Critical Thinking – Bug Bounty Podcast
- Folgen
- 200
- Erscheint
- wöchentlich
- Letzte Folge
- 12. Nov. 2026
Über den Podcast
A "by Hackers for Hackers" podcast focused on technical content ranging from bug bounty tips, to write-up explanations, to the latest hacking techniques.
Folgen 200
Episode 200: Cloud Hacking w/ Nick Copi
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models …
Shownotes
Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Check out Justin’s Dojo on YesWeHack!
https://www.criticalthinkingpodcast.io/ywh-dojo
Today’s Guest:
====== Resources ======
Content-Type Override to Stored XSS on Public Objects
https://blog.voorivex.team/content-type-override-to-stored-xss-on-public-objects
====== Timestamps ======
(00:00:00) Introduction
(00:03:16) Client-side Cloud Service Bug
(00:13:38) Cloud Provider Dashboards
(00:24:08) Larger Cloud Threat Model
(00:37:33) Approach to Hacking Providers that use the Cloud
(00:59:53) Identity Services & S3 Buckets
Episode 199: Hardware LHE Rehash
Episode 199: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Brandyn and JD reflect on their experience at a Hardware LHE. They cover some of the bugs they found, what their prep time looked …
Shownotes
Episode 199: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Brandyn and JD reflect on their experience at a Hardware LHE. They cover some of the bugs they found, what their prep time looked like, and using AI in IoT hacking.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Join us for NahamCon IN PERSON
https://www.criticalthinkingpodcast.io/Nahamcon
====== This Week in Bug Bounty ======
Check out Justin’s Dojo on Yes We Hack!
====== Resources ======
Matt Brown Security Training
https://training.brownfinesecurity.com/l/products
====== Timestamps ======
(00:00:00) Introduction
(00:07:11) LHE Bugs
(00:30:03) Prep Time & Procedure
(00:38:41) IoT Hacking with AI
Episode 198: Scariest Bugs of 2026 - Halloween Special
Episode 198: In this episode of Critical Thinking - Bug Bounty Podcast we're back with the spookiest bug stories we've had this year. We're talking government hacks, summoning global agents, low payouts/long …
Shownotes
Episode 198: In this episode of Critical Thinking - Bug Bounty Podcast we're back with the spookiest bug stories we've had this year. We're talking government hacks, summoning global agents, low payouts/long triage times, and possibly the scariest thing of all for us: Dealing with JD's technical issues...
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Join us for NahamCon IN PERSON
https://www.criticalthinkingpodcast.io/Nahamcon
Sponsored by Intigriti: Join the Waitlist for CrowdRecon!
https://www.criticalthinkingpodcast.io/Intigriti-CrowdRecon
====== Timestamps ======
(00:00:00) Introduction
(00:03:08) Full Auth by Migration Endpoint & RCE Sandbox, artifacts, & Blobs
(00:16:46) Summoning a Global Agent & Preying on Vulnerable Chatbots
(00:27:25) 3d Printer hacks via Tickets
(00:34:20) Hacking Healthcare and Governments
(00:47:52) Dispatcher RCE & the Tale of 3 Bugs
(01:01:05) Pwning IoT Devices
(01:10:15) Intuition Hacks & Scary Low Payouts
(01:18:25) Hackbot Horror Stories
Episode 197: 800 Bugs w/ DeepSeek + Local Model Hacks
Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware.Follow us on twitter at …
Shownotes
Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by Intigriti: Join the Waitlist for CrowdRecon!
https://www.criticalthinkingpodcast.io/Intigriti-CrowdRecon
====== This Week in Bug Bounty ======
Join the H1 Researcher Community Hub on Discord
====== Resources ======
Using Replay Pipelines
https://docs.caido.io/app/guides/replay_test_race_conditions.html
Smashing the token limit with overlapping fragments
https://portswigger.net/research/smashing-the-token-limit
Qwen3.8-Flash-Next-FP4-Local
https://huggingface.co/nvidia/Qwen3.8-Flash-Next-FP4-Local
Prompt Rewriting Tweet
https://x.com/cgtwts/status/2110571916973207906
Muse Spark Open
https://huggingface.co/collections/meta-models/muse-spark-open
Stealth Bench
DreadIndex
https://dreadnode.io/research/dreadindex/
Obliterated
https://huggingface.co/OBLITERATUS/feyospace-s1-obliterated
DeepSeek-v4-Flash-DSpark-2x-DGX-Spark
https://github.com/MiaAI-Lab/DeepSeek-v4-Flash-DSpark-2x-DGX-Spark
====== Timestamps ======
(00:00:00) Introduction
(00:04:00) Bugs found with Deepseek
(00:18:15) Caido Race Conditions & Pipeline Session
(00:23:47) Free models in OpenCode, Reset months, and Overlapping Fragments
(00:29:54) Local Models & Hardware Optimization
(00:46:53) Verifiers & Reflections Agents
(00:58:16) Ohmypi, Herdr and other Harnesses
(01:09:20) Muse Spark Open & Stealth Bench, & DreadIndex
(01:18:35) Keeping agents from fighting
Episode 196: Local AI - The Future of Pentesting & Bug Bounty?
