logo
episode-header-image
May 2024
31m 13s

Episode 73: Sandboxed IFrames and WAF By...

Justin Gardner (Rhynorater) & Joseph Thacker (Rez0)
About this episode

Episode 73: In this episode of Critical Thinking - Bug Bounty Podcast we give a brief recap of Nahamcon and then touch on some topics like WAF bypass tools, sandboxed iframes, and programs redacting your reports.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today's Sponsor - Project Discovery: https://nux.gg/podcast

Resources:

?. Tweet

https://x.com/garethheyes/status/1786836956032176215

NoWafPls

https://github.com/assetnote/nowafpls

Redacted Reports

https://x.com/deadvolvo/status/1790397012468199651

Breaking CORS

https://x.com/MtnBer/status/1794657827115696181

Sandbox-iframe XSS challenge solution

https://joaxcar.com/blog/2024/05/16/sandbox-iframe-xss-challenge-solution/

iframe and window.open magic

https://blog.huli.tw/2022/04/07/en/iframe-and-window-open/#detecting-when-a-new-window-has-finished-loading

domloggerpp

https://github.com/kevin-mizu/domloggerpp

Timestamps

(00:00:00) Introduction

(00:03:29) ?. Operator in JS and NoWafPls

(00:07:22) Redacting our own reports

(00:11:13) Breaking CORS

(00:17:07) Sandbox-iframes

(00:24:11) Dom hook plugins

Up next
Nov 20
Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains
<p>Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.</p><p>Follow us on <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/ctbbpodcast">X</a></p><p>Go ... Show More
1h 2m
Nov 13
Episode 148: MCP Hacking Guide
Episode 148: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us a crash course on Model Context Protocol.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io ... Show More
32m 26s
Nov 6
Episode 147: Stupid Simple Hacking Workflow Tips
Episode 147: In this episode of Critical Thinking - Bug Bounty Podcast we're talking tips and tricks that help us in hacking that we really should’ve learned sooner.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback ... Show More
58m 48s
Recommended Episodes
Feb 2024
E167: Nvidia smashes earnings (again), Google's Woke AI disaster, Groq's LPU breakthrough & more
(0:00) Bestie intros: Banana boat! (2:34) Nvidia smashes expectations again: understanding its terminal value and bull/bear cases in the context of the history of the internet (27:26) Groq's big week, training vs. inference, LPUs vs. GPUs, how to succeed in deep tech (49:37) Goog ... Show More
1h 20m
Nov 2023
Some 40 Series Getting Discontinued
<p>► Thanks to ProtoArc for sponsoring today’s video! Use code UFD10 to get 10% off! Check out their HUB Mouse &amp; XK01 Folding Keyboard here: https://geni.us/MGmAY &amp; https://geni.us/lZnRV ► Check out today&#39;s hottest tech deals here: https://www.ufd.deals/ https://ho ... Show More
22m 3s
Feb 2024
Empowering Innovation: Oxolo's €13M Funding Boosts AI-Driven Video Platform
<p>Explore the transformative potential of Oxolo's €13M funding round, fueling innovation and pushing the boundaries of AI-driven video technology.</p> <p> Get on the AI Box Waitlist: <a href="https://aibox.ai/" target="_blank">https://AIBox.ai/</a> Join our ChatGPT Community: ⁠h ... Show More
8m 17s
Feb 2024
Episode 119 - Dart Squad (Ft. 1Dime)
<p>You are listening to this episode 1 week after it was released. To get episodes on time check out our Patreon!  <a href='https://www.patreon.com/posts/episode-103-ft-91756638'>Episode 1</a>20 is already available there: https://www.patreon.com/TheDeprogram<br/><br/>Check out h ... Show More
1h 16m
Feb 2024
730: Own Your Own PaaS
Scott and Wes talk about the benefits of owning your own PaaS (platform as a service), the main alternatives in the space, and ways to make passion projects more financially viable. Show Notes 00:00 Welcome to Syntax! 01:12 Brought to you by Sentry.io. 01:56 What is a PaaS ... Show More
57m 57s
Jun 2023
Digital Identity w/ ENS Domains
Always mixing business and education, Khori has major experience managing for-profits and non-profits, with a big love for tech and always being an early adopter. Developing an interest in distributed ledger tech, and being passionate about decentralized inclusion and identity, h ... Show More
1h 17m
Dec 2022
Internet Booby Traps
<p>Today’s podcast features 3 separate, unique stories about the dangers of the internet. The audio from all three stories has been pulled from our main YouTube channel, which is just called "MrBallen," and has been remastered for today's podcast.</p><p>Story names, previews & li ... Show More
32m 55s
Feb 2024
Episode 108 - Diving into Amazon Q Builder with Clare Liguori
🚀 Dive into the world of AI with Morgan Willis, Principal Cloud Technologist for AWS, as she interviews Clare Liguori, a Senior Principal Software Engineer at AWS and one of the visionaries behind Amazon Q. Discover the secrets behind this groundbreaking Generative AI conversati ... Show More
48m 6s
Feb 2024
ROLLUP: $ETH 3k! | TradFi Stonks ATHs | $STRK Now Live | Yuga Acquires PROOF
<p>Last Week of February 2024</p> <p>------<br /> 🏹 USE PODCAST24 FOR 10% OFF<br /> <a href= "https://bankless.cc/Citizen2024">https://bankless.cc/Citizen2024</a>  </p> <p>------<br /> 📣SUI | Register for Sui Basecamp<br /> <a href= "https://bankless.cc/sui-basecamp">https://ba ... Show More
1h 10m
May 2023
Monday Jumpstart
A little Monday motivation for when you have to start somewhere but you don’t know where. 
24m 11s