233 - Spoofing Emails, PandoraFMS, and Keycloak

Kicking off 2024 with a longer episode as we talk about some auditing desktop applications (in the context of some bad reports to Edge). Then we've got a couple fun issues with a client-side path traversal, and a information disclosure due to a HTTP 307 redirect. A bunch of issues in PandoraFSM, and finally some research about parser differentials in SMTP leading to SMTP smuggling (for effective email spoofing).

applications auditing bad bounty-podcast client client-side context desktop disclosure edge emails fun http information information disclosure keycloak path path traversal podcast redirect reports spoofing spoofing emails