Episode 168: XSSDoctor - Client-side Path Traversal Research

Episode 168: In this episode of Critical Thinking - Bug Bounty Podcast we’re getting a visit from the XSS Doctor. Jonathan joins us to go through his Client-side workflow, run labs, and diagnose some bugs live.

Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
x.com/Rhynorater
x.com/rez0__
x.com/gr3pme

Critical Research Lab:
lab.ctbb.show

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at ctbb.show/merch!

Today’s Guest: x.com/xssdoctor

====== Resources ======

The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
lab.ctbb.show/research/the-dot-dot-slash-that-…

URL validation bypass cheat sheet
portswigger.net/web-security/ssrf/url-validati…

====== Timestamps ======
(00:00:00) Introduction
(00:01:37) Home Automation AI Hack & E-signature bug stories
(00:12:15) E-signature bug
(00:17:01) XSS DR Intro and Bug Bounty Journey
(00:31:51) CSPT Workflows
(01:07:57) Wildcard Path Parameters
(01:30:34) Custom Sinks