Hardware LHE Rehash (Ep. 199)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Nov 5, 2026 · 56:06
This hardware-focused live hacking event debrief features web hackers pivoting to IoT/firmware, highlighted by an unauthenticated WAN-side router RCE that bypassed ASLR 2:00-2:15.
Key Takeaways:
• JD chained a blind SSRF to a negative chunk size integer overflow in an XML parser, using a fixed "dead beef" stack canary for RCE and exfiltrating a bearer token 9:57-12:04
• Justin exploited a pre-auth WAN function pointer overwrite, using AI-guided brute forcing (~1 in 40,000 odds) to bypass ASLR and prove RCE via encoded ARP callbacks 13:06-19:11
• JD's device-to-cloud pivot escalated to full cloud takeover via a rogue domain, token relay tricks, and an AWS certificate-issuing role exposing Secrets Manager 25:03-29:02
• Config file injection remains potent in IoT: a hostapd injection enabled arbitrary file read via ANQP metadata elements 21:41-23:58
• Niche submissions to hardware programs—even web bugs—are a proven path to live hacking event invites 5:01-6:29
• AI transforms hardware hacking (firmware reversing, ASLR oracles, protocol analysis), but brutal dupe windows make early hours critical 39:56-41:40
Winning formula: get a root shell early and pair architectural understanding with AI as a "sparring partner"—even telling it a rival claims something is impossible.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
It it looks like it looks like um Jason and in the Jason there is one key called location. >> Are you pronouncing it Jason? >> Like Jason had >> Jason Haddex. Yeah. Jason I call it Jason I whatever Jason. >> Best part of acting when you can just you know critical think. Oh >> yeah, >> dude. >> Okay, guys, I don't have to tell you that Namcon is a staple of the bug bounting community, right? I've hosted it in the past. The talks every year are fire. And this year, we've got Nom Con plus the prompt to pone live hacking event in person Oakland, California, November 20th through 21st. I am so hyped, you guys. And I don't even travel that much anymore, guys. But I am getting my butt on a plane and getting over to Oakland for this uh for this event. So, I would love for you guys to join us. Keep…