Client-side hacking techniques

A few weeks ago, I discovered what a cross-window forgery is. If you're unfamiliar with it, it'll be covered in next week's podcast. It's one of the methods used to exploit one-click confirmation screens, such as OAuth consent screens. Yet today, I...

Maxence Schmitt is back with another article about client-side path traversals. This time about constructing JSON payloads that can be interpreted as PDFs by the backend. The trick I liked the most is the one with bypassing the file unix command. By default, it uses a...

Did you know that this code would send a POST request without a Content-Type header? I didn’t. So if you have a backend code like this, you can use it to bypass the CSRF protection. Quick, simple, and unexpected edge case, just as we all love!...

And as if the cookie parsing logic from the previous article isn’t complex enough, you can add a $Version phantom cookie to the mix that downgrades the cookie parsing logic to some old standard....

I feel like even though cookies have been around forever, 2024 is the year where we all realize how complex cookie parsing is and how many things can go wrong. I think a lot of it can be attributed to MatanBer and his interviews in CTTB. But also, to articles like...

All of you should listen to all the Critical Thinking podcasts. That’s the only reason I’m not putting every single episode in the newsletter and I only do it once in a while. Like now when I’m sharing with you the episode with MatanBer about hacking browser...