Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/baby-monitor-bugs-grafana-and-twitter-de-anonymization.html

CSRF lives again in the form of CORF, Cross-Origin Request Forgery with an attack against Grafana. We also take a look at some baby monitor issues and a de-anonymization attack against Twitter.

[00:00:28] Cross-origin request forgery against Grafana [CVE-2022-21703]

[00:17:50] Vulnerabilities Identified in Nooie Baby Monitor

[00:26:47] [Twitter] Discoverability by phone number/email restriction bypass

[00:32:40] EarnHub Exploit - Post mortem

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.

[bounty] Baby Monitor Bugs, Grafana, and Twitter De-anonymization 42:37 Share

Day[0]

Shownotes Transcript

[bounty] Baby Monitor Bugs, Grafana, and Twitter De-anonymization