Critical Thinking - Bug Bounty Podcast

• Episode 137: How We Do AI-Assisted Whitebox Review, New CSPT Gadgets, and Tools from SLCyber

  Episode 137: In this episode of Critical Thinking - Bug Bounty Podcast Justin Gardner and Joseph Thacker reunite to talk about AI Hacking Assistants, CSPT and cache deception, and a bunch of tools like ch.at, Slice, Ebka, and more.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== This Week in Bug Bounty ======Vulnerability vectors: SQL injection for Bug Bounty huntersMozilla VPN Clients: RCE via file write and path traversal====== Resources ======Cache Deception + CSPT:dig @ch.atSearchlight Cyber ToolsSliceEbka-Caido-AIpostMessage targetOrigin bypass====== Timestamps ======(00:00:00) Introduction(00:01:26) Claude, Gemini, and Hacking Assistants(00:11:08) AI Safety(00:18:09) CSPT(00:23:26) ch.at, Slice, Ebka, & Searchlight Cyber Tools(00:45:19) postMessage targetOrigin bypass

  --------  

  49:09

  --------

  49:09
• Episode 136: Hacking Cluely, AI Prod Sec, and How To Not Get Sued with Jack Cable

  Episode 136: In this episode of Critical Thinking - Bug Bounty Podcast, Joseph Thacker sits down with Jack Cable to get the scoop on a significant bug in Cluely’s desktop application, as well as the resulting drama. They also talk about Jack’s background in government cybersecurity initiatives, and the legal risks faced by security researchers.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Sponsor - ThreatLocker. Checkout ThreatLocker Detect! https://www.criticalthinkingpodcast.io/tl-detectToday’s Guest: https://x.com/jackhcable?lang=en====== This Week in Bug Bounty ======Nullcon Berlinhttps://www.yeswehack.com/page/yeswehack-live-hacking-nullcon-berlin-2025?utm_source=sponsor&utm_medium=blog&utm_campaign=lhe-nullcon-berlinBB Bulletin #15https://www.linkedin.com/pulse/bug-bounty-bulletin-15-yes-we-hack-dntue/2x Bounty on Grabhttps://hackerone.com/grab?type=team====== Resources ======Corridorhttps://corridor.dev/disclose.iohttps://disclose.io/====== Timestamps ======(00:00:00) Introduction(00:03:33) Cluely Bug, Government involvement, & Disclosed.io(00:12:33) AI in security & Corridor.dev(00:29:23) Cluely Bug Fallout & Ethics of hacking outside of Programs(00:41:20) Shift Agents

  --------  

  50:53

  --------

  50:53
• Episode 135: Akamai's Ryan Barnett on WAFs, Unicode Confusables, and Triage Stories

  Episode 135: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Ryan Barnett for a deep dive on WAFs. We also recap his Exploiting Unicode Normalization talk from DEFCON, and get his perspective on bug hunting from his time at Akamai. Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Sponsor - ThreatLocker. Checkout ThreatLocker Detect! https://www.criticalthinkingpodcast.io/tl-detectToday’s Guest: https://x.com/ryancbarnett====== Resources ======Accidental Stored XSS Flaw in Zemanta 'Related Posts' Plugin for TypePadhttps://webappdefender.blogspot.com/2013/04/accidental-stored-xss-flaw-in-zemanta.htmlXSS Street-Fighthttps://media.blackhat.com/bh-dc-11/Barnett/BlackHat_DC_2011_Barnett_XSS%20Streetfight-Slides.pdfBlackhat USA 2025 - Lost in Translation: Exploiting Unicode Normalizationhttps://www.blackhat.com/us-25/briefings/schedule/#lost-in-translation-exploiting-unicode-normalization-44923====== Timestamps ======(00:00:00) Introduction(00:02:49) Accidental Stored XSS in Typepad Plugin (00:06:34) Chatscatter & Abusing third party Analytics(00:11:42) Ryan Barnett Introduction(00:21:11) Virtual Patching & WAF Challenges(00:40:39) AWS API Gateways & Whitelisting Bug Hunter Traffic(00:49:59) Lost in Translation: Exploiting Unicode Normalization(01:11:29) CSPs at the WAF level & 'Bounties for Bypass'

  --------  

  1:26:21

  --------

  1:26:21
• Episode 134: XBOW - AI Hacking Agent and Human in the Loop with Diego Djurado

  Episode 134: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Diego Djurado to give us the scoop on XBOW. We cover a little about its architecture and approach to hunting, the challenges with hallucinations, and the future of AI in the BB landscape. Diego also shares some of his own hacking journey and successes in the Ambassador World cup.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Sponsor - ThreatLocker User StoreToday’s Guest: https://x.com/djurado9====== This Week in Bug Bounty ======Announcement of our upcoming live hacking event at Nullcon Berlin, taking place on September 4-5Bug Bounty Village Speakers 2025Talkie Pwnii Caido showcaseCaido Masterclass – From Setup to ExploitsAccess Control vs Account Takeover: What Bug Bounty Hunters Need to Know====== Resources ======CVE-2025-49493: XML External Entity (XXE) Injection in Akamai CloudTest====== Timestamps ======(00:00:00) Introduction(00:05:56) Diego's ATO Bug(00:12:01) H1 Ambassador World Cup and work with XBOW(00:20:57) XBOW's CloudTest XXE Bug(00:49:59) Freedom, Hallucinations, & Validation(01:07:24) XBOW's Architecture(01:23:50) Humans in the Loop, Harnesses, and Xbow's Reception(01:44:21) Ambassador World Cup plans for the future

  --------  

  1:53:35

  --------

  1:53:35
• Episode 133: Building Hacker Communities - Bug Bounty Village, getDisclosed, and the LHE Squad

  Episode 133: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Harley and Ari from H1 to talk some about community management roles within Bug Bounty, as well as discuss the evolution of Bug Bounty Village at DEFCON, and what they’ve got in store this year.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Guests:x.com/infiniteloginshttps://x.com/Arl_roseToday’s Sponsor is Adobe. Use code CTBBP0907 in your first report on Adobe Behance, Portfolio, Fonts or Acrobat Web, and earn a one-time 10% bonus reward!====== This Week in Bug Bounty ======BBV Platform Panel about TriageYesWeHACK Makes Debut at Black Hat USA 2025New Dojo challenge featuring a time-based token prediction combined PyYAML deserializationGMSGadget====== Resources ======Bug Bounty VillageSign up for the Disclosed NewsletterDisclosed OnlineHarley's Youtube Channel====== Timestamps ======(00:00:00) Introduction(00:05:51) Bug Stories and Hacking Journeys(00:32:37) Community Management within Bug Bounty(00:39:43) Bug Bounty Village - Origin & 2025 Plans(01:02:39) Disclosed Online and Harley's Upcoming Ebook

  --------  

  1:16:12

  --------

  1:16:12

More Technology podcasts

Trending Technology podcasts

About Critical Thinking - Bug Bounty Podcast