Bug Bounty JP Podcast

About Bug Bounty JP Podcast

Bug Bounty JP Podcast (BBJP_Podcast) バグバウンティなどを対象にバグハントすることが趣味なメンバーによる「セキュリティ雑談のポッドキャスト」 (ハッシュタグ: #BBJP_Podcast )

Publisher

morioka12

Category

technology

Language

ja

Explicit

No

First episode

22 Feb 2024

Latest episode

10 Jun 2025

Latest episodes

16 episodes in the feed.

1. 

   10 Jun 2025

   BBJP_Podcast #16 (ゲスト回)

   Bug bounty hunters Morioka12, Mokusou, and RyotaK interview Taise about the allure and intrigue of bug bounties, covering recent endeavors, trending vulnerabilities like NahamCon2025, and the mindset required for success in bug hunting.

2. 

   2 May 2025

   BBJP_Podcast #15

   【Episode 15】 ▼News ブログ企画でインタビューを実施しました！ 「⁠日本人バグハンター11人に聞いた！バグバウンティの魅力や面白さについて⁠ (https://scgajge12.hatenablog.com/entry/bughunter_interview_11)」 Spotify等の媒体で、エピソードの概要欄にタイムスタンプを導入しました！ ▼Speakers morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) ▼Summary (Timestamp, Link) (00:27) ①最近の取り組みについて (00:33) mokusou ⁠Meta Bug Bounty Researcher Conference⁠ (https://bugbounty.meta.com/events/) (05:09) RyotaK ⁠Meta Bug Bounty Researcher Conference⁠ (https://bugbounty.meta.com/events/) ⁠SECCON 13 CTF Final 作問記⁠ (https://blog.ryotak.net/post/seccon-13-ctf-final-author-writeup/) (12:17) morioka12 ⁠日本人バグハンター11人に聞いた！バグバウンティの魅力や面白さについて⁠ (https://scgajge12.hatenablog.com/entry/bughunter_interview_11) (23:00) ②トレンドの出来事や脆弱性についてなど (23:38) ⁠How I made $64k from deleted files — a bug bounty story⁠ (https://medium.com/@sharon.brizinov/how-i-made-64k-from-deleted-files-a-bug-bounty-story-c5bd3a6f5f9b) (28:35) ⁠Escalating Impact: Full Account Takeover in Microsoft via XSS in Login Flow⁠ (https://melotover.medium.com/escalating-impact-full-account-takeover-in-microsoft-via-xss-in-login-flow-f160fa79b008) (32:05) Self XSS, iframe (34:36) ⁠React Router and the Remix’ed path⁠ (https://zhero-web-sec.github.io/research-and-things/react-router-and-the-remixed-path) (35:37) ③リスナーからの質問回答 (Q&A) (37:29) Q. 正規表現やサニタイズ周りの学習法、XSSの探し方について (46:08) Q. DOM Based XSSなどのDOMに関する脆弱性の探し方について (48:18) RyotaK流のコードリーディング ▼Survery (Question Form) ⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています！ ▼Official Information ⁠Web Pages⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3) X: ⁠@BBJPPodcast⁠ (https://x.com/BBJPPodcast) hashtag: #BBJP_Podcast

3. 

