183 - CSS Injection and a Google Cloud Project Takeover Bug [Bug Bounty Podcast]

Starting off the week strong we have a CSS injection turned full-read SSRF, and a MyBB exploit chain from XSS to server-side code injection. And we've got a couple auth token disclosures to end off the episode.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/183.html

[00:00:00] Introduction
[00:00:22] Unleashing the power of CSS injection: The access key to an internal API
[00:06:50] MyBB Remote Code Execution Chain
[00:18:53] Client-Side SSRF to Google Cloud Project Takeover [Google VRP] …

access api auth bounty bug bug bounty client client-side cloud code code execution code injection css disclosures end exploit google google cloud injection internal introduction key mybb podcast power project remote code remote code execution server ssrf takeover token xss