193 - ImageMagick, Cracking SmartLocks, and Broken OAuth [Bug Bounty Podcast]

This episode covers a lot of ground, from an insecure OAuth flow (Booking.com) to a crazy JSON injection and fail-open login system (DataHub) to hacking Bluetooth smart locks (Megafeis-palm). And even a new ImageMagick trick for a local file read.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/193.html

[00:00:00] Introduction
[00:00:26] Traveling with OAuth - Account Takeover on Booking.com
[00:13:25] Megafeis-palm: Exploiting Vulnerabilities to Open Bluetooth SmartLocks
[00:22:46] GitHub Security Lab audited DataHub: Here's what they found …

account account takeover bluetooth booking booking.com bounty bug bug bounty cracking exploiting fail file flow github github security lab hacking imagemagick injection insecure introduction json lab local locks login oauth palm podcast security smart system takeover vulnerabilities