Episode 139: James Kettle - Pwning in Prod & How to do Web Security Research

Episode 139: In this episode of Critical Thinking - Bug Bounty Podcast Justin finally sits down with the great James Kettle to talk about HTTP Proxys, metagaming research, avoiding burnout, and why HTTP/1.1 must die!
Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater and Rez0 on Twitter:
x.com/Rhynorater
x.com/rez0__
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
Today’s Guest: x.com/albinowax
jameskettle.com
====== This Week in Bug Bounty ======
Building an Android Bug Bounty lab (yeswehack.com/learn-bug-bounty/android-lab-mob…)
Mobile Hacking Toolkit (bugcrowd.com/blog/mobile-hacking-resource-kit-…)
====== Resources ======
httpd.apache.org/security/vulnerabilities_24.h…
So you want to be a web security researcher? (portswigger.net/research/so-you-want-to-be-a-w…)
Hunting Evasive Vulnerabilities: Finding Flaws That Others Miss by James Kettle (youtu.be/skbKjO8ahCI?feature=shared&t=1252)
HTTP/1.1 Must Die! The Desync Endgame (portswigger.net/research/talks?talkId=32)
Practical HTTP Host header attacks (skeletonscribe.net/2013/05/practical-http-host…)
====== Timestamps ======
(00:00:00) Introduction
(00:05:01) Apache MITM-powered pause-based client-side desync
(00:15:33) HTTP Proxys and Burp Suite HTTP/2 in Repeater
(00:24:52) AI intagrations, life structure, and avoiding burnout
(00:35:23) Client-side to server-side progression
(00:47:39) The 'metagame' of security research
(01:29:43) Host Header Attacks & HTTP/1.1 Must Die!
(02:02:34) Is HTTP/2 the solution?