Episode 160: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and Brandyn. Chat through some news, Including a Cloudflare Zero-day, Turning List-Unsubscribe into an SSRF/XSS Gadget, &amp; Magic String Denial of Service in Claude. Follow us on twitter at: <a href="https://x.com/ctbbpodcast" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://x.com/ctbbpodcast</a>Got any ideas and suggestions? Feel free to send us any feedback here: <a href="mailto:info@criticalthinkingpodcast.io" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">info@criticalthinkingpodcast.io</a>Shoutout to<a href="https://twitter.com/realytcracker" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"> YTCracker</a> for the awesome intro music! ====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X:&nbsp;<a href="https://x.com/Rhynorater" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://x.com/Rhynorater</a><a href="https://x.com/rez0__" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://x.com/rez0__</a><a href="https://x.com/gr3pme" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://x.com/gr3pme</a> Critical Research Lab:<a href="https://lab.ctbb.show/" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://lab.ctbb.show/</a>&nbsp; ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at <a href="https://ctbb.show/discord" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://ctbb.show/discord</a>! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at <a href="https://ctbb.show/merch" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);">https://ctbb.show/merch</a>! Today’s Sponsor: Adobe.Use code CTBB040126, and get a 10% bonus on your bounty for any AI vulnerability which is mapped to the OWASP LLM top 10.Valid on Adobe Acrobat Web - AI Assistant / PDF Spaces / Content Creation and presentation features using ExpressAdobe Express AI Assistant.&nbsp;Valid through April 1st, 2026 Also we have a Google Cloud VRP Swag Bonus! Mention the podcast in any rewarded (cash or credit) VRP report submission before the end of April to receive bonus swag! ====== Resources ======Cloudflare Zero-dayhttps://fearsoff.org/research/cloudflare-acme Turning List-Unsubscribe into an SSRF/XSS Gadgethttps://security.lauritz-holtmann.de/post/xss-ssrf-list-unsubscribe/ Breaking Multi-Tenant Isolation in Heroku Postgreshttps://allistair.sh/blog/breaking-heroku-postgres/ Parse and Parse: MIME Validation Bypass to XSS via Parser Differentialhttps://lab.ctbb.show/research/parse-and-parse-mime-validation-bypass-to-xss-via-parser-differential Claude Magic String Denial of Servicehttps://x.com/Frichette_n/status/2013988503336415522 From WebView to Remote Code Injectionhttps://djini.ai/from-webview-to-remote-code-injection/ DOM XSS Is Not Dead: The Rise of Polyglot Payloadshttps://blogs.jsmon.sh/dom-xss-is-not-dead-the-rise-of-polyglot-payloads/ ====== Timestamps ======(00:00:00) Introduction(00:06:17) Cloudflare Zero-day &amp; Turning List-Unsubscribe into an SSRF/XSS Gadget(00:16:57) Breaking Multi-Tenant Isolation in Heroku Postgres &amp; CTBB Research(00:25:46) Claude Magic String Denial of Service &amp; From WebView to Remote Code Injection

<description>&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Episode 160: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and Brandyn. Chat through some news, Including a Cloudflare Zero-day, Turning List-Unsubscribe into an SSRF/XSS Gadget, &amp;amp; Magic String Denial of Service in Claude.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Follow us on twitter at: &lt;/span&gt;&lt;a href="https://x.com/ctbbpodcast" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://x.com/ctbbpodcast&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Got any ideas and suggestions? Feel free to send us any feedback here: &lt;/span&gt;&lt;a href="mailto:info@criticalthinkingpodcast.io" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;info@criticalthinkingpodcast.io&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Shoutout to&lt;/span&gt;&lt;a href="https://twitter.com/realytcracker" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt; YTCracker&lt;/a&gt;&lt;span style="background-color: transparent;"&gt; for the awesome intro music!&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;====== Links ======&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Follow your hosts Rhynorater, rez0 and gr3pme on X:&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;a href="https://x.com/Rhynorater" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://x.com/Rhynorater&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href="https://x.com/rez0__" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://x.com/rez0__&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a href="https://x.com/gr3pme" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://x.com/gr3pme&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Critical Research Lab:&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;a href="https://lab.ctbb.show/" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://lab.ctbb.show/&lt;/a&gt;&lt;span style="background-color: transparent;"&gt;&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;====== Ways to Support CTBBPodcast ======&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Hop on the CTBB Discord at &lt;/span&gt;&lt;a href="https://ctbb.show/discord" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://ctbb.show/discord&lt;/a&gt;&lt;span style="background-color: transparent;"&gt;!&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;You can also find some hacker swag at &lt;/span&gt;&lt;a href="https://ctbb.show/merch" target="_blank" style="background-color: transparent; color: rgb(17, 85, 204);"&gt;https://ctbb.show/merch&lt;/a&gt;&lt;span style="background-color: transparent;"&gt;!&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Today’s Sponsor: Adobe.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Use code CTBB040126, and get a 10% bonus on your bounty for any AI vulnerability which is mapped to the OWASP LLM top 10.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Valid on Adobe Acrobat Web - AI Assistant / PDF Spaces / Content Creation and presentation features using Express&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Adobe Express AI Assistant.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Valid through April 1st, 2026&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Also we have a Google Cloud VRP Swag Bonus! Mention the podcast in any rewarded (cash or credit) VRP report submission before the end of April to receive bonus swag!&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;====== Resources ======&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Cloudflare Zero-day&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://fearsoff.org/research/cloudflare-acme&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Turning List-Unsubscribe into an SSRF/XSS Gadget&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://security.lauritz-holtmann.de/post/xss-ssrf-list-unsubscribe/&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Breaking Multi-Tenant Isolation in Heroku Postgres&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://allistair.sh/blog/breaking-heroku-postgres/&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Parse and Parse: MIME Validation Bypass to XSS via Parser Differential&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://lab.ctbb.show/research/parse-and-parse-mime-validation-bypass-to-xss-via-parser-differential&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;Claude Magic String Denial of Service&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://x.com/Frichette_n/status/2013988503336415522&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;From WebView to Remote Code Injection&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://djini.ai/from-webview-to-remote-code-injection/&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;DOM XSS Is Not Dead: The Rise of Polyglot Payloads&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;https://blogs.jsmon.sh/dom-xss-is-not-dead-the-rise-of-polyglot-payloads/&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;====== Timestamps ======&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;(00:00:00) Introduction&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;(00:06:17) Cloudflare Zero-day &amp;amp; Turning List-Unsubscribe into an SSRF/XSS Gadget&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;(00:16:57) Breaking Multi-Tenant Isolation in Heroku Postgres &amp;amp; CTBB Research&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style="background-color: transparent;"&gt;(00:25:46) Claude Magic String Denial of Service &amp;amp; From WebView to Remote Code Injection&lt;/span&gt;&lt;/p&gt;</description>

Episode 160: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and Brandyn. Chat through some news, Including a Cloudflare Zero-day, Turning List-Unsubscribe into an SSRF/XSS Gadget, & Magic String Denial of Service in Claude.Follow ...

Critical Thinking - Bug Bounty Podcast

Episode 160: Cloudflare Zero-days & Mail Unsubscribing for XSS

Episode 160: Cloudflare Zero-days & Mail Unsubscribing for XSS

Description