Episode 85: Practical Applications of DEFCON 32 Web Research

Critical Thinking - Bug Bounty Podcast

Content provided by Justin Gardner (Rhynorater) & Joseph Thacker (Rez0), Justin Gardner (Rhynorater), and Joseph Thacker (Rez0). All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Justin Gardner (Rhynorater) & Joseph Thacker (Rez0), Justin Gardner (Rhynorater), and Joseph Thacker (Rez0) or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.

8M ago 1:30:30

MP3•Episode home

Episode 85: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel talk through some of the research coming out of DEFCON, mainly from the PortSwigger team. Web timing attacks, cache exploitation, and exploits related to email protocols are all featured. Plus we also talk some fun Apache hacks from Orange Tsai

We're new to this podcasting thing, so feel free to send us any feedback here: [email protected]

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Find the Hackernotes: https://blog.criticalthinkingpodcast.io/

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

Check out our new SWAG store at https://ctbb.show/swag!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today’s Sponsor - ThreatLocker

Resources

Listen to the whispers

https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work

Splitting the email atom

https://portswigger.net/research/splitting-the-email-atom

Gotta cache 'em all

https://portswigger.net/research/gotta-cache-em-all

HTTP Garden

https://github.com/narfindustries/http-garden

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

https://blog.orange.tw/2024/08/confusion-attacks-en.html#%E2%9C%94%EF%B8%8F-2-2-2-Local-Gadget-to-XSS

Trusted API Types

https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API

Untrusted Types

https://github.com/filedescriptor/untrusted-types

Timestamps:

(00:00:00) Introduction

(00:09:45) 'Listen to the whispers'

(00:30:03) 'Splitting the email atom'

(00:58:42) 'Gotta cache 'em all'

(01:21:03) 'Confusion Attacks'

119 episodes

#Tech #Justin Gardner (Rhynorater