A Hacker on Wall Street - JR0ch17 (Ep. 61)

Episode 61: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Jasmin Landry to share some stories about startup security, bug bounty, and the challenges of balancing both. He also shares his methodology for discovering OAuth-related bugs, highlights some differences between structured learning and self-teaching, and then walks us through a couple arbitrary ATO’s and SSTI to RCE bugs he’s found lately.
Follow us on twitter at: / ctbbpodcast
We're new to this podcasting thing, so feel free to send us any feedback here: [e-mail]
Shoutout to / realytcracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater & Teknogeek on twitter:
/ 0xteknogeek
/ rhynorater
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
Sign up for caido.io/ using the referral code CTBBPODCAST for a 10% discount.
Today’s Guest: Jasmin Landry
/ jr0ch17
Resources:
Dirty Dancing blog post
labs.detectify.com/writeups/a...
OAuth 2.0 Threat Model and Security Considerations
datatracker.ietf.org/doc/html...
OAuth 2.0 Security Best Current Practice
datatracker.ietf.org/doc/html...
Timestamps:
(00:00:00) Introduction
(00:02:20) Meta Tag + DomPurify Bug
(00:09:36) Jasmin's Origin story
(00:28:23) Full time Bug bounty challenges
(00:36:57) Career jumps in Security and current Role
(00:47:32) OAuth Bug methodology and cool bug stories
(01:02:35) Social Engineering and Bug Bounty
(01:13:41) Arbitrary ATO bug
(01:19:41) SSTI to RCE bug

[@jonathanfillion7890]

"It's written in Python 2.7" That's why I'm writting in bash now.

[@actuallyclover]

dude same my college started us out learning C as well, it was really troubling but you learn a lot. I had to take CSC 300 data structures 3 times to pass! I now have my bachelors degree in cyber operations.

[@odenko7680]

Great POD, and great stories from JR0ch17

[@AyushSingh-lp8wi]

Hey Justin, when will you invites zseano in your podcast? It will be a hell of podcast. I hope you will consider him too🙂

[@D4rK_Pr0xY]

FIRST - HELL YEAH Jasmin ! hehe

[@ankitsharma203]

damn! Messi seems to be a good hacker as well.

[@criticalthinkingpodcast]

Holy crap, you're right, he does look like Messi 😂

[@jr0ch17]

hahaha it's like the 10th time I've heard that in the past year or so!!!

[@Kalia_nullbit]

Barca to NASDAQ