The Future
After 283 episodes, this will be the final episode of the DAY[0] podcast. We started the podcast on a hopeful note in the days following Ghi...
Radio and PodcastLive Radio & Podcasts![Day[0] cover](https://radioandpodcast.sfo3.cdn.digitaloceanspaces.com/podcast_images/130240.jpg)
Technology
Day[0]
A weekly podcast for bounty hunters, exploit developers or anyone interesting in the details of the latest disclosed vulnerabilities and exploits.
Episodes
20 of 283 episodes
Exploiting VS Code with Control Characters
A quick episode this week, which includes attacking VS Code with ASCII control characters, as well as a referrer leak and SCIM hunting. Link...
Mitigating Browser Hacking - Interview with John Carse (SquareX Field CISO)
A special episode this week, featuring an interview with John Carse, Chief Information Security Officer (CISO) of SquareX. John speaks about...
Pulling Gemini Secrets and Windows HVPT
A long episode this week, featuring an attack that can leak secrets from Gemini's Python sandbox, banks abusing private iOS APIs, and Window...
Session-ception and User Namespaces Strike Again
API hacking and bypassing Ubuntu's user namespace restrictions feature in this week's episode, as well as a bug in CimFS for Windows and rev...
Extracting YouTube Creator Emails and Spilling Azure Secrets
This episode features some game exploitation in Neverwinter Nights, weaknesses in mobile implementation for PassKeys, and a bug that allows...
ESP32 Backdoor Drama and SAML Auth Bypasses
Discussion this week starts with the ESP32 "backdoor" drama that circled the media, with some XML-based vulnerabilities in the mix. Finally,...
Exploiting Xbox 360 Hypervisor and Microcode Hacking
A very technical episode this week, featuring some posts on hacking the xbox 360 hypervisor as well as AMD microcode hacking. Links and vuln...
Path Confusion and Mixing Public/Private Keys
This week's episode features a variety of vulnerabilities, including a warning on mixing up public and private keys in OpenID Connect deploy...
ZDI's Triaging Troubles and LibreOffice Exploits
We discuss an 0day that was dropped on Parallels after 7 months of no fix from the vendor, as well as ZDI's troubles with responses to resea...
Recycling Exploits in MacOS and Pirating Audiobooks
We cover a comical saga of vulnerabilities and variants from incomplete fixes in macOS, as well as a bypass of Chrome's miraclePtr mitigatio...
Top 10 Web Hacking Techniques and Windows Shadow Stacks
In this episode, we discuss the US government discloses how many 0ds were reported to vendors in a first-ever report. We also cover PortSwig...
Unicode Troubles, Bypassing CFG, and Racey Pointer Updates
On the web side, we cover a portswigger post on ways of abusing unicode mishandling to bypass firewalls and a doyensec guide to OAuth vulner...
Deanonymization with CloudFlare and Subaru's Security Woes
Zero Day Initiative posts their trends and observations from their threat hunting highlights of 2024, macOS has a sysctl bug, and a techniqu...
Excavating Exploits and PHP Footguns
This week features a mix of topics, from polyglot PDF/JSON to android kernel vulnerabilities. Project Zero also publishes a post about excav...
WhatsApp vs. NSO and CCC Talks
Specter and zi discuss their winter break, cover some interesting CCC talks, and discuss the summary judgement in the WhatsApp vs. NSO Group...
Buggy Operating Systems Are Coming to Town
In our last episode of 2024, we delve into some operating system bugs in both Windows and Linux, as well as some bugs that are not bugs but...
Machine Learning Attacks and Tricky Null Bytes
This week's episode contains some LLM hacking and attacks on classifiers, as well as the renewal of DMA attacks with SD Express and the ever...
A Windows Keyhole and Buggy OAuth
A short episode this week, featuring Keyhole which abuses a logic bug in Windows Store DRM, an OAuth flow issue, and a CSRF protection bypas...
Linux Is Still a Mess and Vaultwarden Auth Issues
Linux userspace is still a mess and has some bad bugs in root utilities, and Vaultwarden has an interesting auth bypass attack. Links and vu...