Critical Thinking - Bug Bounty Podcast Episode 106: Announcing our new cohost...
Jan 16, 2025
The podcast introduces a new co-host, Joseph Thacker, who shares his journey into full-time bug bounty hunting. Highlights include discussions on double-click jacking and its implications for web security. The hosts delve into the significance of automation in bug hunting, showcasing various tools and techniques. They also explore character set attacks and SVG XSS vulnerabilities, while emphasizing the need for robust defenses. Finally, a look ahead reveals plans for enhanced community engagement and original research initiatives in the coming years.
AI Snips
Chapters
Books
Transcript
Episode notes
Rez0's Bug Bounty Journey
- Rez0's bug bounty journey started by listening to and learning from established hackers like DoggyG and NahamSec.
- Winning best team at a Yahoo event with a critical vulnerability discovery boosted his confidence and led to more opportunities.
Target Selection Strategy
- Focus on less popular targets or technologies, like Google Cloud Platform (GCP), which are similar to more commonly targeted platforms like AWS.
- This reduces competition and increases the likelihood of finding unique vulnerabilities.
Double-Click Jacking
- Double-click jacking is a new UI redressing attack that bypasses existing defenses like X-Frame options and SameSite cookies.
- It involves deceiving users into performing sensitive actions with a double click, exploiting pop-under windows.