   30 Mar 2025

   BBJP_Podcast #14

   【Episode 14】 Speakers morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Linkのみ) [大テーマ] 最近の取り組みについて Burp Suite Extension "Autorize" - https://github.com/Quitten/Autorize/ (https://github.com/Quitten/Autorize/) Web Security Auditing Toolkit "Caido" - https://caido.io/ (https://caido.io/) Caido Plugin "CaidoReflector" - https://github.com/bebiksior/CaidoReflector (https://github.com/bebiksior/CaidoReflector) Caido Plugin "ui-kit" - https://x.com/caidoio/status/1904542918641160441 (https://x.com/caidoio/status/1904542918641160441) Caido Plugin "devtools" - https://github.com/caido-community/devtools (https://github.com/caido-community/devtools) Caido Plugin "ParamFinder" - https://github.com/bebiksior/ParamFinder (https://github.com/bebiksior/ParamFinder) Caido Plugin "Shift" - https://shiftplugin.com/ (https://shiftplugin.com/) HTTPS Proxy "mitmproxy" - https://mitmproxy.org/ (https://mitmproxy.org/) - https://github.com/mitmproxy/mitmproxy (https://github.com/mitmproxy/mitmproxy) SECCON CTF 13 Finals "not-that-short Challenge": creator RyotaK - https://x.com/ryotkak/status/1897299540598006249 (https://x.com/ryotkak/status/1897299540598006249) Critical Thinking - Bug Bounty Podcast "Ep 115": guest mokusou - https://youtu.be/zELFGXP6oeA (https://youtu.be/zELFGXP6oeA) P3NFST 2025 Winter "開催レポート" - https://issuehunt.jp/events/2025/winter/news/thanks (https://issuehunt.jp/events/2025/winter/news/thanks) P3NFEST 2025 Winte "コードから探す脆弱性": by RyotaK - https://ryotak.net/slides/?id=1 (https://ryotak.net/slides/?id=1) セキュリティ診断AIエージェント "Takumi" - https://flatt.tech/takumi (https://flatt.tech/takumi) CVE-2025-29768 "potential data loss with zip.vim and special crafted zip files" - https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf (https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf) CVE-2025-27423 "potential code execution with tar.vim and special crafted tar files" - https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3 (https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3) 語学アプリ "Duolingo" - https://www.duolingo.com/ (https://www.duolingo.com/) P3NFEST 2025 Winte "実践的なバグバウンティ入門(2025年版)" - https://speakerdeck.com/scgajge12/shi-jian-de-nabagubaunteiru-men-2025nian-ban (https://speakerdeck.com/scgajge12/shi-jian-de-nabagubaunteiru-men-2025nian-ban) セキュリティ若手の会 "第2回 LT&交流会 開催記ブログ" - https://zenn.dev/sec_wakate/articles/3891a59ab0b4fb (https://zenn.dev/sec_wakate/articles/3891a59ab0b4fb) [中テーマ] トレンドの出来事や脆弱性についてなど CVE-2025-29927 "Authorization Bypass in Next.js Middleware" - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw (https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw) Next.js and the corrupt middleware: the authorizing artifact - https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware ( https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware) One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild - https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/ (https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/) IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX - https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities (https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) HackerOne "Hai" - https://x.com/jobertabma/status/1904947501649830366 (https://x.com/jobertabma/status/1904947501649830366) Bug Bounty Village CFP - https://x.com/BugBountyDEFCON/status/1902853396257710489 (https://x.com/BugBountyDEFCON/status/1902853396257710489) [Q&A] なし Web Page ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

4. 

   27 Feb 2025

   BBJP_Podcast #13 (1周年記念回&ゲスト回)

   【1周年記念回 & ゲスト回】 Speakers morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) ゲスト：Masato Kinugawa (@kinugawamasato (https://x.com/kinugawamasato)) Summary (Linkのみ) [大テーマ] 最近の取り組みについて Automated Mobile App Security⁠ (https://bugbounty.meta.com/scope/) https://oversecured.com/ (https://oversecured.com/) Achieving RCE in famous Japanese chat tool with an obsolete Electron feature https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/ (https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/) Leaderboard | Google Bug Hunters https://bughunters.google.com/leaderboard (https://bughunters.google.com/leaderboard) P3NFEST 2025 Winter https://issuehunt.jp/events/2025/winter/p3nfest (https://issuehunt.jp/events/2025/winter/p3nfest) [中テーマ] トレンドの出来事や脆弱性についてなど Exploring the DOMPurify library: Hunting for Misconfigurations (2/2) https://mizu.re/post/exploring-the-dompurify-library-hunting-for-misconfigurations (https://mizu.re/post/exploring-the-dompurify-library-hunting-for-misconfigurations) Zero Day Initiative - Announcing Pwn2Own Berlin and Introducing an AI Category https://www.zerodayinitiative.com/blog/2025/2/24/announcing-pwn2own-berlin-2025 (https://www.zerodayinitiative.com/blog/2025/2/24/announcing-pwn2own-berlin-2025) Top 10 web hacking techniques of 2024 https://portswigger.net/research/top-10-web-hacking-techniques-of-2024 (https://portswigger.net/research/top-10-web-hacking-techniques-of-2024) Leaking the email of any YouTube user for $10,000 https://brutecat.com/articles/leaking-youtube-emails (https://brutecat.com/articles/leaking-youtube-emails) Decoding Google: Converting a Black Box to a White Box https://brutecat.com/articles/decoding-google (https://brutecat.com/articles/decoding-google) NDevTK Writeup Blog https://ndevtk.github.io/writeups/ (https://ndevtk.github.io/writeups/) 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/ (https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/) How We Hacked a Software Supply Chain for $50K https://www.landh.tech/blog/20250211-hack-supply-chain-for-50k/ (https://www.landh.tech/blog/20250211-hack-supply-chain-for-50k/) [Guest] Masato Kinugawa DiscordデスクトップアプリのRCE https://masatokinugawa.l0.cm/2020/10/discord-desktop-rce.html (https://masatokinugawa.l0.cm/2020/10/discord-desktop-rce.html) Cure53 https://cure53.de/ (https://cure53.de/) Cybozu Bug Bounty Point Cumulative Ranking https://x.com/CybozuBugBounty/status/1884799350666305794 (https://x.com/CybozuBugBounty/status/1884799350666305794) 世界最大規模のバグバウンティコンテスト・Pwn2Ownの魅力とは？ https://flatt.tech/magazine/entry/20240404_pwn2own (https://flatt.tech/magazine/entry/20240404_pwn2own) [Q&A] なし Web Page ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

