Critical Thinking - Bug Bounty Podcast

Episode 15: The Israeli Million-Dollar Hacker Apr 13, 2023

Show notes

Episode 15: In this episode of Critical Thinking - Bug Bounty Podcast we talk with the latest Million-Dollar bug bounty hunter: @naglinagli . He talks about his climb from $1,000 in bounties to $1,000,000, recon tips and tricks, and some bug reports that made the news and landed him the "Best Bug" award at a H1 Live Hacking event.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

Follow Nagli and his new startup Shockwave:

https://twitter.com/naglinagli

https://twitter.com/shockwave_sec

HackMD Collaborative Notes:

https://hackmd.io/

Ian Carroll's Airline Miles Website:

https://seats.aero

Nagli's Tweet in ChatGPT Web Cache Deception:

https://twitter.com/naglinagli/status/1639343866313601024

Timestamps:

(00:00:00) Intro

(00:04:40) Nagli’s Climb

(00:05:40) What kind of vulns do you look for?

(00:09:25) Working with other hackers

(00:10:20) Bug Bounty Hunter’s Guild

(00:12:35) Shockwave product

(00:14:12) Outsourcing tool development

(00:18:46) What got you started?

(00:21:13) Manual hacking vs recon suite + LHE focus

(00:25:00) How do you take notes

(00:29:42) Biggest things that you’ve learned over the past 2 years

(00:31:29) How do you ingest new techniques?

(00:31:50) Collaboration

(00:37:20) Justin Ranting about “Trained Eyes”

(00:40:18) Time spent coding vs hacking

(00:45:28) Travel and spending habits

(00:54:16) Grep is Nagli’s database

(00:56:20) Nagli’s ChatGPT Web Cache Deception

(00:58:44) What does your alerting look like?

(01:01:50) Nagli’s “Most Critical” SSRF

(01:04:30) Burp Active Scan

Episode 14: Mobile Hacking Dynamic Analysis w/ Frida + Random Hacker Stuff Apr 06, 2023

Show notes

Episode 14: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Dynamic Analysis within Mobile Hacking and a bunch of random hacker stuff. It's a good time. Enjoy the pod.

Follow us on Twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on Twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

Joel’s Alternative to UberTooth One:

https://www.amazon.com/Bluetooth-UD100-G03-Exchangeable-Bluesoleil-Microsoft/dp/B0161B5ATM

D3monDev’s Burp VPS Plug-in:

https://github.com/d3mondev/burp-vps-proxy

FireProx:

https://github.com/ustayready/fireprox

Joel’s Universal SSL De-pinning Frida Script:

https://gist.github.com/teknogeek/4dc35fb3801bd7f13e5f0da5b784c725

Command-line Fuzzy Finder:

https://github.com/junegunn/fzf

Justin’s two article recommendations for using Frida:

https://tinyurl.com/5n94d6ry

https://tinyurl.com/yfy3n5f5

Copy screen of physical device:

https://tinyurl.com/ymdrscm5

Flipper:

https://flipperzero.one/

BetterCap BLE Module:

https://www.bettercap.org/modules/ble/

Timestamps:

(00:00:00) Intro

(00:00:55) Hacker Chats

(00:03:27) Podcast Content Commentary

(00:04:09) SSRF Rebinding Error Confession

(00:06:02) Flipper Zero

(00:07:58) Bettercap BLE

(00:09:36) Sena USB Bluetooth Adapter

(00:12:41) Burp VPS Proxy Plugin

(00:13:55) Fireprox

(00:15:40) Dynamic Mobile Hacking

(00:17:40) Dynamic Analysis Overview

(00:18:18) Emulator Talk

(00:24:29) Joel’s APK Analysis Flow

(00:26:30) Cert Pinning

(00:32:17) Joel’s SSL Cert Pinning Script

(00:35:29) Hands-on look at Frida

(00:50:11) Frida on Non-rooted Devices

(00:58:22) Tracing Errors to Overwritable Functions

(01:00:39) Native Libraries

(01:09:18) GenyMobile Screen Mirroring Tool

(01:11:50) Justin’s Report of the Day and Custom SSL Pinning

(01:18:15) Joel’s First Ever Bug, Jailbreak Detection Bypass

Episode 13: How to Find a Good BBP + Acropalypse + ZDI Mar 30, 2023

Show notes

Episode 13: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how to determine if a bug bounty program is good or not from the policy page. We also cover some news including Acropalypse, ZDI's Pwn2Own Competition, Node's Request library's SSRF Bypass, and a new scanning tool by JHaddix.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

