Critical Thinking - Bug Bounty Podcast

• Episode 129: Is this how Bug Bounty Ends?

  Episode 129: In this episode of Critical Thinking - Bug Bounty Podcast we chat about the future of hack bots and human-AI collaboration, the challenges posed by tokenization, and the need for cybersecurity professionals to adapt to the evolving landscape of hacking in the age of AIFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== This Week in Bug Bounty ======Improper error handling in async cryptographic operations crashes processhttps://hackerone.com/reports/2817648Recon Series #6: Excavating hidden artifacts with Wayback Machinehttps://www.yeswehack.com/learn-bug-bounty/recon-wayback-machine-web-archive====== Resources ======This is How They Tell Me Bug Bounty Ends https://josephthacker.com/hacking/2025/06/09/this-is-how-they-tell-me-bug-bounty-ends.htmlWelcome, Hackbots: How AI Is Shaping the Future of Vulnerability Discoveryhttps://www.hackerone.com/blog/welcome-hackbots-how-ai-shaping-future-vulnerability-discoveryGlitch Tokenhttps://www.youtube.com/watch?v=WO2X3oZEJOAConducting smarter intelligences than me: new orchestrashttps://southbridge-research.notion.site/conducting-smarter-intelligences-than-me====== Timestamps ======(00:00:00) Introduction(00:04:05) Is this how Bug Bounty Ends?(00:11:14) Hackbots and handling leads(00:20:50) Hacker chain of thought & Tokenization(00:32:54) Context Engineering

  --------  

  36:14

  --------

  36:14
• Episode 128: New Research in Blind SSRF and Self-XSS, and How to Architect Source-code Review AI Bots

  Episode 128: In this episode of Critical Thinking - Bug Bounty Podcast we talking Blind SSRF and Self-XSS, as well as Reversing massive minified JS with AI and a wild Google Logo Ligature BugFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today's Sponsor: ThreatLocker - Patch Management====== This Week in Bug Bounty ======BitK's "Payload plz" challenge at LeHack====== Resources ======Make Self-XSS Great AgainNovel SSRF Technique Involving HTTP Redirect LoopsSurf - Escalate your SSRF vulnerabilities on Modern Cloud EnvironmentsGecko: Intent to prototype: Framebusting InterventionConducting smarter intelligences than me: new orchestrasMandarkLumentisjscollabGoogle Logo Ligature Bug====== Timestamps ======(00:00:00) Introduction(00:03:55) Self-XSS and credentialless iframe (00:16:50) Novel SSRF Technique Involving HTTP Redirect Loops(00:25:02) Framebusting(00:29:13) Reversing massive minified JS with AI(00:53:12) Google Logo Ligature Bug

  --------  

  58:06

  --------

  58:06
• Episode 127: Drama, PDF as JS Chaos, Bounty Profile Apps, And More

  Episode 127: In this episode of Critical Thinking - Bug Bounty Podcast we address some recent bug bounty controversy before jumping into a slew of news itemsFollow us on XShoutout to YTCracker for the awesome intro music!Today's Sponsor: Adobe====== This Week In Bug Bounty ======Hackers Guide to Google dorkingYesWeCaidoNew Dojo ChallengeSmart Contract BB tipsRed Team AAS====== Resources ======DisclosedPDF csp bypassBypassing File Upload Restrictions To Exploit Client-Side Path TraversalOBS WebSocket to RCETime in a bottle (or knapsack)How to Differentiate Yourself as a Bug Bounty HunterDisclosed. Onlinehacked-in‘EchoLeak’Piloting Edge CopilotNewtownerTips for agent promptingFirefox XSS vectorsTweet from Masato KinugawaChrome debug() function

  --------  

  1:07:25

  --------

  1:07:25
• Episode 126: Hacking AI Series: Vulnus ex Machina - Part 3

  Episode 126: In this episode of Critical Thinking - Bug Bounty Podcast we wrap up Rez0’s AI miniseries ‘Vulnus Ex Machina’. Part 3 includes a showcase of AI Vulns that Rez0 himself has found, and how much they paid out.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Sponsor - ThreatLocker Web Controlhttps://www.criticalthinkingpodcast.io/tl-webcontrol====== Resources ======Claude Code System PromptAttacking AI AgentsProbability of HacksNew Gemini for Workspace Vulnerability Enabling Phishing & Content ManipulationHow to Hack AI Agents and Applications====== Timestamps ======(00:00:00) Introduction(00:02:53) NahamCon Recap, Claude news, and wunderwuzzi writeups (00:08:57) Probability of Hacks(00:11:27) First AI Vulnerabilities(00:18:57) AI Vulns on Google (00:25:11) Invisible prompt Injection

  --------  

  38:32

  --------

  38:32
• Episode 125: How to Win Live Hacking Events

  Episode 125: In this episode of Critical Thinking - Bug Bounty Podcast Justin shares insights on how to succeed at live hacking events. We cover pre-event preparations, challenges of collaboration, on-site strategies, and the importance of maintaining a healthy mindset throughout the entire process.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== This Week in Bug Bounty ======Decathlon Public Bug Bounty Program on YesWeHack====== Resources ======The Ultimate Double-Clickjacking PoCGrafana Full read SSRF and Account Takeover: CVE-2025-4123Grafana CVE-2025-4123 ExploitWhat I learned from my first 100 HackerOne ReportsRoot for your friends====== Timestamps ======(00:00:00) Introduction(00:02:30) The Ultimate Double-Clickjacking PoC, Grafana CVE, & Evan Connelly's first 100 bugs(00:10:23) How to win at Live Hacking Events(00:11:53) Pre-event(00:11:45) Scope Call(00:33:11) Dupe window Ends(00:36:00) Onsite & and Day of Event(00:42:46) Don't define your identity on the outcome

  --------  

  47:04

  --------

  47:04

More Technology podcasts

Trending Technology podcasts

About Critical Thinking - Bug Bounty Podcast