12 Febbraio 2025

INFORMAZIONI SU QUESTO EPISODIO

Top 10 Web Hacking Techniques and Windows Shadow Stacks

In this episode, we discuss the US government discloses how many 0ds were reported to vendors in a first-ever report. We also cover PortSwigger's top 10 web hacking techniques of 2024, as well as a deep dive on how kernel mode shadow stacks are implemented on Windows by Connor McGarr.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/272.html

[00:00:00] Introduction

[00:01:50] U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, Per First-Ever Report

[00:19:54] What Okta Bcrypt incident can teach us about designing better APIs

[00:40:08] Top 10 web hacking techniques of 2024

[00:55:03] Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows

[01:06:11] Accidentally uncovering a seven years old vulnerability in the Linux kernel

Podcast episodes are available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Tecnologia

Inglese

Stati Uniti

UsaAPIper recuperare questo episodio inJSON

IN QUESTO EPISODIO

okta bcrypt

connor mcgarr

Modifica queste etichette

TRASCRIZIONE 🔗

Are you the producer of this podcast? Add a podcast transcript

Need Audio-to-Text? Transcribe with Listen411 in Just 60 Seconds

CERCA TRA GLI EPISODI PASSATI

Cerca gli episodi passati di Day[0].

Incorpora questa barra di ricerca nel tuo sito web

ALTRI EPISODI IN QUESTO PODCAST

Recycling Exploits in MacOS and Pirating Audiobooks

18 Febbraio 2025

We cover a comical saga of vulnerabilities and variants from incomplete fixes in macOS, as well as a bypass of Chrome's miraclePtr mitigation against Use-After-Frees (UAFs). We also discuss an attack that abuses COM hijacking to elevate to SYSTEM through AVG Antivirus, and a permissions issue that …

01:17:06

SALVA

Clip

Unicode Troubles, Bypassing CFG, and Racey Pointer Updates

04 Febbraio 2025

On the web side, we cover a portswigger post on ways of abusing unicode mishandling to bypass firewalls and a doyensec guide to OAuth vulnerabilities. We also get into a Windows exploit for a use-after-free in the telephony service that bypasses Control Flow Guard, and a data race due to non-atomic…

00:41:29

SALVA

Clip

Path Confusion and Mixing Public/Private Keys

03 Marzo 2025

This week's episode features a variety of vulnerabilities, including a warning on mixing up public and private keys in OpenID Connect deployments, as well as path confusion with an nginx+apache setup. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podca…

00:59:34

SALVA

Clip

ZDI's Triaging Troubles and LibreOffice Exploits

25 Febbraio 2025

We discuss an 0day that was dropped on Parallels after 7 months of no fix from the vendor, as well as ZDI's troubles with responses to researchers and reproducing bugs. Also included are a bunch of filesystem issues, and an insanely technical linux kernel exploit chain. Links and vulnerability sum…

00:57:02

SALVA

Clip

Dichiarazione di non responsabilità: Il podcast e la grafica incorporati in questa pagina provengono da dayzerosec, che è di proprietà del suo proprietario e non è affiliato o approvato da Listen Notes, Inc.