Episode 118: Hacking Happy Hour: 0days on Tap and SQLi Shots

Episode 118: In this episode of Critical Thinking - Bug Bounty Podcast we cover a host of news, including clientside tidbits, “Credentialless” iframes, prototype pollution, and what constitutes a polyglot in llms.txt.
Follow us on X (x.com/ctbbpodcast)
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow x.com/Rhynorater and Rez0 (x.com/rez0__)on X
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
You can also find some hacker swag (ctbb.show/merch)!
====== Resources ======
p4fg passed 1 Million! (hackerone.com/p4fg)
/reports/:id.json - $25K Crit (hackerone.com/reports/3000510)
Hacking Crypto pt1 (bugcrowd.com/blog/hacking-crypto-part-i)
The art of payload obfuscation (yeswehack.com/learn-bug-bounty/payload-obfusca…)
Analyzing the Next.js Middleware Bypass (slcyber.io/assetnote-security-research-center/…)
Nahamsec's Merch store (merch.nahamsec.com)
llms.txt polyglot prompt injection (josephthacker.com/llms.txt)
React Router and the Remix’ed path (zhero-web-sec.github.io/research-and-things/re…)
Pre-Authentication SQL Injection in Halo ITSM (slcyber.io/assetnote-security-research-center/…)
Pwning Millions of Smart Weighing Machines (spaceraccoon.dev/pwning-millions-smart-weighin…)
MCP Server Oauth (x.com/tweetsbycolin/status/1905268522357571663)
Cline (x.com/cline/status/1907186512506306572)
“Credentialless” iframes (developer.mozilla.org/en-US/docs/Web/Security/…)
Tiny XSS Payloads (tinyxss.terjanq.me)
Types of Pollution (discord.com/channels/1110206757227216916/11747…)
====== Timestamps ======
(00:00:00) Introduction
(00:05:56) Next.js Middleware bypass & Polyglots in llms.txt
(00:16:35) CPDoS on React Router
(00:24:26) Loose Types Sink Ships & Pwning Smart Scales
(00:32:30) MCP Server Oauth & Cline
(00:39:40) Clientside Tidbits & Prototype Pollutions