CRLF + XSS + cache poisoning = Access to Github private pages for $35k bounty

✉️ Get the 1st issue of the BBRE newsletter and sign up for the next ones ✉️
https://mailing.bugbountyexplained.co...

📧 Subscribe to BBRE Premium: https://bbre.dev/premium
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw


This video is an explanation of bug bounty report submitted by 17-years-old Robert Chen and 14-years-old Phillip on Hackerone to Github's private bug bounty program. The vulnerability was CRLF combined with XSS and cache poisoning that allowed reading private pages. It was paid out $35,000.

🖥 Get $100 in credits for Digital Ocean 🖥
https://m.do.co/c/cc700f81d215

Report:
https://robertchen.cc/blog/2021/04/03...

Reporters' twitter:
  / notdeghost  
  / ginkoid  

Follow me on twitter:
  / gregxsunday  

Timestamps:
00:00 Intro
00:24 What is BBRE newsletter?
01:10 Github Pages auth flow
02:33 XSS by CRLF
04:57 Bypassing Nonce and __Host cookie
08:44 Cache poisoning
09:49 Attacking from outside the org