James Kettle: Pwning in Prod & How to do Web Security Research (Ep. 139) скачать в хорошем качестве

James Kettle: Pwning in Prod & How to do Web Security Research (Ep. 139)

Episode 139: In this episode of Critical Thinking - Bug Bounty Podcast Justin finally sits down with the great James Kettle to talk about HTTP Proxys, metagaming research, avoiding burnout, and why HTTP/1.1 must die! Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: [email protected] Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynorater https://x.com/rez0__ ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today’s Guest: https://x.com/albinowax https://jameskettle.com ====== This Week in Bug Bounty ====== Building an Android Bug Bounty lab https://www.yeswehack.com/learn-bug-b... Mobile Hacking Toolkit https://www.bugcrowd.com/blog/mobile-... ====== Resources ====== CVE-2022-22720 https://httpd.apache.org/security/vul... So you want to be a web security researcher? https://portswigger.net/research/so-y... Hunting Evasive Vulnerabilities: Finding Flaws That Others Miss by James Kettle    • Keynote Day 2 | Hunting Evasive Vulnerabil...   HTTP/1.1 Must Die! The Desync Endgame https://portswigger.net/research/talk... Practical HTTP Host header attacks https://www.skeletonscribe.net/2013/0... ====== Timestamps ====== (00:00:00) Introduction (00:05:01) Apache MITM-powered pause-based client-side desync (00:15:33) HTTP Proxys and Burp Suite HTTP/2 in Repeater (00:24:52) AI intagrations, life structure, and avoiding burnout (00:35:23) Client-side to server-side progression (00:47:39) The 'metagame' of security research (01:29:43) Host Header Attacks & HTTP/1.1 Must Die! (02:02:34) Is HTTP/2 the solution?