Critical Thinking - Bug Bounty Podcast

Episode 62: Frontend Language Oddities

10 snips
Mar 14, 2024
Exploring HTML quirks and bug bounty journeys, discussing the Yelp Cookie Bridge Bug and unique CSS exfiltration techniques. Delving into community engagement, bypassing authorization checks, and innovative CSS data extraction methods.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
INSIGHT

HTML Quirks

  • HTML has quirky functionalities like the form attribute on input elements.
  • This attribute emulates nested forms or places inputs outside a form but still posts data with it.
ANECDOTE

Iframe Clickjacking

  • Justin clickjacked a login button and exfiltrated data via postMessage.
  • He bypassed client-side JS state login limitations by framing two iframes, one for the target site and another with the same origin and name as the target's window.open, redirecting the opened window.
INSIGHT

Unexpected Input Element Behavior

  • Input elements with type=image function unexpectedly, triggering onerror handlers.
  • This behavior can bypass WAFs that don't recognize input elements as XSS vectors.
Get the Snipd Podcast app to discover more snips from this episode
Get the app