Episode 131: SL Cyber Writeups, Bug Bounty Metastrategy, and Orphaned Github Commits

Episode 131: In this episode of Critical Thinking - Bug Bounty Podcast we're covering Christmas in July with several banger articles from Searchlight Cyber, as well as covering things like Raycast for Windows, Third-Person prompting, and touch on the recent McDonalds Leak
Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater and Rez0 on Twitter:
x.com/Rhynorater
x.com/rez0__
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
Today’s Sponsor is Adobe. Use code CTBBP0907 in your first report on Adobe Behance, Portfolio, Fonts or Acrobat Web, and earn a one-time 10% bonus reward!
====== Resources ======
v1 Instance Metadata Service protections bypass (amlw.dev/vrp/135276622)
Would you like an IDOR with that? Leaking 64 million McDonald’s job applications (ian.sh/mcdonalds)
How we got persistent XSS on every AEM cloud site, thrice (slcyber.io/assetnote-security-research-center/…)
Google docs now supports export as markdown (x.com/albinowax/status/1943306445149049178)
Abusing Windows, .NET quirks, and Unicode Normalization to exploit DNN (DotNetNuke) (slcyber.io/assetnote-security-research-center/…)
How I Scanned all of GitHub’s “Oops Commits” for Leaked Secrets (trufflesecurity.com/blog/guest-post-how-i-scan…)
Bug bounty, feedback, strategy and alchemy (zhero-web-sec.github.io/thoughts/bugbounty-fee…)
====== Timestamps ======
(00:00:00) Introduction
(00:05:39) Metadata Service protections bypass & Mcdonalds Leak
(00:12:30) Christmas in July with Searchlight Cyber Pt 1
(00:19:43) Export as Markdown, Raycast for Windows, & Third-Person prompting
(00:23:56) Christmas in July with Searchlight Cyber Pt 2
(00:27:39) GitHub’s “Oops Commits” for Leaked Secrets
(00:36:53) Bug bounty, feedback, strategy and alchemy