Path-Scoped Cookie Hacks with Uppercase & Post-based Raw Protobuf XSS (Ep 171)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Apr 23, 2026 · 22:44
BLUF: The video details how ThreatLocker uses mini-filter drivers, Windows Filtering Platform, and EX version kernel notification routines to enforce application ring-fencing and network access controls 0:40.
Key Takeaways:
• ThreatLocker leverages mini-filter drivers to hook IO requests, allowing it to approve or deny file read/write operations based on ACLs 0:50.
• Windows Filtering Platform is used to control network connectivity by approving or denying connect/bind requests for specific processes and ports 0:50.
• EX version kernel notification routines enable active approval or denial of native API calls, such as creating new user processes like PowerShell 0:50.
• Leaking a person's age inadvertently exposes their full date of birth, as the birthday can be deduced by identifying the date the age increments 0:00.
Understanding these kernel-level mechanisms reveals how modern application control tools secure networks by intercepting system calls before execution.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
If you leak the age of a person, you also leak their birthday, their full date of birth, right? Because what you can do is you can just look at that age and then find the day that it changes and then you've got the person's birthday. Best part about hacking when you can just, you know, critical thing, right? >> [music] >> All right, y'all. We've talked about ThreatLocker ring-fencing a lot. We know how it allows you to set ACLs and policies for exactly what an application is allowed to do in your network. But today I'm going to tell you how it does that, okay? Three technologies: mini-filter drivers, Windows Filtering Platform, and EX version kernel notification routines. Mini-filter drivers are essentially a hook or callback for IO requests, okay? So when you're trying to write or read fr…