221 - Attacking OAuth, Citrix, and some P2O Drama [Bug Bounty Podcast]

Kicking off the week with a bit of Pwn2Own drama, then taking a look at an OAuth attack against Grammarly and a couple other sites, a fun little polyglot file based attack, and Citrix Bleed, a snprintf information disclosure vulnerability on the web.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/221.html

[00:00:00] Introduction
[00:01:24] Wyze Cam v3 - Pwn2Own Drama
[00:17:57] Oh-Auth - Abusing OAuth to take over millions of accounts
[00:30:55] Exploiting Healthcare Servers with Polyglot …

attack bounty bug bug bounty cam citrix citrix bleed disclosure drama file fun grammarly information information disclosure information disclosure vulnerability introduction oauth podcast polyglot pwn2own the web vulnerability web week wyze wyze cam