Critical Thinking - Bug Bounty Podcast Episode 115: Mentee to Career Hacker - Mokusou (So Sakaguchi)
Mar 20, 2025
So Sakaguchi, a full-time bug bounty hunter known for his expertise in client-side vulnerabilities, joins the conversation. The highlights include sharing insights on a recent cross-site scripting bug discovered in a Facebook project and a deeper dive into security issues found in Google products. They emphasize the transformative journey from traditional employment to the rewarding world of bug bounties, showcasing the impact of mentorship. Plus, enjoy a surprise bonus segment in Japanese that adds a unique twist!
AI Snips
Chapters
Transcript
Episode notes
Facebook Excalibur XSS Discovery
- So Sakaguchi found a store-domained XSS bug in Facebook's open source project Excalibur.
- The XSS occurred when importing SVG-based objects from a specified host into the library preview, not in the canvas itself.
Persistence Pays Off
- So Sakaguchi spent days hunting a bug without success, then found a breakthrough on the fifth day.
- Persistence despite setbacks is essential in bug bounty hunting for discovering valuable bugs.
Client-Side Path Traversal Tip
- Use client-side path traversal on HTTP paths to arbitrarily control API endpoint targeting.
- Exploit lack of validation to hit otherwise restricted API endpoints for bug discovery.