Episode 196: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about how Pentests can help boost morale, the architecture of Building local AI models, and our bug bounty predictions for …
Shownotes
Episode 196: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about how Pentests can help boost morale, the architecture of Building local AI models, and our bug bounty predictions for the future.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
====== Resources ======
UniiChat.com
https://x.com/VictorTaelin/status/2108200878553588091?s=20
The model isn't cooperating
https://portswigger.net/research/the-model-isnt-cooperating
Scan for Good
https://www.wiz.io/blog/scan-for-good-critical-ai-exposures
====== Timestamps ======
(00:00:00) Introduction
(00:04:29) UniiChat, Local architecture, and why the model isn't cooperating
(00:12:15) Pentesting Pros and Predictions
(00:31:06) Securing Critical Infrastructure, Cyber Verification, & Pentesting Delivery
(00:40:35) Bug Bounty Future Predictions
Episode 195: Frans Rosen on the AI Age of Bug Bounty
Episode 195: In this episode of Critical Thinking - Bug Bounty Podcast we talk to Frans Rosen and get his take on the Bug Bounty Industry and finding enjoyment in hacking during the AI Slopocalypse.Follow us on …
Shownotes
Episode 195: In this episode of Critical Thinking - Bug Bounty Podcast we talk to Frans Rosen and get his take on the Bug Bounty Industry and finding enjoyment in hacking during the AI Slopocalypse.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam
====== Timestamps ======
(00:00:00) Introduction
(00:02:48) Bug Bounty Update and AI Dissatisfaction
(00:30:27) How Frans Uses AI & Bugs it can't find.
(00:46:16) What the Future holds for Bug Bounty
Episode 194: Using Jev for Bug Bounty
Episode 194: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph cover Faav’s Microsoft hack, Salesforce adjusting their scope, and if/how Jev can be used for Bug BountyFollow us on …
Shownotes
Episode 194: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph cover Faav’s Microsoft hack, Salesforce adjusting their scope, and if/how Jev can be used for Bug Bounty
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam
====== Resources ======
How I Could've Accessed 17 Trillion Microsoft Records
====== Timestamps ======
(00:00:00) Introduction
(00:04:10) Opus 5.5 & Cyber Verification Program
(00:12:01) Jev, Tac, and CVP
(00:24:45) Turbo Intruder 2
(00:31:33) Salesforce's critical error & Faav's Findings
Episode 193: Browser Logic Errors & XS-Leaks with Jorian Woltjer
Episode 193: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Jorian Woltjer to talk through his Bug Bounty journey and all the crazy research he’s done for the Critical Thinking …
Shownotes
Episode 193: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Jorian Woltjer to talk through his Bug Bounty journey and all the crazy research he’s done for the Critical Thinking Lab.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
====== Resources ======
Cache key injection: Smuggling poison through the door
https://www.yeswehack.com/lab/research-cache-key-injection
====== Resources ======
XS-Leaks
Solving an ORB mystery
https://lab.ctbb.show/research/solving-an-orb-mystery
Research Review #24: Solving an ORB mystery (J0R1AN)
https://www.youtube.com/watch?v=TpXccQbOb48
Stopping Redirects
https://lab.ctbb.show/research/stopping-redirects
Ethical Hacker Groep Nederland
https://www.youtube.com/playlist?list=PL-cT3O--POR-ElvSufpZ1oPfyocmWYeos
====== Timestamps ======
(00:00:00) Introduction
(00:04:19) CTFd status code XS-Leak
(00:18:05) Jorian's Journey & Solving an ORB mystery
(00:33:39) Stopping Redirects
(00:58:55) DNS Rebinding in the browser
(01:08:47) Popunder: weak password prompt
(01:24:33) Declarative partial updates
Episode 192: Hackbot Proof-of-Concept Skill Creation
Episode 192: In this episode of Critical Thinking - Bug Bounty Podcast Justin lays out some goals and tips on PoC Creation.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel …
Shownotes
Episode 192: In this episode of Critical Thinking - Bug Bounty Podcast Justin lays out some goals and tips on PoC Creation.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam
====== This Week in Bug Bounty ======
LHE at Ekoparty, open to all Ekoparty Attendees
https://www.yeswehack.com/fr/page/live-hacking-event-banco-galicia-yeswehack-ekoparty-2026
Builders & Breakers | Building Hackbots: Models, Harnesses and Human Expertise with Hamid Kashfi
https://www.youtube.com/watch?v=MYK9-66qe6w
====== Resources ======
Get Justin’s exclusive masterclass for more information
====== Timestamps ======
(00:00:00) Introduction
(00:05:33) PoC Creation Goals & Formats
(00:15:01) Nuts and Bolts of Python & HTML Files
Episode 191: Rez0s Sick Caching Bug & Local AI vs Subsidized tokens
Episode 191: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph talk about successes in scaling their hackbots, and brainstorm possible ways to stretch their AI subscriptions.Follow us …
Shownotes
Episode 191: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph talk about successes in scaling their hackbots, and brainstorm possible ways to stretch their AI subscriptions.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
====== This Week in Bug Bounty ======
How to use Codex for Bug Bounty research: explore broadly, validate rigorously
https://www.yeswehack.com/learn-bug-bounty/llm-series-codex
====== Resources ======
Herdr
https://herdr.dev/
====== Timestamps ======
(00:00:00) Introduction
(00:02:43) Rez0's Sick Caching Bug
(00:11:38) Hackbot Scale & Hardware Spend
(00:19:16) Stretching your Subscriptions
(00:27:53) Herdr.dev & LHE's with Total Bounty Pools
Episode 190: Hacker Life Coaching & is Rez0 a Claude Shill?
Episode 190: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph do a little life-coaching session to make sure they’re both still aligned with their bug bounty goals. They also talk …
Shownotes
Episode 190: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph do a little life-coaching session to make sure they’re both still aligned with their bug bounty goals. They also talk about Claude vs Codex, amount vs impact, and where to focus tokens.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam
====== This Week in Bug Bounty ======
Web Fuzzing for Hackers
https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers
When fear no longer holds you back. Interview with Ryan Bonner
https://www.intigriti.com/blog/business-insights/interview-with-ryan-bonner-roll4combatus
Steve’s Maturity Framework
https://x.com/SteveHernandezM/status/2094398761946493107
====== Timestamps ======
(00:00:00) Introduction
(00:07:10) Focusing your Tokens, Cloud Providers, and Dropping Bounties
(00:18:30) Amount vs. Impact
(00:25:42) Ideal Work Day and Focus State
Episode 189: What Happened to HackerOne with Joel Margolis
Episode 189: In this episode of Critical Thinking - Bug Bounty Podcast we’re (re)joined by none other than JOEL FREAKING MARGOLIS to talk about his blog post concerning HackerOne. We talk about what he thinks …
Shownotes
Episode 189: In this episode of Critical Thinking - Bug Bounty Podcast we’re (re)joined by none other than JOEL FREAKING MARGOLIS to talk about his blog post concerning HackerOne. We talk about what he thinks went wrong with H1, and how they can revive their old self.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Guest - Joel Magolis
====== This Week in Bug Bounty ======
Kara Sprague’s Statement:
“I read Joel’s post and listened to the episode myself. You raise many good points. The part I want to fix first is how we exchange and action feedback from the community. I don’t have the full fix yet, but I own it and am also open to working together to find a good solution.”
Kara Sprague, CEO, HackerOne
Write triager-grade Bug Bounty reports with Claude Code: introducing the YesWeHack Claude Kit plugin
https://www.yeswehack.com/learn-bug-bounty/triager-grade-reports-claude-code
Claude Kit
https://github.com/yeswehack/claude-kit
====== Resources ======
What Happened to HackerOne?
https://blog.teknogeek.io/posts/what-happened-to-hackerone/
Watch our episode with Alex Rice
https://www.youtube.com/watch?v=Pa4wWv_ONjM
====== Timestamps ======
(00:00:00) Introduction
(00:04:18) The early days: LHE's, Covid, and the rise of AI
(00:17:20) HSM Program, HAI, and resource allocation
(00:36:41) Sales Incentivisation
(00:46:10) AI and Researcher Reports Data
(00:54:38) How Can H1 Revive its Old Self
(01:02:40) Triage
Episode 188: DEFCON 34 Hotel Room Debrief
Episode 188: In this episode of Critical Thinking - Bug Bounty Podcast Gr3pme and BusFactor grab some Hackers for a Live from DEFCON Episode to recap the event and highlight their top bugs and talks.Follow us …
Shownotes
Episode 188: In this episode of Critical Thinking - Bug Bounty Podcast Gr3pme and BusFactor grab some Hackers for a Live from DEFCON Episode to recap the event and highlight their top bugs and talks.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Sponsor: The Adobe Program is moving to Intigriti! Head to our Discord and type “Ready to Hack Adobe” in the giveaway channel and paste your Intigriti profile for a chance to win a Lifetime CT Membership!
