logo
episode-header-image
May 2024
31m 13s

Episode 73: Sandboxed IFrames and WAF By...

Justin Gardner (Rhynorater) & Joseph Thacker (Rez0)
About this episode

Episode 73: In this episode of Critical Thinking - Bug Bounty Podcast we give a brief recap of Nahamcon and then touch on some topics like WAF bypass tools, sandboxed iframes, and programs redacting your reports.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Teknogeek on twitter:

https://twitter.com/0xteknogeek

https://twitter.com/rhynorater

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today's Sponsor - Project Discovery: https://nux.gg/podcast

Resources:

?. Tweet

https://x.com/garethheyes/status/1786836956032176215

NoWafPls

https://github.com/assetnote/nowafpls

Redacted Reports

https://x.com/deadvolvo/status/1790397012468199651

Breaking CORS

https://x.com/MtnBer/status/1794657827115696181

Sandbox-iframe XSS challenge solution

https://joaxcar.com/blog/2024/05/16/sandbox-iframe-xss-challenge-solution/

iframe and window.open magic

https://blog.huli.tw/2022/04/07/en/iframe-and-window-open/#detecting-when-a-new-window-has-finished-loading

domloggerpp

https://github.com/kevin-mizu/domloggerpp

Timestamps

(00:00:00) Introduction

(00:03:29) ?. Operator in JS and NoWafPls

(00:07:22) Redacting our own reports

(00:11:13) Breaking CORS

(00:17:07) Sandbox-iframes

(00:24:11) Dom hook plugins

Up next
Yesterday
Episode 143: New Cohost + Client-Side Gadgets, LHE Meta — Instant Global Admin in Entra!
Episode 143: In this episode of Critical Thinking - Bug Bounty Podcast Justin brings Brandyn back to announce him as our newest co-host. We chat about recent LHE experiences, and then break down some news. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and sugges ... Show More
1h 4m
Oct 2
Episode 142: Gr3pme's Full-Time Hunting Journey Update, Insane AI research, And Some Light News
Episode 142: In this episode of Critical Thinking - Bug Bounty Podcast Rez0 and Gr3pme join forces to discuss Websocket research, Meta’s $111750 Bug, PROMISQROUTE, and the opportunities afforded by going full time in Bug Bounty.Follow us on twitter at: https://x.com/ctbbpodcastGo ... Show More
54m 50s
Sep 25
Episode 141: Hacking the Pod - Google Docs 0-day & React CreateElement Exploits with Nick Copi (7urb0)
Episode 141: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Nick Copi to talk about CSPT, React, CSS Injections and how Nick hacked the pod.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any f ... Show More
1h 23m
Recommended Episodes
Feb 2024
E167: Nvidia smashes earnings (again), Google's Woke AI disaster, Groq's LPU breakthrough & more
(0:00) Bestie intros: Banana boat! (2:34) Nvidia smashes expectations again: understanding its terminal value and bull/bear cases in the context of the history of the internet (27:26) Groq's big week, training vs. inference, LPUs vs. GPUs, how to succeed in deep tech (49:37) Goog ... Show More
1h 20m
Nov 2023
Some 40 Series Getting Discontinued
► Thanks to ProtoArc for sponsoring today’s video! Use code UFD10 to get 10% off! Check out their HUB Mouse & XK01 Folding Keyboard here: https://geni.us/MGmAY & https://geni.us/lZnRV ► Check out today's hottest tech deals here: https://www.ufd.deals/ https://howl.me/ck1lO9QW ... Show More
22m 3s
Feb 2024
Empowering Innovation: Oxolo's €13M Funding Boosts AI-Driven Video Platform
Explore the transformative potential of Oxolo's €13M funding round, fueling innovation and pushing the boundaries of AI-driven video technology. Get on the AI Box Waitlist: https://AIBox.ai/ Join our ChatGPT Community: ⁠https://www.facebook.com/groups/739308654562189/⁠ Follow ... Show More
8m 18s
Feb 2024
Episode 119 - Dart Squad (Ft. 1Dime)
You are listening to this episode 1 week after it was released. To get episodes on time check out our Patreon!  Episode 120 is already available there: https://www.patreon.com/TheDeprogram Check out his work here:Controlled Opposition video: https://www.youtube.com/watch?v=7uPevW ... Show More
1h 16m
Feb 2024
730: Own Your Own PaaS
Scott and Wes talk about the benefits of owning your own PaaS (platform as a service), the main alternatives in the space, and ways to make passion projects more financially viable. Show Notes 00:00 Welcome to Syntax! 01:12 Brought to you by Sentry.io. 01:56 What is a PaaS? NGINX ... Show More
57m 58s
Jun 2023
Digital Identity w/ ENS Domains
Always mixing business and education, Khori has major experience managing for-profits and non-profits, with a big love for tech and always being an early adopter. Developing an interest in distributed ledger tech, and being passionate about decentralized inclusion and identity, h ... Show More
1h 17m
Dec 2022
Internet Booby Traps
Today’s podcast features 3 separate, unique stories about the dangers of the internet. The audio from all three stories has been pulled from our main YouTube channel, which is just called "MrBallen," and has been remastered for today's podcast.Story names, previews & links to ori ... Show More
32m 55s
Feb 2024
Episode 108 - Diving into Amazon Q Builder with Clare Liguori
🚀 Dive into the world of AI with Morgan Willis, Principal Cloud Technologist for AWS, as she interviews Clare Liguori, a Senior Principal Software Engineer at AWS and one of the visionaries behind Amazon Q. Discover the secrets behind this groundbreaking Generative AI conversati ... Show More
48m 6s
Feb 2024
ROLLUP: $ETH 3k! | TradFi Stonks ATHs | $STRK Now Live | Yuga Acquires PROOF
Last Week of February 2024 ------ 🏹 USE PODCAST24 FOR 10% OFF https://bankless.cc/Citizen2024   ------ 📣SUI | Register for Sui Basecamp https://bankless.cc/sui-basecamp    ------ 🎧Listen On Your Favorite Podcast Player:  https://bankless.cc/podcast  ------ BANKLESS SPONSOR TOO ... Show More
1h 10m
Feb 2020
USMLE Content Outline Topic: Small & Large Bowel Obstruction
A Rapid review of small & large bowel obstruction 
14m 17s