Critical Thinking - Bug Bounty Podcast

Episode 64: .NET Remoting, CDN Attack Surface, and Recon vs Main App

8 snips
Mar 28, 2024
.NET Remoting exploitation, Dom Purify bypass, Cloudflare CDN-CGI endpoint, JavaScript deobfuscation, bug bounty collaboration, impactful POCs, hiding XSS payloads with URL updates
Ask episode
AI Snips
Chapters
Transcript
Episode notes
ANECDOTE

RCEs from .NET Remoting Research

  • Justin listened to Shubham Shah's tweet about .NET remoting research.
  • This led to multiple remote code executions (RCEs) on a target.
INSIGHT

.NET Remoting Explained

  • .NET remoting lets you call functions on a different server, similar to Java RMI.
  • Exploiting it over HTTP, often the least secured method, previously required an arbitrary URL string.
ADVICE

Exploiting .NET Remoting

  • Leverage error stack traces in .NET remoting to leak the object reference URL.
  • Use Code White's GitHub repo for exploiting this, linked in the show notes.
Get the Snipd Podcast app to discover more snips from this episode
Get the app