Podcasts Technology Day[0] [bounty] Web Hackers vs. Cars and a Facebook Account Takeover

[bounty] Web Hackers vs. Cars and a Facebook Account Takeover

Published: Jan. 10, 2023, 9 p.m.

First episode of the new year, and we've got some cool stuff. Several authentication issues and "class pollution" in Python.

\n


\n

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/177.html

\n


\n

[00:00:00] Introduction

\n

[00:00:31] ReDoS "vulnerabilities" and misaligned incentives

\n

[00:17:14] Web Hackers vs. The Auto Industry

\n

[00:37:19] Prototype Pollution in Python

\n

 - Correction: We discuss a bit of a disagreement regarding calling the issue "Prototype Pollution" in Python, turns out we missed the fact the author calls it "Class Pollution" in the actual article which is a more fitting name.

\n

[00:50:26] [MK8DX] Improper verification of Competition creation allows to create "Official" competitions

\n

[00:56:36] 0 click Facebook Account Takeover and Two-Factor Authentication Bypass

\n

[01:01:18] How SAML works and some attacks on it

\n


\n

The DAY[0] Podcast episodes are streamed live on Twitch twice a week:

\n

 -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

\n

 -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits.

\n


\n

We are also available on the usual podcast platforms:

\n

 -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

\n

 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

\n

 -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

\n

 -- Other audio platforms can be found at https://anchor.fm/dayzerosec

\n


\n

You can also join our discord: https://discord.gg/daTxTK9