Episode 171: Path-Scoped Cookie Hacks with Uppercase & Post-based Raw Protobuf XSS

Episode 171: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us some quick tips from his own hacking, including some clickjacking, using capital letters, and the potential value of leaking ages

Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
x.com/Rhynorater
x.com/rez0__
x.com/gr3pme

Critical Research Lab:
lab.ctbb.show

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at ctbb.show/merch!

Sponsored by ThreatLocker - Ringfencing
criticalthinkingpodcast.io/tl-rf

====== Resources ======

The ultimate Bug Bounty guide to OS command injection vulnerabilities
yeswehack.com/learn-bug-bounty/ultimate-guide-…

Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation
yeswehack.com/news/auth-bypass-wordpress-azure…

Aituglo featured on YWH
yeswehack.com/community/developer-aituglo-bug-…

Adobe will be sponsoring Ekoparty in Miami and hosting a live hacking event on May 21st
ekoparty.org/ekoparty-miami-2026-super-live-ha…

====== Resources ======

SVG clickjacking
lyra.horse/blog/2025/12/svg-clickjacking

====== Timestamps ======
(00:00:00) Introduction
(00:06:35) Protobuff XSS
(00:12:51) Leaking Age & CSPTs
(00:15:59) Capital Letters and Clickjacking