5. 

   5 Feb 2025

   BBJP_Podcast #12

   Speakers morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Linkのみ) [大テーマ] 最近の取り組みについて Meta Bug Bounty scope ⁠https://bugbounty.meta.com/scope/⁠ (https://bugbounty.meta.com/scope/) https://x.com/NahamSec/status/1873779040693231680 (https://x.com/NahamSec/status/1873779040693231680) Clone2Leak: Your Git Credentials Belong To Us https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to-us/ (https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to-us/) https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx (https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx) https://github.com/gogs/gogs (https://github.com/gogs/gogs) https://github.com/go-gitea/gitea (https://github.com/go-gitea/gitea) DUMANGキーボード 再配置可能なマグネット付きメカニカルキーボード https://akizukidenshi.com/catalog/g/g114963/ (https://akizukidenshi.com/catalog/g/g114963/) [中テーマ] トレンドの出来事や脆弱性についてなど Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak (https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak) Attacks on Maven proxy repositories https://github.blog/security/vulnerability-research/attacks-on-maven-proxy-repositories/ (https://github.blog/security/vulnerability-research/attacks-on-maven-proxy-repositories/) Stealing HttpOnly cookies with the cookie sandwich technique https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique (https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique) WorstFit: Unveiling Hidden Transformers in Windows ANSI! https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/ (https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/) Pwn2Own Automotive 2025 https://x.com/thezdi/status/1882694954415439915 (https://x.com/thezdi/status/1882694954415439915) https://x.com/SinSinology (https://x.com/SinSinology) DoubleClickjacking: A New Era of UI Redressing https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html (https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html) Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel https://samcurry.net/hacking-subaru (https://samcurry.net/hacking-subaru) [Q&A] なし Web Page ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

6. 

   31 Dec 2024

   BBJP_Podcast #11

   Speaker morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Linkのみ) [大テーマ] 最近の取り組みについて Meta Bug Bounty scope https://bugbounty.meta.com/scope/ (https://bugbounty.meta.com/scope/) Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection https://flatt.tech/research/posts/compromising-openwrt-supply-chain-sha256-collision/ (https://flatt.tech/research/posts/compromising-openwrt-supply-chain-sha256-collision/) [中テーマ] 今年の振り返りと来年の抱負 [小テーマ] トレンドの出来事や脆弱性についてなど [Q&A] なし ブログ：「Bug Bounty JP Podcast」の2024年振り返りまとめ https://scgajge12.hatenablog.com/entry/bbjppodcast_2024 (https://scgajge12.hatenablog.com/entry/bbjppodcast_2024) Web Page ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

7. 

   30 Nov 2024

   BBJP_Podcast #10

   Bug bounty experts morioka12, mokusou, and RyotaK share insights on recent trends, vulnerabilities, and security challenges, including DOMPurify bypasses and Okta AD/LDAP delegated authentication.

8. 