JHaddix AWSScrape Tool:

https://twitter.com/Jhaddix/status/1637140192728612865?s=20

Acropalypse Links:

https://twitter.com/ItsSimonTime/status/1636857478263750656

https://www.da.vidbuchanan.co.uk/blog/exploiting-acropalypse.html

https://twitter.com/David3141593/status/1638222624084951040

https://twitter.com/David3141593/status/1638293029059477505

SSRF Bypass in NodeJS:

https://blog.doyensec.com/2023/03/16/ssrf-remediation-bypass.html

ZDI's Pwn2Own:

https://twitter.com/thezdi

Kuzu7shiki's Awesome Pixiv Report:

https://hackerone.com/reports/1861974

https://twitter.com/kuzu7shiki

Some of the Programs we talk about:

https://hackerone.com/instacart

https://hackerone.com/semrush

https://hackerone.com/yahoo

https://hackerone.com/paypal

Episode 12: JHaddix on Hacker->Hacker CISO, OG Hacking Techniques, and Crazy Reports Mar 23, 2023

Show notes

Episode 12: In this episode of Critical Thinking - Bug Bounty Podcast we talk with Jason Haddix about his eclectic hacking techniques, Hacker -> Hacker CISO life, and some crazy vulns he found. This episode is chock full of awesome tips so give it a good listen!

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

Follow JHaddix on Twitter:

https://twitter.com/jhaddix

BuddoBot:

https://buddobot.com/

BC Hunt:

https://github.com/bugcrowd/HUNT/blob/master/README.md

One List For All:

https://github.com/six2dez/OneListForAll

AssetNote Wordlists:

https://wordlists.assetnote.io/

Backslash Powered Scanner:

https://portswigger.net/bappstore/9cff8c55432a45808432e26dbb2b41d8

Jason’s Handy Dandy Acronyms:

SSWLR - Sensitive Secrets Were Leaked Recently

Status
Size
Words
Lines
Response Time

COTS Software - Common Off-The-Shelf Software

Episode 11: CV$$, Web Cache Deception, and SSTI Mar 16, 2023

Show notes

Episode 11: In this episode of Critical Thinking - Bug Bounty Podcast we talk about CVSS (the good, the bad, and the ugly), Web Cache Deception (an underrated vuln class) and a sick SSTI Joel and Fisher found.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

MDSec Outlook Vuln:

https://twitter.com/MDSecLabs/status/1635791863478091778

Jub0bs User-Existance Oracle Tweet:

https://twitter.com/jub0bs/status/1633786349529513986

James Kettle's Tweet About BB ID Header Standardization:

https://twitter.com/albinowax/status/1635951506791755776

15K Snapchat Numeric IDOR:

https://hackerone.com/reports/1819832

Bug Bounty Reports Explained:

https://www.bugbountyexplained.com/

CVSS Calculator:

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

Web Cache Deception Write-up:

https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack.pdf

Episode 10: The Life of a Full-Time Bug Bounty Hunter + BB News + Reports from Mentees Mar 09, 2023

Show notes

Episode 10: In this episode of Critical Thinking - Bug Bounty Podcast we talk about what its like to be a full-time bug bounty hunter, a tonne of bug bounty news, and some great report summaries from Justin’s two mentees: Kodai and Soma.

Follow us on twitter at: https://twitter.com/ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

HackVertor https://portswigger.net/bappstore/65033cbd2c344fbabe57ac060b5dd100

Not_An_Aardvark (Teddy Katz) Blog: https://blog.teddykatz.com/

Tweets from PortSwigger Research:

https://twitter.com/PortSwiggerRes/status/1632742844535324677

https://twitter.com/PortSwiggerRes/status/1630221223874445314

https://twitter.com/PortSwiggerRes/status/1629131380473970688

HackerOne LHE Standards: https://www.hackerone.com/hackerone-community-blog/get-invited-how-live-hacking-event-invites-have-changed

Rez0 Bug Bounty Tweet: https://twitter.com/rez0__/status/1553371602770960384?t=NCr_esHcEts9PrcjxIZ5uw&s=19

Rojan’s Github Bug: https://twitter.com/uraniumhacker/status/1633199768263593984

Goodbye Daily Swig: https://portswigger.net/daily-swig/were-going-teetotal-its-goodbye-to-the-daily-swig

Gareth Heyes JavaScript for Hackers:https://leanpub.com/javascriptforhackers/

Episode 9: Headless Browser SSRF & RebindMultiA Tool Release + Web3 Bug Mar 02, 2023