Today’s Guests:
====== This Week in Bug Bounty ======
YesWeHack is introducing Credits to combat AI slop reports
https://helpcenter.yeswehack.io/en/articles/711408-yeswehack-credits
====== Timestamps ======
(00:00:00) Introduction
(00:03:45) DEFCON Event Reactions and Takeaways
(00:12:56) Bus & Turbo Talk Overviews
(00:21:53) Event Bugs
Episode 187: Are Live Hacking Events even worth it?
Episode 187: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how much to gaslight your Hackbot, finding “Internet Melting Bugs” and if LHEs still make sense in this AI age.Follow us on …
Shownotes
Episode 187: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how much to gaslight your Hackbot, finding “Internet Melting Bugs” and if LHEs still make sense in this AI age.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Sponsor: Adobe - Head to our Discord and type “Ready to Hack Adobe” in the giveaway channel and paste your Intigriti profile for a chance to win a Lifetime CT Membership!
====== This Week in Bug Bounty ======
Exploiting web cache poisoning vulnerabilities
====== Resources ======
frontier class vulnerabilities: it gets worse before it (maybe) gets better
https://shubs.io/frontier-class-vulnerabilities-it-gets-worse-before-it-maybe-gets-better/
====== Timestamps ======
(00:00:00) Introduction
(00:05:41) LHE Vs. AI
(00:19:27) Hacker Intuition and Gaslighting your Hackbot
(00:25:49) Resolving Sol 5.6 compaction error & AI memory usage
(00:37:00) Frontier Class Vulnerabilities
Episode 186: Is Sol 5.6 SuperHuman for Bug Bounty?
Episode 186: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some Recent Bug Bounty trends and pricing changes, wp2Shell exploits, Sol 5.6, and prompting via the Gauntlet loop.Follow us …
Shownotes
Episode 186: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some Recent Bug Bounty trends and pricing changes, wp2Shell exploits, Sol 5.6, and prompting via the Gauntlet loop.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Network Access
https://www.criticalthinkingpodcast.io/tl-ztna
====== Resources ======
Trend of Bug Bounty Programs
https://x.com/iangcarroll/status/2082535987633410540
Next chapter: Restructuring GitHub’s bug bounty program
https://github.blog/security/next-chapter-restructuring-githubs-bug-bounty-program/
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Gauntlet Loop
https://x.com/mattshumer_/status/2081830214384886228
KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066)
https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066
Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25
====== Timestamps ======
(00:00:00) Introduction
(00:05:40) Bug Bounty Program Trends & Pricing Changes
(00:15:52) Wiz Research uncovers RCE in GitHub & Sol 5.6
(00:29:06) AI Harnessing, prompting, and the Gauntlet Loop
(00:36:58) LHE vs Hackbot
(00:43:21) KindaRails2Shell & WP2Shell
Episode 185: Harley & Ariel - Your Guide to Bug Bounty Village 2026
Episode 185: In this episode of Critical Thinking - Bug Bounty Podcast we, It’s almost time for DEFCON! We’re joined by Harley Kimball and Ariel Garcia to preview this year’s Bug Bounty Village!Follow us on …
Shownotes
Episode 185: In this episode of Critical Thinking - Bug Bounty Podcast we, It’s almost time for DEFCON! We’re joined by Harley Kimball and Ariel Garcia to preview this year’s Bug Bounty Village!
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Network Access
https://www.criticalthinkingpodcast.io/tl-ztna
Today’s Guests:
Harley Kimball - https://x.com/infinitelogins
Ariel Garcia - https://x.com/Arl_rose
====== This Week in Bug Bounty ======
Meet YesWeHack at DEFCON 34
https://www.yeswehack.com/fr/page/yeswehack-defcon-34
====== Resources ======
Bug Bounty Village Agenda
https://www.bugbountydefcon.com/agenda-2026
BBV CTF 2026
https://www.bugbountydefcon.com/ctf
Hacker Hangout with TikTok, HackerOne, and Bug Bounty Village
====== Timestamps ======
(00:00:00) Introduction
(00:04:39) Podcast ATO & ATM Hacks
(00:17:12) Bug Bounty Village Preview
(00:31:02) BBV Room Layout and Swag
(00:42:36) BBV Agenda
(01:10:57) Harley's Hackbot
Episode 184: 750+ Bugs in 2026 with 0xMoose (Ads Dawson)
Episode 184: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Ads Dawson (0xMoose) to talk about his skyrocketing report velocity, as well as how he builds and manages his …
Shownotes
Episode 184: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Ads Dawson (0xMoose) to talk about his skyrocketing report velocity, as well as how he builds and manages his hackbot.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Guest: https://substack.com/@0xmoose
====== This Week in Bug Bounty ======
How to use Claude Code for Bug Bounty: find fast, validate manually
https://www.yeswehack.com/learn-bug-bounty/llm-series-claude
====== Resources ======
Signal Over Noise: AI Agents and the Operator Moat
https://0xmoose.substack.com/p/signal-over-noise-ai-agents-and-the
FBDL Goes Agentic: AI Agents Can Now Build Your Test Environments
https://bugbounty.meta.com/blog/fbdl-goes-agentic/
====== Timestamps ======
(00:00:00) Introduction
(00:11:01) Satisfaction for hackbot finds
(00:19:31) Hackbot Mechanics and Tech Debt
(00:33:31) Sitting in the Bottleneck & Analyzing hacking sessions with Frontier models
(00:44:35) FBDL Goes Agentic, Noise Reduction, & Hill Climbing
(01:05:45) Hackbot Load Distribution
Episode 183: PortSwigger Research Impossible XSS SOLVED
Episode 183: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Brandyn talk about looking at AI features like tech features, Using AI to leak private repos, and solving PortSwigger’s …
Shownotes
Episode 183: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Brandyn talk about looking at AI features like tech features, Using AI to leak private repos, and solving PortSwigger’s Unexploitable XSS labs
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Network Access
https://www.criticalthinkingpodcast.io/tl-ztna
====== This Week in Bug Bounty ======
How LLMs are changing Bug Bounty Interview series
https://www.yeswehack.com/fr/community/llms-bug-bounty-interview-aituglo
https://www.yeswehack.com/fr/community/llms-bug-bounty-interview-rhynorater
https://www.yeswehack.com/fr/community/llms-bug-bounty-interview-icare
====== Resources ======
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain
https://whoareme.com/blog/cspt-account-takeover-2fa-bypass/
Two Bypasses for Chrome’s Sanitizer API
https://slcyber.io/research-center/two-bypasses-for-chromes-sanitizer-api/
Documenting the impossible: Unexploitable XSS labs
https://portswigger.net/research/documenting-the-impossible-unexploitable-xss-labs
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/
Chaining Razor SSTI into RCE via Reflection and Runtime Strings
https://phsi.se/posts/chaining-razor-ssti-into-rce-via-reflection-and-runtime-strings/
====== Timestamps ======
(00:00:00) Introduction
(00:06:07) AI Features Are Just Tech Features
(00:20:02) CSPT to full Account Takeover & Other Chains
(00:35:27) Sanitizer API for Chrome and Firefox
(00:46:57) Solving PortSwigger's Impossible Lab & GitLost
(01:01:19) SSTI into RCE via Reflection
Episode 182: Partial Auth, Hackbot GraphQL, and AI's #1 Mission
Episode 182: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some recent bugs involving WPM, MCP, and a possible emerging bug class using Wayback. We also talk about some GraphQL Hackbot …
Shownotes
Episode 182: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some recent bugs involving WPM, MCP, and a possible emerging bug class using Wayback. We also talk about some GraphQL Hackbot finds, and what AI’s #1 mission should be.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
====== This Week in Bug Bounty ======
LeHack 2026 Recap
https://event.yeswehack.com/events/lehack-2026
Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits
https://www.yeswehack.com/fr/news/chocopocs-vulnerability-researchers-trojanised-exploits
Navigating the AI Wave: How We're Keeping Security Research Meaningful
https://www.hackerone.com/blog/ai-driven-report-volume-insights-and-actions
====== Resources ======
Caido Skills
https://github.com/caido/skills/pull/22
Hunting For AWS Cognito Security
Misconfigurations
https://www.yassineaboukir.com/talks/NahamConEU2022.pdf
X MCP
US South Summer Sessions: Hack the Heat
====== Timestamps ======
(00:00:00) Introduction
(00:08:31) WPM Bug & Wayback to Guest Bearer
(00:18:42) GraphQL Hackbot Finds, Fable Updates, & AI's #1 Mission
(00:29:45) MCP, US South H1 Event, & AI Sandbox Escapes
Episode 181: Bug Bounty Singularity
Episode 181: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and XSSDoctor talk about building a Hackbot.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel …
Shownotes
Episode 181: In this episode of Critical Thinking - Bug Bounty Podcast Joseph and XSSDoctor talk about building a Hackbot.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Network Access
https://www.criticalthinkingpodcast.io/tl-ztna
====== Resources ======
Are bug bounties cooked?
https://hakluke.com/are-bug-bounties-cooked
We built a Hackbot
https://josephthacker.com/hacking/2026/07/01/we-built-a-hackbot.html
====== Timestamps ======
(00:00:00) Introduction
(00:07:22) Manual vs. AI Hacking
(00:17:27) Building a Hackbot
(00:23:53) Negatives of Hackbots
(00:31:34) Logistics and Problems of Singularity
(00:46:21) Successes
Episode 180: State of Bug Bounty Maturity Posture Report
Episode 180: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Steve Hernandez, founder of the Bug Bounty Maturity Framework (BBMF), to walk us through the inaugural State of Bug Bounty …
Shownotes
Episode 180: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Steve Hernandez, founder of the Bug Bounty Maturity Framework (BBMF), to walk us through the inaugural State of Bug Bounty Maturity Posture Report. We go through the scores and cover Asset Hygiene, Operational Signal, how to re-engage the relationship between trust and researcher participation.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Guest: https://x.com/SteveHernandezM
Email Steve at [email protected]
Fill out this form to enter a Critical Thinkers raffle
====== Resources ======
State of Bug Bounty Maturity Posture
https://bugbountymaturity.com/research/state-of-bug-bounty-maturity-posture-2026
Take the Bug Bounty Maturity Assessment
https://bugbountymaturity.com/assessment
AI Is Compressing the Bug Bounty Maturity Curve
https://bugbountymaturity.com/research/ai-is-compressing-the-bug-bounty-maturity-curve
====== Timestamps ======
(00:00:00) Introduction
(00:04:09) State of Bug Bounty Maturity Posture
(00:22:33) Researcher Interface & Program Trust
(00:44:38) Maturity Bands and Scoring
(01:08:19) AI Is Compressing the Bug Bounty Maturity Curve
Episode 179: Maintaining Motivation in Post-AI Bug Bounty World
Episode 179: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how to stay motivated and keep the vibes strong during this trying time for Bug Bounty.Follow us on twitter at …
Shownotes
Episode 179: In this episode of Critical Thinking - Bug Bounty Podcast we talk about how to stay motivated and keep the vibes strong during this trying time for Bug Bounty.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Cloud Access
https://www.criticalthinkingpodcast.io/tl-ztca
====== Timestamps ======
(00:00:00) Introduction
(00:04:57) Managing Hacker Motivation
(00:10:45) Community, Competition, & Curosity
(00:16:54) Using AI with Passion
(00:23:10) The LHE Method & Sharing Wins
(00:28:01) Video POCs, Scripts, & Talking about Bugs
(00:40:49) Watching your health & stopping mid-hack
Episode 178: 600k in ~3 months - BruteCat pt 2
Episode 178: In this episode of Critical Thinking - Bug Bounty Podcast we’re back with BruteCat to finish up our discussion on hacking Google. This week we hit AI.Follow us on twitter at …
Shownotes
Episode 178: In this episode of Critical Thinking - Bug Bounty Podcast we’re back with BruteCat to finish up our discussion on hacking Google. This week we hit AI.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Guest: https://x.com/brutecat
====== Resources ======
Hacking Google with AI
https://brutecat.com/articles/hacking-google-with-ai/
====== Timestamps ======
(00:00:00) Introduction
(00:03:07) Discovery Docs Refresher & AI at BugSWAT Mexico
(00:30:49) Auth & Enumeration of Referer and Origin
(00:45:59) Pwning Google Stories
(01:09:32) Batch Execute & GraphQL
Episode 177: 2x Google RCE with VRP Legend Brutecat
Episode 177: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by BruteCat to talk about his journey hacking Google Cloud, Gmail, Youtube, and Google Phone.Follow us on twitter at …
Shownotes
Episode 177: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by BruteCat to talk about his journey hacking Google Cloud, Gmail, Youtube, and Google Phone.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Cloud Access
https://www.criticalthinkingpodcast.io/tl-ztca
Today’s Guest: https://x.com/brutecat
====== Resources ======
StubZero: $148,337 RCE in Google Cloud Production
https://brutecat.com/articles/google-cloud-rce/
Leaking the email of any YouTube user for $10,000
https://brutecat.com/articles/leaking-youtube-emails/
Disclosing YouTube Creator Emails for a $20k Bounty
https://brutecat.com/articles/youtube-creator-emails/
Leaking the phone number of any Google user
https://brutecat.com/articles/leaking-google-phones/
====== Timestamps ======
(00:00:00) Introduction
(00:29:14) 2nd RCE in Application Integration
(00:39:55) BruteCat's Background & RCE Follow-up Questions
(00:48:02) Google VRP and Youtube Bugs
(01:10:17) Google Phone Leak
(01:18:36) Discovery Docs and Episode 178 Teaser
Episode 176: 600+ CVEs on Adobe AEM with Jim Green (GreenJam)
Episode 176: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by top Adobe hacker Jim Green to deep-dive AEM. We talk through Sling selectors, Permissions, and how to spot AEM Red …
Shownotes
Episode 176: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by top Adobe hacker Jim Green to deep-dive AEM. We talk through Sling selectors, Permissions, and how to spot AEM Red Flags.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Sponsor: Adobe. Earn more for AI bugs with Adobe’s new AI Tier! https://blog.adobe.com/security/adobe-expands-bug-bounty-program-to-incentivize-ai-security-research
Also don’t forget to also grab a 10% bonus for valid AI vulnerabilities in Adobe Stock and Lightroom Web. Use code: CTBB063026 in your report.
Expires June 30, 2026.
====== This Week in Bug Bounty ======
Scaling Bug Bounty triage in the AI era
(https://www.yeswehack.com/security-best-practices/scaling-bug-bounty-triage-ai)
The AI impact: a triager’s perspective
https://www.intigriti.com/blog/business-insights/the-ai-impact-a-triagers-perspective
====== Resources ======
Sling Selectors - The Key to Unlocking AEM's Attack Surface
https://greenjam.co.uk/blog/sling-selectors/
Just a Moment CTF
https://poc.greenjam.co.uk/just-a-moment.html
General XSS jquery .text()
https://poc.greenjam.co.uk/text-xss.html
URL XXS Challenge
https://poc.greenjam.co.uk/url-xss.html
====== Timestamps ======
(00:00:00) Introduction
(00:04:35) Background and AEM Bug
(00:17:40) Sling Selectors & the Tech Stack
(00:38:14) Permissions & Apache Sling Resolution
(01:01:37) The Bugs & AEM Red Flags
(01:31:55) Moment in Time CTF
(01:40:38) General XSS jquery .text()
(01:45:45) URL XXS Challenge
Episode 175: Rhyno’s Hackbot Setup, Sick Bugs, and ZDI Drama
Episode 175: In this episode of Critical Thinking - Bug Bounty Podcast we’re comparing Hackbot setups and results. We also talk about some of the recent ZDI drama, as well as the importance of freaking …
Shownotes
Episode 175: In this episode of Critical Thinking - Bug Bounty Podcast we’re comparing Hackbot setups and results. We also talk about some of the recent ZDI drama, as well as the importance of freaking beautiful POCs
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Cloud Access
https://www.criticalthinkingpodcast.io/tl-ztca
====== Resources ======
Another day, another universal linux LPE
https://x.com/v12sec/status/2054491454064746629
ZDI Drama
https://x.com/ryotkak/status/2052881664909660521
Orange Tsai Bug on Edge
https://x.com/thezdi/status/2054868495888777266
Chompie's Exploit in NV Container Toolkit
https://x.com/chompie1337/status/2054882193055601140
GitHub Security April bug bounty stats
https://x.com/GitHubSecurity/status/2054274356403138932
====== Timestamps ======
(00:00:00) Introduction
(00:02:14) q param prompt injection & Mobile CSPT
(00:14:17) Admin API Key MegaCrit
(00:17:13) Hackbots
(00:37:10) Pretty POCs and ZDI Drama
(00:44:48) GitHub Security April Stats
Episode 174: Saving Bug Bounty Programs + AMPScript, tessl & GPT-5.5
Episode 174: In this episode of Critical Thinking - Bug Bounty Podcast we follow up from last episode with some advice for BB platforms, as well as cover a slew of writeups from Searchlight Cyber, watchTowr …
Shownotes
Episode 174: In this episode of Critical Thinking - Bug Bounty Podcast we follow up from last episode with some advice for BB platforms, as well as cover a slew of writeups from Searchlight Cyber, watchTowr, and Starstrike.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Need a Pentest? We just launched CTBB Pentests!
Hack full time? Check out the Full-Time Hunter’s Guild!
====== This Week in Bug Bounty ======
COST, AI frontier models and more: A measured take on the future of security testing
https://www.yeswehack.com/security-best-practices/cost-mythos-future-security-testing
Common AI misconceptions debugged!
BountySync + Social
https://luma.com/bountysync_social
====== Resources ======
Ghosts of Encryption Past
https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/
tessl Skill Optimizer
https://tessl.io/registry/tessl/skill-optimizer/0.8.0
The Internet Is Falling Down, Falling Down, Falling Down
High Fidelity Check for the cPanel Authentication Bypass
Achieving Deterministic Prompt Injection Through Client-Side Feedback Loops
GPT-5.5: Mythos-Like Hacking, Open To All
https://xbow.com/blog/mythos-like-hacking-open-to-all
Remote Command Execution in Google Cloud with Single Directory Deletion
====== Timestamps ======
(00:00:00) Introduction
(00:09:20) AMPScript
(00:25:10) Tessl Skill Optimizer
(00:33:07) cPanel & WHM Authentication Bypass
(00:40:46) Advice for Bug Bounty Programs
(00:50:07) Prompt Injection Through Client-Side Feedback Loops
(00:54:37) GPT 5.5
(01:01:00) Remote Command Execution in Google Cloud
Episode 173: Bug Bounty is Dead and AI Killed it.
Episode 173: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about the negative effects that AI is having on the Bug Bounty scene as a whole. Is it over, or are we so back?Follow us on …
Shownotes
Episode 173: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about the negative effects that AI is having on the Bug Bounty scene as a whole. Is it over, or are we so back?
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Zero Trust Cloud Access
https://www.criticalthinkingpodcast.io/tl-ztca
====== Resources ======
We want your feedback on this!
https://forms.ctbb.show/future_of_bug_bounty
Evolving the Android & Chrome VRPs for the AI Era
https://bughunters.google.com/blog/evolving-the-android-chrome-vrps-for-the-ai-era
Paid Submissions?
https://x.com/d0rsky/status/2047744193976742120
Keep the Robots Out of the Gym
https://danielmiessler.com/blog/keep-the-robots-out-of-the-gym
Is my data used for model training?
https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training
====== Timestamps ======
(00:00:00) Introduction
(00:06:28) Network effects of Bug Bounty
(00:31:55) Hopium/Copium
(00:47:21) The Great Training Data Debate
Episode 172: Source Code Review Meta Analysis
Episode 172: In this episode of Critical Thinking - Bug Bounty Podcast trying out a new structure of episode: a Meta Analysis of sorts of many Source Code Review techniques. This episode features tips gathered …
Shownotes
Episode 172: In this episode of Critical Thinking - Bug Bounty Podcast trying out a new structure of episode: a Meta Analysis of sorts of many Source Code Review techniques. This episode features tips gathered from Shubs, Rafax, and FSI. Justin highlights best approaches, patterns, and common pitfalls.
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Today’s Sponsor: Adobe - Get 10% bonus for valid AI vulnerabilities in Adobe Stock and Lightroom Web. Use code: CTBB063026 in your report.
Expires June 30, 2026.
====== This Week in Bug Bounty ======
Open-source security testing: the Bug Bounty guide to code analysis
====== Resources ======
Abusing Windows, .NET quirks, and Unicode Normalization to exploit DNN (DotNetNuke)
====== Timestamps ======
(00:00:00) Introduction
(00:06:49) Tracing Data Flow, knowing where your playload is landing, and developer mistakes.
(00:17:33) Mapping the software
(00:24:46) Sniffing for blood
(00:31:54) Common Patterns and Pitfalls
Episode 171: Path-Scoped Cookie Hacks with Uppercase & Post-based Raw Protobuf XSS
Episode 171: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us some quick tips from his own hacking, including some clickjacking, using capital letters, and the potential value of …
Shownotes
Episode 171: In this episode of Critical Thinking - Bug Bounty Podcast Justin gives us some quick tips from his own hacking, including some clickjacking, using capital letters, and the potential value of leaking ages
Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: [email protected]
Shoutout to YTCracker for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
Critical Research Lab:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at https://ctbb.show/merch!
Sponsored by ThreatLocker - Ringfencing
https://www.criticalthinkingpodcast.io/tl-rf
====== Resources ======
The ultimate Bug Bounty guide to OS command injection vulnerabilities
Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation
Aituglo featured on YWH
https://www.yeswehack.com/community/developer-aituglo-bug-bounty-story
Adobe will be sponsoring Ekoparty in Miami and hosting a live hacking event on May 21st
https://ekoparty.org/ekoparty-miami-2026-super-live-hacking-event/
====== Resources ======
SVG clickjacking
https://lyra.horse/blog/2025/12/svg-clickjacking/
====== Timestamps ======
(00:00:00) Introduction
(00:06:35) Protobuff XSS
(00:12:51) Leaking Age & CSPTs
(00:15:59) Capital Letters and Clickjacking
Hier stehen die neuesten 40 von 200 Folgen. Ältere Folgen findest du im Feed des Podcasts.
Ähnliche Podcasts
Mehr Technologie-Podcasts
Ist das dein Podcast?
Bestätige es mit einem Eintrag in deinem Feed: Du bekommst hier einen Code, trägst ihn als podcast:txt in den Kanal deines Feeds ein, und wir prüfen ihn. Danach steht dein Podcast als „verifiziert“ bei SoundNode.