Critical Thinking - Bug Bounty Podcast
Episode 70: NahamCon and CSP Bypasses Everywhere
May 9, 2024
Cybersecurity researcher Ben Sadeghipour discusses NahamCon news, LHEs, CI/CD, and drops cool CSP Bypasses. Topics include WordPress hacking, bug bounty rewards, sponsorships, maximizing bonuses, anticipation for NahamCon, Deppie tool, CSP bypass techniques, and bypassing Google CSP.
43:08
Episode guests
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- CSP bypasses on trusted domains can be exploited using JSONP callbacks, enabling manipulation of JavaScript actions.
- Innovative CSP bypass techniques on WordPress involve leveraging limited callback capabilities to trigger specific JavaScript functions.
Deep dives
Google Maps.JSONP CSP Bypass
Researchers discovered a CSP bypass on maps.googleapis.com using JSONP callbacks. By inserting a full function call into the callback via jasonp, they could trigger JavaScript actions within the trusted domain. This loophole can bypass standard security measures by leveraging trusted domains' functionality for nefarious actions.
Remember Everything You Learn from Podcasts
Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
