Episode 113: Best Technical Takeaways from Portswigger Top 10 2024

Episode 113: In this episode of Critical Thinking - Bug Bounty Podcast we’re breaking down the Portswigger Top 10 from 2024. There’s some bangers in here!
Follow us on X at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts x.com/Rhynorater and Rez0 (x.com/rez0__) on X:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord (ctbb.show/discord)!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag (ctbb.show/merch)!
====== Resources ======
Hijacking OAUTH flows via Cookie Tossing (snyk.io/articles/hijacking-oauth-flows-via-coo…)
ChatGPT Account Takeover - Wildcard Web Cache Deception (nokline.github.io/bugbounty/2024/02/04/ChatGPT…)
OAuth Non-Happy Path to ATO (blog.voorivex.team/oauth-non-happy-path-to-ato)
CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js (codeanlabs.com/blog/research/cve-2024-4367-arb…)
DoubleClickjacking: A New Era of UI Redressing (paulosyibelo.com/2024/12/doubleclickjacking-wh…)
WorstFit: Unveiling Hidden Transformers in Windows ANSI (blog.orange.tw/posts/2025-01-worstfit-unveilin…)
SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level (media.defcon.org/DEF%20CON%2032/DEF%20CON%2032…)
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server (blog.orange.tw/posts/2024-08-confusion-attacks…)
Middleware, middleware everywhere – and lots of misconfigurations to fix (labs.detectify.com/ethical-hacking/middleware-…)
====== Timestamps ======
(00:00:00) Introduction
(00:09:56) Hijacking OAuth flows via Cookie Tossing
(00:17:30) ChatGPT Account Takeover
(00:25:28) OAuth Non-Happy Path to ATO
(00:29:24) CVE-2024-4367
(00:37:37) DoubleClickjacking:
(00:44:54) Exploring the DOMPurify library
(00:48:01) WorstFit
(00:56:29) Unveiling TE.0 HTTP Request Smuggling
(01:06:40) SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
(01:14:05) Confusion Attacks