Exploiting VS Code with Control Characters

About this episode

This episode discusses exploiting VS Code using ASCII control characters, along with a referrer leak and SCIM hunting.

A quick episode this week, which includes attacking VS Code with ASCII control characters, as well as a referrer leak and SCIM hunting. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/282.html [00:00:00] Introduction [00:00:57] Attacking Hypervisors - Training Update [00:06:20] Drag and Pwnd: Leverage ASCII characters to exploit VS Code [00:12:12] Full Referer URL leak through img tag [00:17:52] SCIM Hunting - Beyond SSO [00:25:17] Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages Podcast episodes are available on the usual podcast platforms: -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Topics covered

• ASCII control characters
• VS Code exploitation
• referrer leak
• SCIM hunting
• fuzzing CoreAudio

Keywords

• VS Code
• ASCII control characters
• referrer leak
• SCIM
• fuzzing
• CoreAudio

Mentioned in this episode

Organizations: VS Code, SCIM, Apple Podcasts, Spotify, Google Podcasts, Discord

More episodes of Day[0]

• The Future · April 10, 2026 · 1h 20m
• Mitigating Browser Hacking - Interview with John Carse (SquareX Field CISO) · April 22, 2025 · 1h 47m
• Pulling Gemini Secrets and Windows HVPT · April 16, 2025 · 1h 33m
• Session-ception and User Namespaces Strike Again · April 1, 2025 · 50 min
• Extracting YouTube Creator Emails and Spilling Azure Secrets · March 24, 2025 · 44 min
• ESP32 Backdoor Drama and SAML Auth Bypasses · March 17, 2025 · 1h 14m