Anker Eufy Bugs
[bounty] Cloudflare Pages, Hacking a Bank, and Attacking Price Oracles
[binary] NimbusPwn, a CLFS Vulnerability, and DatAFLow (Fuzzing)
[bounty] XSS for NFTs, a VMWare Workspace ONE UEM SSRF, and GitLab CI Container Escape
[binary] Getting into Vulnerability Research and a FUSE use-after-free
[bounty] A Struts RCE, Broken Java ECDSA (Psychic Signatures) and a Bad Log4Shell Fix
[binary] Another iOS Bug and Edge Chakra Exploitation
[bounty] Taking Over an Internal AWS Service and an Interesting XSS Vector
[binary] A subtle iOS parsing bug and a PHP use-after-free
[bounty] A Double-Edged SSRF, Pritunl VPN LPE, and a NodeBB Vuln
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
Lex Fridman Podcast