Show notes

Episode 9: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Headless Browser SSRF and drop a tool called RebindMultiA. Joel also walks us through a web3 bug and we cover some bug bounty news from the past week. As always, we drop some bug bounty tips and give you some attack vectors to think about.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Truffle Security End-To-End Encryption Video:

https://www.youtube.com/watch?v=BBcZcoIZ1Jc

HackerOne World Cup:

https://www.hackerone.com/hackers/brand-ambassador-program

HackerOne World Cup Sign Up Form for USA:

https://docs.google.com/forms/d/e/1FAIpQLSeRQpH2y0J-opxlsz8dPkvnIu8BqC_DA3CJe_eFhTFroPwdcg/viewform

ChatGPT API:

https://openai.com/blog/introducing-chatgpt-and-whisper-apis

Megachad RobertMD GitHub Issue:

https://github.com/nccgroup/singularity/issues/2

Justin’s RebindMultiA Tool:

https://github.com/Rhynorater/rebindMultiA

Brandon Dorsey’s WhoNow Tool:

https://github.com/brannondorsey/whonow

NCC Group’s Singularity:

https://github.com/nccgroup/singularity

Chromium Disclosed Bugs:

https://chromium-disclosed-bugs.appspot.com/

NahamSec Talk on Headless Browser SSRF:

https://docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresen

Jonathan Bowman - LFI via <annotation>:

https://medium.com/@jonathanbouman/local-file-inclusion-at-ikea-com-e695ed64d82f

WASM Port Scanning:

https://github.com/avilum/portsscan

Jack Halon - Chrome Browser Exploitation:

https://twitter.com/jack_halon/status/1583957704930131968

DNSChef:

https://github.com/iphelix/dnschef

Episode 8: PostMessage Bugs, CSS Injection, and Bug Drops Feb 22, 2023

Show notes

Episode 8: In this episode of Critical Thinking - Bug Bounty Podcast we drop some critical bugs which leak raw credit card info. We also discuss some CSS Injection & PostMessage related techniques. It's a short one but a good one! Don't miss it!

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

CSS Escape Blog Post:

https://mathiasbynens.be/notes/css-escapes

Rez0’s blog on ChatGPT:

https://rez0.blog/hacking/2023/02/21/hacking-with-chatgpt.html

All the ways to get a reference to a frame (shoutout to @wcbowling for the article):

https://bluepnume.medium.com/every-known-way-to-get-references-to-windows-in-javascript-223778bede2d

CSS Painting API:

https://developer.mozilla.org/en-US/docs/Web/API/CSS_Painting_API

Import Chaining:

https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b

Episode 7: PortSwigger Top 10, TruffleSecurity Drama, and More! Feb 16, 2023

Show notes

Episode 7: In this episode of Critical Thinking - Bug Bounty Podcast we talk about PortSwigger's Top 10 Web Hacking Techniques of 2022 (link below), some drama surrounding TruffleSecurity's XSS Hunter, and, as always, some great bug bounty tips.

Sorry if the audio is a little rough around the edges this time, should be better than ever next time.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

PortSwigger's Top 10 Web Hacking Techniques of 2022:

https://portswigger.net/research/top-10-web-hacking-techniques-of-2022

Ian Carroll Cookie Monster:

https://github.com/iangcarroll/cookiemonster

Frans Rosen's postMessage Tracker Chrome Extension:

https://github.com/fransr/postMessage-tracker

Notes from Justin on postMessages:

https://rhynorater.github.io/postMessage-Braindump

Frans Rosen's research on nginx misconfiguration that are similar to #6:

https://blog.detectify.com/2020/11/10/common-nginx-misconfigurations/

"Mount" Wycheproof 😂:

https://github.com/google/wycheproof

https://en.wikipedia.org/wiki/Mount_Wycheproof

Nathan Davison - Abusing Hop-by-Hop headers:

https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers

Awesome example of client-side path traversal:

https://erasec.be/blog/client-side-path-manipulation/

Joohoi Ffuf 2.0:

https://infosec.exchange/@joohoi/109806822104162973

FeroxBuster:

https://github.com/epi052/feroxbuster

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis) Feb 09, 2023

Show notes

Episode 6: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with mobile hacking legend Joel Margolis and get the scoop on his approach to popping bugs on Android.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

Joel’s HackerOne Android Hacking Introduction:

https://t.ly/f87D

Android Pixel Lock Screen Bypass

https://t.ly/Q_qq

Exploiting Deeplink URLs: