Spring4Shell, PEAR Bugs, and GitLab's Hardcoded Passwords [Bug Bounty Podcast]

If you like what I do in hacking and want to support, I invite you to visit our store to buy cheap and exclusive nfts: https://mintable.app/u/cha0smagick


This week we have some fun with some bugs that really shouldn't have passed code-review, we of course talk about Spring4Shell/SpringShell and dive into the decade long history of that bug, and a bit of discussion about triaging more subtle bugs. Links and vulnerability summaries for this episode are available at: https://ift.tt/F7Ra0UV [00:00:00] Introduction [00:00:29] [Stripe] CSRF token validation system is disabled [00:09:42] GitLab Account Takeover with Hardcoded Password [00:21:22] Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring [00:37:49] PHP Supply Chain Attack on PEAR [00:52:16] Finding bugs that doesn’t exists The DAY[0] Podcast episodes are streamed live on Twitch twice a week: - Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities - Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits. The audio-only version of the podcast is available on: -- Apple Podcasts: https://ift.tt/3APcDVj -- Spotify: https://ift.tt/XlxMVav -- Google Podcasts: https://ift.tt/qTaYkUH -- Other audio platforms can be found at https://ift.tt/WKNen94 You can also join our discord: https://ift.tt/xdcysGL Or follow us on Twitter (@dayzerosec) to know when new releases are coming. #BugBounty #EthicalHacking #InfoSec #Podcast

For more hacking info and tutorials visit: https://sectemple.blogspot.com/
Hello and welcome to the temple of cybersecurity. If you are looking for tutorials and all the news about the world of hacking and computer security, you have come to the right place. We invite you to subscribe to our newsletter in the box at the top and to follow us on our social networks:
Twitter: https://twitter.com/freakbizarro
Facebook: https://web.facebook.com/sectempleblogspotcom/
Discord: https://discord.gg/5SmaP39rdM

We also invite you to visit the other blogs in our network, where you can find something for every taste.
https://elantroposofista.blogspot.com/
https://gamingspeedrun.blogspot.com/
https://skatemutante.blogspot.com/
https://budoyartesmarciales.blogspot.com/
https://elrinconparanormal.blogspot.com/
https://freaktvseries.blogspot.com/

#hacking, #infosec, #tutorial, #bugbounty, #threathunting, #opensource, #pentest, #pentesting, >