   31 Oct 2024

   BBJP_Podcast #9

   Speaker morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Link) [大テーマ] 最近の取り組みについて [小テーマ] バグバウンティにおける気持ち/メンタルの問題について [中テーマ] トレンドの出来事や脆弱性についてなど Pwn2Own ⁠https://x.com/thezdi/status/1849381296771891372⁠ (https://x.com/thezdi/status/1849381296771891372) CSP Bypass Search ⁠https://x.com/renniepak/status/1841495174729314352⁠ (https://x.com/renniepak/status/1841495174729314352) Concealing payloads in URL credentials ⁠https://portswigger.net/research/concealing-payloads-in-url-credentials⁠ (https://portswigger.net/research/concealing-payloads-in-url-credentials) Insecurity through Censorship: Vulnerabilities Caused by The Great Firewall ⁠https://www.assetnote.io/resources/research/insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall⁠ (https://www.assetnote.io/resources/research/insecurity-through-censorship-vulnerabilities-caused-by-the-great-firewall) Bypassing Filters: SSRF Exploitation via DNS Rebinding with Just 1 in 30 Successful Requests ⁠https://mokhansec.medium.com/bypassing-filters-ssrf-exploitation-via-dns-rebinding-with-just-1-in-30-successful-requests-2fdc3a9cfd7d⁠ (https://mokhansec.medium.com/bypassing-filters-ssrf-exploitation-via-dns-rebinding-with-just-1-in-30-successful-requests-2fdc3a9cfd7d) HTTP Parameter Pollution in 2024 ! ⁠https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89⁠ (https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89) Hacking 700 Million Electronic Arts Accounts ⁠https://battleda.sh/blog/ea-account-takeover⁠ (https://battleda.sh/blog/ea-account-takeover) Sam Curryのコメントについて ⁠https://x.com/samwcyo/status/1848196974006186384⁠ (https://x.com/samwcyo/status/1848196974006186384) [Q&A] 脆弱性についてより深く学ぶには、記事を読んだり用意された攻撃環境で遊ぶだけでなく、CVEの再現や自分で脆弱なアプリを実装する等「開発寄りの勉強」も重要だと思うのですが、皆さんはそのようなの勉強方法が、バグバウンティのスキルの向上にどんな影響を与えると思いますか？ Web Page ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

9. 

   30 Sept 2024

   BBJP_Podcast #8

   [お知らせ] BBJP_Podcast のリスナー向けに Discord にて「コミュニティサーバー」を開設しました！(8月) 配信媒体を「Spotify」に加えて「Apple Podcasts」と「Amazon Music」でも配信を開始しました！(9月) BBJP_Podcast の公式X(⁠@bbjppodcast⁠ (https://x.com/BBJPPodcast))を解説しました！ (9月) Speaker morioka12 (⁠⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Link) [大テーマ] 最近の取り組みについて バグハンティング (バグバウンティ) 名言「バグハントに秘密はない」 ホームゲートウェイからUNI出しをしたらMAP-Eが動かなかった話 https://blog.ryotak.net/post/mape-over-uni-port-of-hgw/ (https://blog.ryotak.net/post/mape-over-uni-port-of-hgw/) エレコムのAPに関する脆弱性報告 https://www.elecom.co.jp/news/security/20240827-01/ (https://www.elecom.co.jp/news/security/20240827-01/) [小テーマ] バグハンティングにおける思考プロセスの大事さについて 今まで経験してきた分野や技術などの順番(過程)について [中テーマ] トレンドの出来事や脆弱性についてなど URL validation bypass cheat sheet https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet (https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet) https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet (https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) Using YouTube to steal your files https://lyra.horse/blog/2024/09/using-youtube-to-steal-your-files/ (https://lyra.horse/blog/2024/09/using-youtube-to-steal-your-files/) [Q&A] バグバウンティで必要だと考えるサーバーサイドwebシステム（開発）の知識やその習得方法に関して気になりました。特にホワイトボックス環境下で脆弱性を探していく際の思考法などです。 Web Page ⁠⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

10. 

