Sign up to save your podcasts
Or
Share Takeover A Facebook, SnapChat or JetBrains Account [Bounty Hunting]
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
![Day[0]](https://podcast-api-images.s3.amazonaws.com/corona/show/870239/logo_300x300.jpeg){kind=logo}
Takeover A Facebook, SnapChat or JetBrains Account [Bounty Hunting]
Multiple account takeover vulnerabilities in this episode with three cross-origin communication vulnerabilities in Facebook, an odd OTP endpoint in SnapChat and an open redirect in JetBrains leaking your JWT.
Links and summaries are available on our website: https://dayzerosec.com/podcast/takeover-a-facebook-snapchat-or-jetbrains-account.html
[00:00:00] Introduction + The Future
[00:08:37] How MarkMonitor left 60,000 domains for the taking
[00:17:21] Eye for an eye: Unusual single click JWT token takeover
[00:25:20] How I found a primitive but critical broken access control vulnerability in YouTrack…
[00:29:02] Ghost CMS 4.3.2 - Cross-Origin Admin Takeover
[00:33:47] Tale of $126k worth of bugs that lead to Facebook Account Takeovers
[00:47:15] Improper Authentication - any user can login as other user
[00:53:35] Illogical Apps - Exploring and Exploiting Azure Logic Apps
The DAY[0] Podcast has two weekly episodes that are streamed live on Twitch (https://www.twitch.tv/dayzerosec)
Mondays at 3pm Eastern we focus on vulnerabilities that would be of interest to bounty hunters, and on Tuesdays at 7:00pm Eastern we focus on low-level vulnerabilities.
You can also join our discord: https://discord.gg/daTxTK9 Or follow us on Twitter (@dayzerosec) to know when new releases are coming.
View all episodes
By dayzerosec
4
1010 ratings
Multiple account takeover vulnerabilities in this episode with three cross-origin communication vulnerabilities in Facebook, an odd OTP endpoint in SnapChat and an open redirect in JetBrains leaking your JWT.
Links and summaries are available on our website: https://dayzerosec.com/podcast/takeover-a-facebook-snapchat-or-jetbrains-account.html
[00:00:00] Introduction + The Future
[00:08:37] How MarkMonitor left 60,000 domains for the taking
[00:17:21] Eye for an eye: Unusual single click JWT token takeover
[00:25:20] How I found a primitive but critical broken access control vulnerability in YouTrack…
[00:29:02] Ghost CMS 4.3.2 - Cross-Origin Admin Takeover
[00:33:47] Tale of $126k worth of bugs that lead to Facebook Account Takeovers
[00:47:15] Improper Authentication - any user can login as other user
[00:53:35] Illogical Apps - Exploring and Exploiting Azure Logic Apps
The DAY[0] Podcast has two weekly episodes that are streamed live on Twitch (https://www.twitch.tv/dayzerosec)
Mondays at 3pm Eastern we focus on vulnerabilities that would be of interest to bounty hunters, and on Tuesdays at 7:00pm Eastern we focus on low-level vulnerabilities.
You can also join our discord: https://discord.gg/daTxTK9 Or follow us on Twitter (@dayzerosec) to know when new releases are coming.
More shows like Day[0]
View all
Critical Thinking - Bug Bounty Podcast
54 Listeners