189 - Compromising Azure, Password Verification Fails, and Readline Crime [Bug Bounty Podcast]

A variety episode this week with some bad cryptography in PHP and Azure, information disclosure in suid binaries, request smuggling in HAProxy, and some research on testing for server-side prototype pollution.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/189.html

[00:00:00] Introduction
[00:00:22] PHP :: Sec Bug #81744 :: Password_verify() always return true with some hash
[00:11:25] Readline crime: exploiting a SUID logic bug
[00:18:05] Azure B2C Crypto Misuse and Account Compromise
[00:24:32] BUG/CRITICAL: http: properly reject empty …

account account compromise azure b2c bad bounty bug bug bounty compromise crime critical crypto cryptography disclosure exploiting haproxy hash http information information disclosure introduction logic password php podcast prototype request request smuggling research return sec server smuggling testing verification