    28 Aug 2024

    BBJP_Podcast #7

    [お知らせ] BBJP_Podcast のリスナー向けに Discord にて「コミュニティサーバー」を開設しました！(詳細は Web ページをご覧ください) Speaker morioka12 (⁠⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Link) [大テーマ] 最近の取り組みについて 2024 HackerOne Live Hacking Events ⁠https://www.hackerone.com/lhe/2024-lhe-invitations⁠ (https://www.hackerone.com/lhe/2024-lhe-invitations) HackerOne AWC (Ambassador World Cup) https://x.com/Hacker0x01/status/1825583543705067782 (https://x.com/Hacker0x01/status/1825583543705067782) ⁠ (https://x.com/Hacker0x01/status/1795545681232318693)https://x.com/Hacker0x01/status/1825993754613862625 (https://x.com/Hacker0x01/status/1825993754613862625) P3NFEST 2024 Summer ⁠https://issuehunt.jp/events/2024/summer/p3nfest (https://issuehunt.jp/events/2024/summer/p3nfest) [中テーマ] トレンドの出来事や脆弱性について DEFCON32 Bug Bounty Village https://www.bugbountydefcon.com/ (https://www.bugbountydefcon.com/) DEFCON32: SQL Injection Isn't Dead https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf (https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn) Black Hat USA 2024 slides https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202024%20slides (https://github.com/onhexgroup/Conferences/tree/main/Black%20Hat%20USA%202024%20slides) Black Hat USA 2024: web timing attacks that actually work https://i.blackhat.com/BH-US-24/Presentations/US-24-Kettle-Listen-to-the-whispers-web-timing-attacks-that-actually-work.pdf (https://i.blackhat.com/BH-US-24/Presentations/US-24-Kettle-Listen-to-the-whispers-web-timing-attacks-that-actually-work.pdf) Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit https://x.com/ryotkak/status/1819387926247362961 (https://x.com/ryotkak/status/1819387926247362961) https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/ (https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/) Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! https://blog.orange.tw/posts/2024-08-confusion-attacks-en/ (https://blog.orange.tw/posts/2024-08-confusion-attacks-en/) https://httpd.apache.org/security/vulnerabilities_24.html (https://httpd.apache.org/security/vulnerabilities_24.html) [Q&A] バグバウンティや調査で得た知識は何に記録していますか (Notion, Obsidianなど)。使っているメモアプリの良いところとか、情報整理のコツなどもあれば教えてください。 Joplin https://joplinapp.org/ (https://joplinapp.org/) Obsidian https://obsidian.md/ (https://obsidian.md/) Toggl Track https://toggl.com/ (https://toggl.com/) Notion https://www.notion.so/ (https://www.notion.so/) [Q&A] 一つのプログラムを長く続けて、広い知識を学ぶジェネラリストを目指すべきでしょうか？ それとも一つのプログラムに執着し過ぎず、複数のプログラムを経験して特定の脆弱性や特定の技術(GraphQLとか)に関して深い知識を学ぶスペシャリストを目指すべきでしょうか？ (一つのプログラムを長く続けて広く深く学ぶのが最強なのは分かってます) Web Page ⁠⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

11. 

    31 Jul 2024

    BBJP_Podcast #6

    Speaker morioka12 (⁠⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (Link) [大テーマ] 最近の取り組みについて バグバウンティ https://hackerone.com/epicgames (https://hackerone.com/epicgames) 2024 HackerOne Live Hacking Events https://www.hackerone.com/lhe/2024-lhe-invitations (https://www.hackerone.com/lhe/2024-lhe-invitations) Hack.Fes2024 https://www.hacker.or.jp/hack-fes-2024/ (https://www.hacker.or.jp/hack-fes-2024/) Spotify Top Podcasts Ranked https://twitter.com/scgajge12/status/1813904107679130044 (https://twitter.com/scgajge12/status/1813904107679130044) バグバウンティプラットフォーム HackerOne, Bugcrowd, Intigriti, YesWeHack Microsoft のバグハンティング：脆弱性発見者へのインタビューとMSRCについて https://msrc.microsoft.com/blog/2021/10/code-blue-open-talk/ (https://msrc.microsoft.com/blog/2021/10/code-blue-open-talk/) RyotaK's Blog https://blog.ryotak.net/ (https://blog.ryotak.net/) [中テーマ] トレンドの脆弱性について Encoding Differentials: Why Charset Matters https://x.com/sonar_research/status/1812864424807444825 (https://x.com/sonar_research/status/1812864424807444825) https://www.sonarsource.com/blog/encoding-differentials-why-charset-matters/ (https://www.sonarsource.com/blog/encoding-differentials-why-charset-matters/) Browser's XSS Filter Bypass Cheat Sheet by Masato Kinugawa https://github.com/masatokinugawa/filterbypass/wiki/Browser's-XSS-Filter-Bypass-Cheat-Sheet#iso-2022-jp%E3%81%AE%E3%82%A8%E3%82%B9%E3%82%B1%E3%83%BC%E3%83%97%E3%82%B7%E3%83%BC%E3%82%B1%E3%83%B3%E3%82%B9%E3%81%AE%E5%88%A9%E7%94%A8 (https://github.com/masatokinugawa/filterbypass/wiki/Browser) XSS input tag by Masato Kinugawa https://x.com/kinugawamasato/status/1816234368714871185 (https://x.com/kinugawamasato/status/1816234368714871185) pixiv Bug Bounty Program 2018 https://inside.pixiv.blog/kobo/5962 (https://inside.pixiv.blog/kobo/5962) CVE-2024-6387 (OpenSSHにおけるRCE) https://x.com/ryotkak/status/1807755450383028439 (https://x.com/ryotkak/status/1807755450383028439) https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt (https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt) Unveiling TE.0 HTTP Request Smuggling https://www.bugcrowd.com/blog/unveiling-te-0-http-request-smuggling-discovering-a-critical-vulnerability-in-thousands-of-google-cloud-websites/ (https://www.bugcrowd.com/blog/unveiling-te-0-http-request-smuggling-discovering-a-critical-vulnerability-in-thousands-of-google-cloud-websites/) [Q&A] Recon、自動化は何をしていますか？ Automated Recon Framework https://github.com/yogeshojha/rengine (https://github.com/yogeshojha/rengine) https://github.com/MobSF/Mobile-Security-Framework-MobSF (https://github.com/MobSF/Mobile-Security-Framework-MobSF) Web Page ⁠⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

12. 

    30 Jun 2024

    BBJP_Podcast #5

    Speaker morioka12 (⁠⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (link) [大テーマ] 最近の取り組み HackerOne AWC (Ambassador World Cup) https://x.com/Hacker0x01/status/1795545681232318693 (https://x.com/Hacker0x01/status/1795545681232318693) Grafana https://github.com/grafana/bugbounty (https://github.com/grafana/bugbounty) セキュリティ・ミニキャンプ in 宮城 2024 https://www.security-camp.or.jp/minicamp/miyagi2024.html (https://www.security-camp.or.jp/minicamp/miyagi2024.html) [中テーマ] アウトプットのモチベーションについて ブログ執筆 DEFCON Bug Bounty Village https://x.com/Rhynorater/status/1799183392275054906 (https://x.com/Rhynorater/status/1799183392275054906) [中テーマ] トレンドの脆弱性について CVE-2024-4577 - Yet Another PHP RCE https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html (https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html) cURL https://hackerone.com/reports/2550951 (https://hackerone.com/reports/2550951) Zoom Session Takeover https://nokline.github.io/bugbounty/2024/06/07/Zoom-ATO.html (https://nokline.github.io/bugbounty/2024/06/07/Zoom-ATO.html) The Cookie Monster in Your Browsers https://speakerdeck.com/filedescriptor/the-cookie-monster-in-your-browsers (https://speakerdeck.com/filedescriptor/the-cookie-monster-in-your-browsers) Mobile OAuth Attacks https://x.com/Evan_Connelly/status/1803018319915618550 (https://x.com/Evan_Connelly/status/1803018319915618550) https://evanconnelly.github.io/post/ios-oauth/ (https://evanconnelly.github.io/post/ios-oauth/) [Q&A] 一つのプログラムにどれくらいの期間継続して取り組みますか？ そして並行して複数のプログラムに取り組みますか？ [小テーマ] Live Hacking Eventについて https://www.hackerone.com/lhe/2024-lhe-invitations (https://www.hackerone.com/lhe/2024-lhe-invitations) https://x.com/Hacker0x01/status/1806734517534650690 (https://x.com/Hacker0x01/status/1806734517534650690) インタビュー記事「バグバウンティに取り組む理由とその醍醐味」 https://levtech.jp/media/article/interview/detail_466/ (https://levtech.jp/media/article/interview/detail_466/) Web Page ⁠⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

13. 

    28 May 2024

    BBJP_Podcast #4

    Speaker morioka12 (⁠⁠⁠⁠@scgajge12⁠⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠⁠@Mokusou4⁠⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠⁠@ryotkak⁠⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (link) [大テーマ] 最近の取り組み Mutation XSS (MXSS) https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/ (https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) DOMPurify 2.5.3 https://github.com/cure53/DOMPurify/releases/tag/2.5.3 (https://github.com/cure53/DOMPurify/releases/tag/2.5.3) WAF Bypass https://x.com/hackerscrolls/status/1273254212546281473 (https://x.com/hackerscrolls/status/1273254212546281473) https://gist.github.com/hackerscrolls/5c0990dfc734eeb4a9ce8cf2ccdf6fba (https://gist.github.com/hackerscrolls/5c0990dfc734eeb4a9ce8cf2ccdf6fba) NahamCon 2024 https://www.nahamcon.com/schedule (https://www.nahamcon.com/schedule) https://scgajge12.hatenablog.com/entry/nahamcon_2024 (https://scgajge12.hatenablog.com/entry/nahamcon_2024) [中テーマ] Black Hat USA 2024 "Listen to the Whispers: Web Timing Attacks that Actually Work" https://www.blackhat.com/us-24/briefings/schedule/index.html#listen-to-the-whispers-web-timing-attacks-that-actually-work-38297 (https://www.blackhat.com/us-24/briefings/schedule/index.html#listen-to-the-whispers-web-timing-attacks-that-actually-work-38297) "Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!" https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-40227 (https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-40227) "OVPNX: 4 Zero-Days Leading to RCE, LPE and KCE (via BYOVD) Affecting Millions of OpenVPN Endpoints Across the Globe" https://www.blackhat.com/us-24/briefings/schedule/index.html#ovpnx--zero-days-leading-to-rce-lpe-and-kce-via-byovd-affecting-millions-of-openvpn-endpoints-across-the-globe-38900 (https://www.blackhat.com/us-24/briefings/schedule/index.html#ovpnx--zero-days-leading-to-rce-lpe-and-kce-via-byovd-affecting-millions-of-openvpn-endpoints-across-the-globe-38900) V8 / Chrome https://x.com/ajxchapman/status/1794629740504178762 (https://x.com/ajxchapman/status/1794629740504178762) https://blog.ajxchapman.com/ (https://blog.ajxchapman.com/) input: Browser, Web3, LLM [Q&A] バグバウンティでVPNを使っていますか？OSSの場合は何のエディタを使っていますか？ VSCode, IntelliJ IDEA Hacker News https://news.ycombinator.com/ (https://news.ycombinator.com/) IntelliJ IDEA Community Edition https://sales.jetbrains.com/hc/ja/articles/360021922640-%E5%95%86%E7%94%A8%E3%82%BD%E3%83%95%E3%83%88%E3%82%A6%E3%82%A7%E3%82%A2%E3%82%92%E9%96%8B%E7%99%BA%E3%81%99%E3%82%8B%E3%81%9F%E3%82%81%E3%81%AB-Community-%E3%82%A8%E3%83%87%E3%82%A3%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE-JetBrains-IDE-%E3%82%92%E4%BD%BF%E7%94%A8%E3%81%A7%E3%81%8D%E3%81%BE%E3%81%99%E3%81%8B (https://sales.jetbrains.com/hc/ja/articles/360021922640-%E5%95%86%E7%94%A8%E3%82%BD%E3%83%95%E3%83%88%E3%82%A6%E3%82%A7%E3%82%A2%E3%82%92%E9%96%8B%E7%99%BA%E3%81%99%E3%82%8B%E3%81%9F%E3%82%81%E3%81%AB-Community-%E3%82%A8%E3%83%87%E3%82%A3%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%AE-JetBrains-IDE-%E3%82%92%E4%BD%BF%E7%94%A8%E3%81%A7%E3%81%8D%E3%81%BE%E3%81%99%E3%81%8B) [Q&A] ターゲットのサービスで検証用に複数のアカウントを作りたい時は、何のメールを使っていますか？ Hacker Email Alias https://docs.hackerone.com/en/articles/8404308-hacker-email-alias (https://docs.hackerone.com/en/articles/8404308-hacker-email-alias) Temp Mail - Disposable Temporary Email https://addons.mozilla.org/ja/firefox/addon/temp-mail/ (https://addons.mozilla.org/ja/firefox/addon/temp-mail/) XSS in PDF.js https://x.com/albinowax/status/1792568684713500935 (https://x.com/albinowax/status/1792568684713500935) https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/ (https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/) Web Page ⁠⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

14. 

    30 Apr 2024

    BBJP_Podcast #3

    Speaker morioka12 (⁠⁠⁠@scgajge12⁠⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠⁠@Mokusou4⁠⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠⁠@ryotkak⁠⁠⁠ (https://twitter.com/ryotkak)) Summary (link) [大テーマ] 最近の取り組み HackerOneイベント(シンガポール) https://x.com/Hacker0x01/status/1778090763592573318 (https://x.com/Hacker0x01/status/1778090763592573318) "BatBadBut: You can't securely execute commands on Windows" https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ (https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/) Reproduced DOMPurify 3.1.0 bypass https://twitter.com/ryotkak/status/1784526620033974765 (https://twitter.com/ryotkak/status/1784526620033974765) "Mutation XSS via namespace confusion – DOMPurify < 2.0.17 bypass" https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/ (https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) Bypassing DOMPurify again with mutation XSS https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss (https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss) Caido "New community workflows added by @ryotkak" https://twitter.com/CaidoIO/status/1779862162464235830 (https://twitter.com/CaidoIO/status/1779862162464235830) IssueHuntイベント "P3NFEST" https://issuehunt.jp/events/2024/p3nfestconf (https://issuehunt.jp/events/2024/p3nfestconf) HackerOneアンバサダークラブ https://twitter.com/ryotkak/status/1775101176666861779 (https://twitter.com/ryotkak/status/1775101176666861779) [中テーマ] バグバウンティを取り組む上でのモチベーションの維持について バグバウンティの楽しみ方 "CVE-2022-4908: SOP bypass in Chrome using Navigation API" https://blog.joaxcar.com/ (https://blog.joaxcar.com/) "BatBadBut: You can't securely execute commands on Windows" [中テーマ] 遊ぶような感覚で脆弱性を見つけられるようになるためのRyotaK流のTipとは セキュリティを楽しむということについて バグバウンティの楽しみ方について [Q&A] ロジックの不備に関して、特に面白かった脆弱性はあったりしますか？ (自分の発見したのでも、他人の報告でも) "DEF CON 31 - Smashing the State Machine the True Potential of Web Race Conditions - James Kettle" https://youtu.be/tKJzsaB1ZvI?si=RYZYUHocuxnEaRPn (https://youtu.be/tKJzsaB1ZvI?si=RYZYUHocuxnEaRPn) https://twitter.com/kinugawamasato/status/178503064437829232 (https://twitter.com/kinugawamasato/status/178503064437829232) "Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter" https://hackerone.com/reports/210670 (https://hackerone.com/reports/2106708) [Q&A] 初報奨金獲得に向けて学ぶべき事はなんだと思いますか？ Web Security Academy https://portswigger.net/web-security (https://portswigger.net/web-security) Web Page ⁠⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

15. 

    26 Mar 2024

    BBJP_Podcast #2

    Speaker morioka12 (⁠⁠@scgajge12⁠⁠ (https://twitter.com/scgajge12)) mokusou (⁠⁠@Mokusou4⁠⁠ (https://twitter.com/Mokusou4)) RyotaK (⁠⁠@ryotkak⁠⁠ (https://twitter.com/ryotkak)) ←今回はチャットベースで途中参加 Summary (link) 最近の取り組み 先月のバグバウンティで発見した脆弱性について バグバウンティの取り組む特徴(方向性)について 強いバグハンターについて バグバウンティにおけるインプットとの両立について DOMPurifyの脆弱性報告について https://github.com/cure53/DOMPurify/releases/tag/2.4.9 https://github.com/cure53/DOMPurify/releases/tag/3.0.11 [Q&A] ディフェンスや自衛で意識していることはあるか。例えばバックアップはどうやっているとか、公開するサービスの構成とか気をつけてることを教えて欲しい。 攻撃環境やおすすめの設定についても色々教えて欲しい。 [Q&A] バグバウンティで初めて見つけた脆弱性は何ですか？ またその脆弱性を見つけた経緯についても参考までに知りたいです。 Web Page ⁠⁠https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4⁠⁠ (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery ⁠⁠https://forms.gle/wkr2jkc3m9o8NhPk7⁠⁠ (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

16. 

    22 Feb 2024

    BBJP_Podcast #1

    Speaker morioka12 (@scgajge12 (https://twitter.com/scgajge12)) mokusou (@Mokusou4 (https://twitter.com/Mokusou4)) RyotaK (@ryotkak (https://twitter.com/ryotkak)) ←今回はチャットベース Summary (link) 最近の取り組み Full Time Bug Bounty について Bug Bounty のメリットや面白い点 https://hackerone.com/epicgames (https://hackerone.com/epicgames) https://github.com/kevin-mizu/domloggerpp (https://github.com/kevin-mizu/domloggerpp) https://github.com/caido/caido (https://github.com/caido/caido) https://portswigger.net/research/top-10-web-hacking-techniques-of-2023 (https://portswigger.net/research/top-10-web-hacking-techniques-of-2023) https://twitter.com/assetnote (https://twitter.com/assetnote) KeyTrap (CVE-2023-50387) https://thehackernews.com/ (https://thehackernews.com/) [Q&A] バグバウンティの入門者を一緒に働けるレベルまで引き上げるなら、どのようなカリキュラムを考えますか？ [Q&A] 好きな脆弱性とその理由について Web Page https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4 (https://bugbountyjppodcast.notion.site/Bug-Bounty-JP-Podcast-8bf1080383a54c4a8848f10bfeb874b3?pvs=4) Survery https://forms.gle/wkr2jkc3m9o8NhPk7 (https://forms.gle/wkr2jkc3m9o8NhPk7) BBJP_Podcast で話して欲しいテーマや聞きたいことなどを Google Form で募集しています。 感想も X(Twitter)でハッシュタグ「#BBJP_Podcast」や Google Formでいただけると嬉しいです。

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

8 ratings

Contact Bug Bounty JP Podcast

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.