Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty. (Ep. 69)

Episode 69: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Johan Carlsson to hear about some updates on his bug hunting journey. We deep-dive a CSP bypass he found in GitHub, a critical he found in GitLab's pipeline, and also talk through his approach to using script gadgets and adapting to highly CSP'd environments. Then we talk about his transition to full-time bug hunting, including the goals he’s set, the successes and challenges, and his current focus on specific bug types like ReDoS and OAuth, and the serendipitous nature of bug hunting.
Follow us on twitter at: / ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: [e-mail]
Shoutout to / realytcracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater & Teknogeek on twitter:
/ 0xteknogeek
/ rhynorater
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.
Nuclei 3.2 Release: nux.gg/podcast
Today’s Guest:
/ joaxcar
joaxcar.com/blog/
Resources:
Github CSP Bypass:
gist.github.com/joaxcar/6e5a0...
CSP Validator:
cspvalidator.org/
Cross Window Forgery:
www.paulosyibelo.com/2024/02/...
Gitlab Crit:
gist.github.com/joaxcar/9419b...
Timestamps
(00:00:00) Introduction
(00:09:34) Github CSP Bypass
(00:38:48) Script Gadgets and growth through Gitlab
(00:53:53) Gitlab pipeline bug
(01:12:32) Full-time Bug Bounty

[@alvarobalada6528]

I was waiting for this since the beginning of this podcast

[@jub0bs]

Legend!

[@poopfeast_420]

neat episode number

[@arunharbola3006]

6*9 + 6 + 9 = Hey! It's the 69th Episode , Congratulations Guys . Awesome Work .

[@mylosovich24]

Love your guys pod so much, thank you for keeping these rolling [and in style]

[@theskelet4r]

Another awesome episode!

[@siddharthchhetry4218]

I understood half of the things which they said cool stuff. Need to learn more to understand the other half.

[@mr_robot1587]

👓+👓+👓+👓(me)
😂😂😂

[@TheCyberWarriorGuy]

:)