TL;DR ¶ jub0bs/cors v0.5.0 now lets you handle CORS-configuration errors programmatically. This feature should be of interest to you if you’re a multi-tenant service provider and you let your tenan...
Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an over...
Hacking Subaru, Being a FOSS Developer in Prison, Google’s Patch Rewards Program, Claude is Hiring ASEs, Obsidian 2024 Gems Of The Year Winners, NixOS Wiki Beef
Justin and Joseph are tackling the subject of cross-origin security headers. They also cover some news items including Google’s OAuth login flaw, RAINK, and gift card hacking
On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United St...
In this post, I will introduce the “cookie sandwich” technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version coo...
Editing with LLMs, 80% faster Ax framework, AI-first Director of Finance, Obsidian 2024 Gems of the Year Voting, 8 Lessons from Red Teaming 100 Gen AI Products, The Big Ass Data Broker Opt-Out List...
We announce our new co-host of the podcast: Joseph Thacker Aka Rez0! We also cover some cool research including doubleclickjacking, character set attacks, SVG XSS, CSPT and a bunch more. Check it o...
Google white paper on AI Agents, HuntDB: track and monitor CVEs, 2024 Good Tech Awards, Bugcrowd HackerCup ‘24 Winners Interview, InternetCTF, How To Become a Hacker, and more…
We’re back with another Best-of episode recapping some of our top moments of the year. This one captures some of the cooler tips and takeaways from this years episodes along with links to the origi...