[bounty] Reading GitLab Hidden HackerOne Reports and Golang Parameter Smuggling
Day[0] - A podcast by dayzerosec
![](https://is5-ssl.mzstatic.com/image/thumb/Podcasts125/v4/a6/69/69/a6696919-3987-fbc0-8e0c-1ba0e1349a2b/mza_6631746544165345331.jpg/300x300bb-75.jpg)
Categories:
We are back at it, covering some write-ups and exploits we found interesting this summer. From browse-powered desyncs, to account take overs. Links are available on our website at: https://dayzerosec.com/podcast/reading-gitlab-hidden-hackerone-reports-and-golang-parameter-smuggling.html [00:02:17] Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor [00:15:03] [GitLab] Able to view hackerone report attachments [00:26:59] Forwarding addresses is hard [CVE-2022-31813] [00:32:18] "ParseThru" – Exploiting HTTP Parameter Smuggling in Golang [00:46:41] Browser-Powered Desync Attacks [01:09:30] Scraping the bottom of the CORS barrel (part 1)