Day[0]

Not a lot of interesting binary exploitation topics for this week, we've got a DHCPv6 service vuln, and a fun idea to use a timing side-channel to improve exploit stability. Then we end with a discussion about Rust coming the Windows operating system, what Rust means for the future of exploit development and vulnerability research and the value of memory corruption in Windows. Links and vulner...

On this weeks bug bounty podcast we take a look at a few interesting issues. While they are all patched, there is reason to believe they'd all creep up in other applications too. First up is an RCE due to nested use of an escaped string. Second a fgets loop that doesn't account for long lines. A XML signature verification tool with a deceptive interface, and last a look at how Bash's p...

This week's binary exploitation episode has some pretty solid bugs. A string escaping routine that goes out of bounds, a web-based information disclosure. And a couple kernel issues, one in the Windows registry, a logical bug leading to memory corruption, and an AppleSPU out of bounds access. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/20...

For this week's bug bounty podcast We start off with a bit of a unique auth bypass in a firewall admin panel. We've also got a couple desktop-based software bugs, with a Docker Desktop privilege escalation on windows, and a chfn bug. We've also got a couple escalation techniques, one for Azure environments, and another trick for exploiting semi-controlled file-writes. Links and vulnera...

We start with a hardware/glitching attack against the Wii U, then lets talk about integer overflows. We've got three integer overflows this week that lead to buffer overflows in different ways. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/204.html [00:00:00] Introduction [00:00:19] Spot the Vuln - Easy as ABC [00:06:18] de_Fuse, the One Tr...

Some fun issues this week as we explore code execution in Synthetics Recorder stemming from a comment in the code. An auth bypass in Pentaho leading to RCE via SSTI, car theft via CAN bus message injection, and how to become a cluster admin from a compromised pod in AWK Elastic Kubernetes Service. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/2...

Just a few bugs this week, a classic buffer overflow because of an unbounded copy in SNIProxy. mast1c0re Part 2 with a few more easy vulnerability but some more complex and difficult exploitation. And a Samsung NPU in-the-wild double free. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/202.html [00:00:00] Introduction [00:00:24] Spot The Vuln -...

Some audio issues this week, sorry for the ShareX sound. But we have a few interesting issues. A curl quirk that it might be useful to be aware of, Azure Pipelines vulnerability abusing attacker controlled logging. A look at a pretty classic Android/mobile bug, and a crazy auth misconfiguration (BingBang). Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/...

Its our 200th episode, and we've got some stats from our first 200 episodes. Then we talk some Pwn2Own policy changes, a couple memeable overflows, and some new anti-ROP mitigations on OpenBSD. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/200.html [00:00:00] Introduction [00:00:52] Spot the Vuln - Just a Coupon [00:04:56] 200th Episode [00...

We are back with more discussion about applying AI/ChatGPT to security research, but before that we have a few interesting vulnerabilities. An OTP implementation that is too complex for its own good, a directory traversal leading to a guest to host VM escape, and server-side mime-sniffing. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/199.html...

We've got a pretty nice root/super-use check bypass in XNU this week, and a sort of double fetch issue in Intel's SMM leading to a potential privilege escalation into the Management system. We've also got a few meme-able Shannon Baseband issues and some tough to exploit out of bound reads in MIT Kerberos V5. Links and vulnerability summaries for this episode are available at: https://d...

Recovering data from a cropped image (thanks to an undocumented API change, bypassing an origin check with an emoji, and a trivial SSRF filter bypass all in this week's bug bounty podcast. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/197.html [00:00:00] Introduction [00:00:32] SSRF Cross Protocol Redirect Bypass [00:08:08] EmojiDeploy: Smi...

Some simple, but interesting vulnerabilities. A use-after-free because of wrong operation ordering, an interesting type confusion, an integer underflow and some OOB access in TPM 2.0 reference code. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/196.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Just be Positive [00:03:42] oss-sec: Linu...

A few varied issues this week, exploiting an apparently unexploitable CRLF injection, organization secrets exposure in GitHub, and a Jenkins XSS. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/195.html [00:00:00] Introduction [00:00:25] Abusing Hop-by-Hop Header to Chain A CRLF Injection Vulnerability [00:04:26] HubSpot Full Account Takeover in...

Just one vulnerability this week about hacking the Nintendo DSi browser, but we have a good discussion about fuzzing and a new paper "autofz". Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/194.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Checking your Numbers [00:03:23] autofz: Automated Fuzzer Composition at Runtime [00:14:52] Alex...

This episode covers a lot of ground, from an insecure OAuth flow (Booking.com) to a crazy JSON injection and fail-open login system (DataHub) to hacking Bluetooth smart locks (Megafeis-palm). And even a new ImageMagick trick for a local file read. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/193.html [00:00:00] Introduction [00:00:26] Travelin...

Just a couple issues this week, a cache coherency issue because the functions used to flush changes were not implemented on AARCH64. The second was using the "world's worst fuzzer" to find some bugs. Dumb fuzzer, but it worked. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/192.html [00:00:00] Introduction [00:00:24] Spot the Vuln - Targeting [0...

Parameter pollution for an auth bypass, SQL injection in an ORM, CRLF injection for a WAF bypass...this episode has a great mix of issues. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/191.html [00:00:00] Introduction [00:00:26] OpenEMR - Remote Code Execution in your Healthcare System [00:10:13] Vulnerability write-up - "Dangerous assumptions"...

This week we talk about more Rust pitfalls, and fuzzing cURL. Then we have a couple bugs, one involving messing with the TCP stack to reach the vulnerable condition. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/190.html [00:00:00] Introduction [00:00:27] Spot the Vuln - Insecure by Default [00:02:20] cURL audit: How a joke led to significant f...

A variety episode this week with some bad cryptography in PHP and Azure, information disclosure in suid binaries, request smuggling in HAProxy, and some research on testing for server-side prototype pollution. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/189.html [00:00:00] Introduction [00:00:22] PHP :: Sec Bug #81744 :: Password_verify() alw...

Few discussions this week, from using ASAN for effectively, to vulnerabilities in Rust code, and some discussion about exploiting the OpenSSH double free. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/188.html [00:00:00] Introduction [00:00:31] Spot the Vuln - Too Soft [00:04:19] One Weird Trick to Improve Bug Finding With ASAN [00:08:27] Rustp...

Bit slow this week, so we talk about the Top Web-hacking techniques of 2022, and some TruffleSec/XSS Hunter drama before so we cover a blockchain verification bug, and a simple path traversal to SSTI and RCE chain. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/187.html [00:00:00] Introduction [00:00:32] Top 10 web hacking techniques of 2022 [00...

First, we take a look at some positive changes to OSS Fuzz, then we dive into some vulnerabilities. This includes an XNU heap out-of-bounds write vulnerability, a Chrome heap-based overflow vulnerability, and an out-of-bounds read in cmark-gfm that, while probably not exploitable, is still intriguing. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podca...

Is it possible to escalate a self-XSS into an account takeover? Perhaps, we take a look at some potential options by abusing single-sign on. Then we take a look at a few Facebook/Meta authentication issues, and a deserialization trick to increase the usable classes in PHP. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/185.html [00:00:00] Introd...

Discussion heavy episode this week, talking about KASAN landing on Windows, shuffling gadgets to make ROP harder, and a paper about automatic exploit primitive discovery. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/184.html [00:00:00] Introduction [00:00:26] Spot the Vuln - Just the Data [00:04:20] Introducing kernel sanitizers on Microsoft p...