118 - Fastly Infoleak, Samba OOB Access, and Pwning MacOS
A discussion heavy episode this week as we speculate about how some XNU code passed muster, and how to exploit a small overflow and weaponizing a large info-leak.
117 - Hacking Google Drive Integrations and XSS Puzzles
A "maybe" issue this week in Ruby's net/http library, some long chains leading to XSS, and a look at abusing parameter injection for SSRF in applications integrating with the Google Drive API.
116 - PwnKit, a Win32k Type Confusion, and Binary Ninja 3.0
Binary ninja 3.0 just dropped, lets talk about that, then into pwnkit and a couple kernel bugs, and ending this week off with a discussion about dealing with imposter syndrome.
115 - Zoho Auth Bypass, a Bogus Bug, and Leaking Microsoft Bug Reports
A few unique issues this week, routing issues in ManageEngine, a Little Snitch bypass, an undecodable characters leading to a denial of service.
114 - NetUSB RCE, a Kernel Heap Overflow, & an XNU UAF
Integer overflows and underflow this week, covering vulns from desktop Zoom clients, to kernel and some routers.
113 - Bypassing Box MFA & Bad AES Key Generation
A new security-related humble bundle, MFA bypass in Box, and a a few older style vulnerabilities: lfi2rce, allow-list bypass with an @ sign, and insecure random number seeds.
112 - Pwning Camera and Overflowing your Integers
Short episode this week, stack smashing, integer overflowing and a more logical issue. Ending off with a discussion about what to do when you're stuck on CTFs.
111 - Bad Code and Bad URLs
This week is a shorter episode looking at some bad code in mermaid.js and Moodle's Shibboleth plugin, and a bit of research regarding URL parsing issues.
110 - Rooting Ubuntu By Accident and Samsung Kernel Bugs
We are back for the first 2022 binary episode, and its all kernel. Obtaining root through an hours long exploit process on Ubuntu thanks to an invalid free, use-after-free in XNU due to bad locking, and some terrible code in Samsung S20 DSP kernel driver with multiple integer overflows.
109 - RocketChat RCE, Flickr, and a Critical Smart Contract Bug
More cases of developers make insecure assumptions and getting owned because of it. This week we've got a Flickr account takeover, escalating restricted SSRF into something more useful, and XSS to RCE in Rocket.Chat.