233 - Spoofing Emails, PandoraFMS, and Keycloak [Bug Bounty Podcast]

Kicking off 2024 with a longer episode as we talk about some auditing desktop applications (in the context of some bad reports to Edge). Then we've got a couple fun issues with a client-side path traversal, and a information disclosure due to a HTTP 307 redirect. A bunch of issues in PandoraFSM, and finally some research about parser differentials in SMTP leading to SMTP smuggling (for effective email spoofing).

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/233.html …

applications auditing bad bounty bug bug bounty client client-side context desktop disclosure edge emails fun http information information disclosure keycloak path path traversal podcast redirect reports spoofing spoofing emails