Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Crazy CSP Bypass here by Paulos Yibelo! Utilizes JSONP endpoints where you can ONLY use [a-z.]+ as the callback and crafts a valid exploit. Masterful.

Critical Thinking - Bug Bounty Podcast

26,184 subscribers

28,081 views • 2 years ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

2 Comments

Fisher2 years ago

@PaulosYibelo Joel is UNFAZED 😂

John walter ⚡️2 years ago

@remonsec @PaulosYibelo #remonsec

Related Videos

unsure if people know this, but you can use easing to bypass the zoom limit in the editor :) i figured this out after people found a similar exploit in rhythm doctor haha

unsure if people know this, but you can use easing to bypass the zoom limit in the editor :) i figured this out after people found a similar exploit in rhythm doctor haha

Colon :🦊:

23,790 views • 6 months ago

Those telling you to use the northern bypass, here is the Northern bypass right now📌🤦‍♂️

Those telling you to use the northern bypass, here is the Northern bypass right now📌🤦‍♂️

Engineer Faisal

32,075 views • 1 year ago

👾Revolutionary Technologies in Games Are Here👻 In the video, you can see a horror game where you can communicate with a ghost by voice, and the AI will respond as the ghost of a witch would. 😱

👾Revolutionary Technologies in Games Are Here👻 In the video, you can see a horror game where you can communicate with a ghost by voice, and the AI will respond as the ghost of a witch would. 😱

GameDevNews

20,038 views • 1 year ago

Only in South Africa you can use a visitors visa to work and do as you please!

Only in South Africa you can use a visitors visa to work and do as you please!

Abahambe Abdul Majola🇿🇦🇷🇺

72,840 views • 1 year ago

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

Found an XSS but got blocked by the CSP? has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

André Baptista

48,054 views • 8 months ago

In Ultraman Ps2, you can beat Zetton to death if you're patient enough and also use a cheeky little exploit towards the end

In Ultraman Ps2, you can beat Zetton to death if you're patient enough and also use a cheeky little exploit towards the end

Plasma (3D Model Comms Soon?)

15,621 views • 3 months ago

As Trump targets Harvard, here is a standard that the Left created which he can exploit against them.

As Trump targets Harvard, here is a standard that the Left created which he can exploit against them.

Dinesh D'Souza

57,982 views • 1 year ago

The message here is; You cannot bypass Kenya’s minimum KCSE requirements for Medicine (MBChB) by enrolling in a foreign university. The Kenya Medical Practitioners and Dentists Council (KMPDC) will not license you upon graduation if you didn’t meet the entry criteria locally. The only viable path then is to remain and practise in the foreign country where you trained.

The message here is; You cannot bypass Kenya’s minimum KCSE requirements for Medicine (MBChB) by enrolling in a foreign university. The Kenya Medical Practitioners and Dentists Council (KMPDC) will not license you upon graduation if you didn’t meet the entry criteria locally. The only viable path then is to remain and practise in the foreign country where you trained.

Andrew Githiria MD

79,737 views • 6 months ago

i only just realized windows game bar can record the last 30 secs on csp as well!!!!

i only just realized windows game bar can record the last 30 secs on csp as well!!!!

佐藤

15,015 views • 2 months ago

Calling x402 endpoints isn't cool. You know what's cool? Letting AI agent's call x402 endpoints. I made a quick demo showing how to make an agent in AgentBlocks that can choose which x402 services to use, call & pay them, and combine the results. Check it out:

Calling x402 endpoints isn't cool. You know what's cool? Letting AI agent's call x402 endpoints. I made a quick demo showing how to make an agent in AgentBlocks that can choose which x402 services to use, call & pay them, and combine the results. Check it out:

David Mihal.eth

35,421 views • 7 months ago

The only thing Elliot Page accomplished here is confirmation that you can pump a woman full of testosterone, cut off her tits, and she'll still be crazy!

The only thing Elliot Page accomplished here is confirmation that you can pump a woman full of testosterone, cut off her tits, and she'll still be crazy!

Avery Daye

118,899 views • 17 days ago

Walking makes you more creative Daniel Pink says: "The research on walking is unbelievable. There's a famous study where they put people in a chair and they put people on a treadmill, and they do the "alternative uses for an object test." Basically, you give somebody something mundane like a brick and ask: How many different uses can you have for the brick? You can use it as a door stop. You can use it as a step ladder to reach something you can't reach. You can use it as a paper weight. The people who were walking on a treadmill generated like three times as many ideas as the people sitting in a chair. Wow. It's unbelievable. They were just in a treadmill in a laboratory." Daniel Pink

Walking makes you more creative Daniel Pink says: "The research on walking is unbelievable. There's a famous study where they put people in a chair and they put people on a treadmill, and they do the "alternative uses for an object test." Basically, you give somebody something mundane like a brick and ask: How many different uses can you have for the brick? You can use it as a door stop. You can use it as a step ladder to reach something you can't reach. You can use it as a paper weight. The people who were walking on a treadmill generated like three times as many ideas as the people sitting in a chair. Wow. It's unbelievable. They were just in a treadmill in a laboratory." Daniel Pink

David Perell Clips

231,225 views • 4 months ago

A milestone day for clinical trial innovation. We’re announcing the first real-time clinical trials, where U.S. FDA can see data signals and endpoints in real time. A quick explainer:

A milestone day for clinical trial innovation. We’re announcing the first real-time clinical trials, where U.S. FDA can see data signals and endpoints in real time. A quick explainer:

Dr. Marty Makary

430,301 views • 2 months ago

Motorists can now access Kenya's South Coast without using the Likoni ferry crossing as the Dongo Kundu bypass is open for use by small vehicles Video: Kevin Mutai

Motorists can now access Kenya's South Coast without using the Likoni ferry crossing as the Dongo Kundu bypass is open for use by small vehicles Video: Kevin Mutai

NTV Kenya

342,291 views • 1 year ago

Where You Can Use A Cayenne Pepper Compress 🌶️

Where You Can Use A Cayenne Pepper Compress 🌶️

Barbara Oneill

37,928 views • 10 months ago

Here are the top 3 dirty self-defense moves you can use to protect yourself if you get attacked by a criminal.

Here are the top 3 dirty self-defense moves you can use to protect yourself if you get attacked by a criminal.

Jason Hanson - Spy Briefing

4,269,926 views • 2 years ago

Can you use a human as a silencer?

Can you use a human as a silencer?

Interesting As Fuck

165,612 views • 1 year ago

Harvesting of Poppy Seeds (Opium Poppy), scientifically known as Papaver somniferum, can be cultivated in India only with a valid government license. Cultivating it without a license is illegal. You can make a drink from it for summer and used in Halva in the winter.

Harvesting of Poppy Seeds (Opium Poppy), scientifically known as Papaver somniferum, can be cultivated in India only with a valid government license. Cultivating it without a license is illegal. You can make a drink from it for summer and used in Halva in the winter.

JIX5A

72,655 views • 4 months ago

This indie developer is making a sick looking FPS where you play as a kitsune and can use both firearms and your beast powers. Ir's called FERRA, any interest?

This indie developer is making a sick looking FPS where you play as a kitsune and can use both firearms and your beast powers. Ir's called FERRA, any interest?

Best Indie Games

3,517,840 views • 1 month ago