AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
Critical Thinking - Bug Bounty Podcast
Episode 96: Cookies & Caching with MatanBer
Nov 7, 2024
Explore advanced cookie parsing techniques and the unique quirks of Safari's cookie handling. Dive into the complexities of cookie exploitation and how cookie order impacts security. Discover insights on Capture the Flag challenges, particularly around caching vulnerabilities. Learn about the risks of cache poisoning and the implications of XSS vulnerabilities, emphasizing the importance of effective cookie management. Uncover practical strategies for manipulating cookies and safeguarding web applications against these threats.
49:09
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Advanced cookie manipulation techniques, such as cookie tossing and Safari's unique handling, can lead to significant web security vulnerabilities.
- Exploiting caching behavior in web applications reveals new avenues for XSS attacks, illustrating the complexities of service workers and data access restrictions.
Deep dives
Converting Partial Cookie Injection
The episode discusses how to effectively convert a partial cookie injection into a full cookie injection, allowing for total control over the injected key. It highlights methods used in specific environments, particularly in Java, where unique cookie parsing logic can lead to vulnerabilities. By manipulating cookie order using a technique called cookie tossing, attackers can prioritize their malicious cookies by setting them in the right sequence and utilizing quotes to comment out preceding cookies. This approach emphasizes the complexities and nuances involved in exploiting cookie behavior, particularly in legacy systems.
Get the Snipd
podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any
moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share
& Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode