Critical Thinking - Bug Bounty Podcast Episode 128: New Research in Blind SSRF and Self-XSS, and How to Architect Source-code Review AI Bots
Jun 26, 2025
Delve into the vulnerabilities of self-XSS and the complexities of blind SSRF attacks, unveiling the latest research on HTTP redirect techniques. Explore the innovative applications of AI in reversing minified JavaScript and improving code security. Hear about exciting new tools like Lumintus for better bug bounty documentation and the implications of URL spoofing linked to Google font ligatures. This engaging discussion combines technical insights with the evolving landscape of web security.
AI Snips
Chapters
Transcript
Episode notes
Persistence via Self-XSS and fetchLater
- Self-XSS combined with login CSRF and fetchLater can create persistent SSRF attacks.
- This chain requires predictable request bodies and cookie-based authentication only.
Blind SSRF Escalation via Redirect Loops
- Blind SSRF can be escalated by triggering multiple redirects to cause application-level error responses.
- Over five redirects, applications handle errors differently, allowing full HTTP response visibility.
Automate Blind SSRF Escalation
- Develop a tool to automate blind SSRF escalation by cycling redirects and targeting internal hosts.
- Incorporate variable status codes and redirect counts to adapt to different SSRF configurations.