179 - Client-Side Path Traversal and Hiding Your Entitlement(s) [Bug Bounty Podcast]

This week kicks off with another look at client-side path traversal attacks, this time with some more case-studies. Then we get into some mobile issues, one a cool desync between DER processors resulting in an iOS privilege escalation. The other a Bundle processing issue in Android that provides an almost use-after-free like primitive but in Java.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/179.html

[00:00:00] Introduction

The DAY[0] Podcast episodes are streamed live on Twitch twice a …

android attacks bounty bug bug bounty bundle case client client-side episodes escalation free introduction ios issue java live mobile path path traversal podcast privilege privilege escalation processors studies twitch use-after-free