Download - A Slack Attack and a MySQL Scientific Notation Bug [Bug Hunting]

Discover

Podcast Features
Your all-in-one podcasting solution.

Blog to Podcast
Turn your blog into an engaging podcast.
Livestream
High-performing audio live, without limits.

Podcast Studio
Easy-to-use audio recorder app.
Podbean AI
AI-Enhanced Audio Quality and Content Generation.

Podcast App
The best podcast player & podcast app.

Ads Marketplace
Join Ads Marketplace to earn money
through sponsorship on your podcast.

PodAds
Manage your ads with dynamic ad insertion capability.
Apple Podcasts Subscriptions Integration
Effortlessly publish and manage exclusive episodes for your
Apple Podcasts subscribers directly from Podbean.
Live Streaming
Receive livestream rewards from your audience and earn
recurring income from your Fan Club membership.

All Arts Business Comedy Education
Fiction Government Health & Fitness History Kids & Family
Leisure Music News Religion & Spirituality Science
Society & Culture Sports Technology True Crime TV & Film
Live

How to Start a Podcast
How to Start a Live Podcast
How to Monetize a podcast
How to Promote Your Podcast
How to Use Group Recording

Log in
Start your podcast for free

Podcasting
Monetization
Advertisers
Enterprise
Pricing
Discover

Day[0]

Technology

A Slack Attack and a MySQL Scientific Notation Bug [Bug Hunting]

2021-10-26

Download Right click and do "save link as"

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/a-slack-attack-and-a-mysql-scientific-notation-bug.html

Just four bugs this week, but that all are somewhat interesting, from an Instagram 2FA removal, deanonymizing Slack users, a MySQL bug, and how to get cheap reddit coins.

[00:00:31] How I was able to revoke your Instagram 2FA

[00:10:02] Abusing Slack's file-sharing functionality to de-anonymise fellow workspace members

[00:29:41] A Scientific Notation Bug in MySQL left AWS WAF Clients Vulnerable to SQL Injection

[00:35:38] Reddit disclosed on HackerOne: IDOR to pay less for coin purchases...

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.