White Box Formulas - Vulnerable Coding Patterns (Ep. 54)

Episode 54: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joel are back with news items and new projects. Joel shares about his personal scraping project to gather data on bug bounty programs and distribution Next, they announce the launch of HackerNotes, a podcast companion that will summarize the main technical points of each episode. They also discuss a recent GitLab CVE and an invisible prompt injection, before diving into a discussion (or debate) about vulnerable code patterns.
Follow us on twitter at: @ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: [e-mail]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater & Teknogeek on twitter:
/ 0xteknogeek
/ rhynorater
====== Ways to Support CTBBPodcast ======
Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Gitlab CVE
github.com/Vozec/CVE-2023-7028
about.gitlab.com/releases/202...
Fix commit: gitlab.com/gitlab-org/gitlab/...
Invisible Prompt Injection
x.com/goodside/status/1745511...
Regex 101
regex101.com
Regex to Strings
www.wimpyprogrammer.com/regex...
Timestamps
(00:00:00) Introduction
(00:01:54) Joel’s H1 Data Scraping Research
(00:19:23) HackerNotes launch
(00:21:29) Gitlab CVE
(00:27:45) Invisible Prompt Injection
(00:33:52) Vulnerable Code Patterns
(00:37:51) Sanitization, but then modification of data afterward
(00:45:39) Auth check inside body of if statement
(00:48:15) sCheck for bad patterns with if, but then don't do any control flow
(00:50:21) Bad Regex
(01:00:36) Replace statements for sanitization
(01:04:32) Anything that allows you to call functions or control code flow in uncommon ways

[@odenko7680]

Ayo guys, this is why i love this channel
I was thinking about this topic "Vulnerable Coding Patterns" this week, then u guys put a video about it .
I will watch the video now, thank you

[@user-mo8uj9vq5u]

you guys are funny as hell and im learning tons.

[@opchannel8141]

I know am dumb, but what is that c.. something bug that you are talking in 1:11:11 ? I cannot find any info about it xD