Episode 28: Surfin' with CSRFs

1

Introduction

00:00 • 3min

2

The Reality of C-Surfing

02:52 • 2min

3

The Caveat to JavaScript Bridges

04:29 • 2min

4

Carff: A Cross-App Request for a Tree

06:05 • 2min

5

Joel Solo Interviews at DEF CON

07:42 • 2min

6

How to Use Curl to Test a SQL Map

09:29 • 2min

7

How to Market a Chrome Extension for One Cent Per User

11:16 • 2min

8

Chrome Extensions for Service Workers

12:55 • 2min

9

How to Remove XSS Auditor From Chrome

15:01 • 2min

10

JS Weasel: A Cool Product to Try Out

16:49 • 4min

11

How to Use Office-Gated JavaScript to Hack Your App

20:32 • 2min

12

How to Make Money With a Bug Bounty

22:03 • 2min

13

The Importance of Internal Brain Patterns in JavaScript

23:43 • 2min

14

The Most Rojan Thing I've Ever Heard

25:24 • 2min

15

C Surfs: A Vulnerability That's Not the Case

27:27 • 3min

16

The Importance of C Surfs

30:29 • 3min

17

How to Use a Two Minute Window to Get a Cookie Reset

33:31 • 3min

18

How to Bypass GitHub's a Lot Flow

36:27 • 4min

19

Rails: A Quirk to Know About

40:11 • 2min

20

Rails and Head Requests in Rails

42:03 • 2min

21

Exploitation Techniques for Mobile C Surf

43:47 • 2min

22

How to Fix a CSERF Bug

45:50 • 2min

23

CSRF: How to Check Your Cookies

48:18 • 2min

24

Ruby on Rails: A Weird Rails Configuration

50:33 • 3min

25

How to Find Vulnerabilities in an Application

53:59 • 3min

26

The Limits of CSRF Vulnerability

56:43 • 3min

27

How to Change Your Post Request to Get Request

59:32 • 2min

28

How to Send a Request With the Null in the Origin With Nowadays Same Site Stuff

01:01:59 • 3min

29

How to Bypass the C Surf Check and Get the Bug Fixed

01:04:30 • 2min

30

C Surf: How to Get an Account on an Obvious Domain

01:06:04 • 5min

31

How to Use TikTok to Scan QR Codes Within an App

01:10:36 • 2min

32

The JavaScript Bridge and the Attack Scenario

01:12:23 • 3min

33

How to Be a Bald and Eyebrowless Nohamsec

01:15:24 • 3min