Critical Thinking - Bug Bounty Podcast

Latest Episodes:

Episode 115: Mentee to Career Hacker - Mokusou (So Sakaguchi) Mar 20, 2025

Show notes

Episode 115: In this episode of Critical Thinking - Bug Bounty Podcast Justin and So Sakaguchi sit down to walk through some recent bugs, before having a live mentorship session. They also talk about Reflector, and finish up by doing a bonus podcast segment in Japanese!

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to https://x.com/realytcracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor: ThreatLocker Cloud Control - https://www.threatlocker.com/platform/cloud-control

Today’s Guest: https://x.com/Mokusou4

====== Resources ======

So's last appearance in episode 40

ctbb.show/40

====== Timestamps ======

(00:00:00) Introduction

(00:04:11) So's Facebook Bug

(00:14:37) So and Justin's Google Bug

(00:33:39) Live Mentorship Session

(00:56:29) Reflector

(01:13:22) Bonus - Podcast in Japanese

Episode 114: Single Page Application Hacking Playbook Mar 13, 2025

Show notes

Episode 114: In this episode of Critical Thinking - Bug Bounty Podcast we’re diving into SPA and how to attack them.We also cover a host of news items, including some bug write-ups, AI updates, and a new tool called Hackadvisor.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor: ThreatLocker Cloud Control

====== Resources ======

Hacking High-Profile Bug Bounty Targets: Deep Dive into a Client-Side Chain

Research finds 12,000 ‘Live’ API Keys and Passwords in DeepSeek's Training Data

Hackadvisor

WP Extensions

Notebook LM

Pressing Buttons with Popups

Response to @RenwaX23

Prompt Injection Attacks for Dummies

Shadow Repeater

parallel-prettier

====== Timestamps ======

(00:00:00) Introduction

(00:02:15) Bug Write-up from @busf4ctor

(00:09:44) Scanning Common Crawl

(00:16:30) Hackadvisor and WP/Chrome Extension News

(00:24:15) Notebook LM, and Recent AI Updates

(00:31:58) Write-up from @J0R1AN and Related POC from @RenwaX23

(00:38:10) Prompt Injection Attacks for Dummies

(00:42:29) ShadowRepeater

(00:47:04) Single-page applications

Episode 113: Best Technical Takeaways from Portswigger Top 10 2024 Mar 06, 2025

Show notes

Episode 113: In this episode of Critical Thinking - Bug Bounty Podcast we’re breaking down the Portswigger Top 10 from 2024. There’s some bangers in here!

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on X:

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag!

====== Resources ======

Hijacking OAUTH flows via Cookie Tossing

ChatGPT Account Takeover - Wildcard Web Cache Deception

OAuth Non-Happy Path to ATO

CVE-2024-4367 - Arbitrary JavaScript execution in PDF.js

DoubleClickjacking: A New Era of UI Redressing

WorstFit: Unveiling Hidden Transformers in Windows ANSI

SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server

Middleware, middleware everywhere – and lots of misconfigurations to fix

====== Timestamps ======

(00:00:00) Introduction

(00:09:56) Hijacking OAuth flows via Cookie Tossing

(00:17:30) ChatGPT Account Takeover

(00:25:28) OAuth Non-Happy Path to ATO

(00:29:24) CVE-2024-4367

(00:37:37) DoubleClickjacking:

(00:44:54) Exploring the DOMPurify library

(00:48:01) WorstFit

(00:56:29) Unveiling TE.0 HTTP Request Smuggling

(01:06:40) SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level

(01:14:05) Confusion Attacks

Episode 112: Interview with Ciarán Cotter (MonkeHack) - Critical Lab Researcher and Full-time Hunter Feb 27, 2025

Show notes

Episode 112: In this episode of Critical Thinking - Bug Bounty Podcast Joseph Thacker is joined by Ciarán Cotter (Monke) to share his bug hunting journey and give us the rundown on some recent client-side and server-side bugs. Then they discuss WebSockets, SaaS security, and cover some AI news including Grok 3, Nuclei -AI Flag, and some articles by Johann Rehberger.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Guest - Ciarán Cotter

https://x.com/monkehack

====== Resources ======

Msty

https://msty.app/

From Day Zero to Zero Day

https://nostarch.com/zero-day

Nuclei - ai flag

https://x.com/pdiscoveryio/status/1890082913900982763

ChatGPT Operator: Prompt Injection Exploits & Defenses

https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/

Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocation

https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/

====== Timestamps ======

(00:00:00) Introduction

(00:01:04) Bug Rundowns

(00:13:05) Monke's Bug Bounty Background

(00:20:03) Websocket Research

(00:34:01) Connecting Hackers with Companies

(00:34:56) Grok 3, Msty, From Day Zero to Zero Day

(00:42:58) Full time Bug Bounty, SaaS security, and Threat Modeling while AFK

(00:54:49) Nuclei - ai flag, ChatGPT Operator, and Hacking Gemini's Memory

Episode 111: How to Bypass DOMPurify in Bug Bounty with Kevin Mizu Feb 20, 2025

Show notes

Episode 111: In this episode of Critical Thinking - Bug Bounty Podcast Justin interviews Kevin Mizu to showcase his knowledge regarding DOMPurify and its misconfigurations. We walk through some of Kevin’s research, highlighting things like Dangerous allow-lists and URI Attributes, DOMPurify hooks, node manipulation, and DOM Clobbering.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

====== Resources ======

Exploring the DOMPurify library: Bypasses and Fixes (1/2)

https://mizu.re/post/exploring-the-dompurify-library-bypasses-and-fixes

Exploring the DOMPurify library: Hunting for Misconfigurations (2/2)

https://mizu.re/post/exploring-the-dompurify-library-hunting-for-misconfigurations

Dom-Explorer tool

https://yeswehack.github.io/Dom-Explorer/shared?id=772a440c-b0c2-4991-be71-3e271cf7954f

CT Episode 61: A Hacker on Wall Street - JR0ch17

https://www.criticalthinkingpodcast.io/episode-61-a-hacker-on-wall-street-jr0ch17/

====== Timestamps ======

(00:00:00) Introduction

(00:01:44) Kevin Mizu - Background and Bring-a-bug

(00:15:09) DOMPurify

(00:29:04) Misconfigurations - Dangerous allow-lists

(00:39:09) Dangerous URI attributes configuration

(00:46:08) Bad usage

(00:59:55) DOMPurify Hooks: before, after, and upon SanitizeAttribute

(01:29:15) Node manipulation, nodeName namespace case confusion, & DOM Clobbering DOS

(01:36:51) Misc concepts for future research

Episode 110: Oauth Gadget Correlation and Common Attacks Feb 13, 2025

Show notes

Episode 110: In this episode of Critical Thinking - Bug Bounty Podcast we hit some quick news items including a DOMPurify 3.2.3 Bypass, O3 mini updates, and a cool postLogger Chrome Extension. Then, we hone in on OAuth vulnerabilities, API keys, and innovative techniques hackers use to exploit these systems.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to https://x.com/realytcracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

====== Resources ======

DOMPurify 3.2.3 Bypass

Jason Zhou's post about O3 mini

Live Chat Blog #2: Cisco Webex Connect

postLogger Chrome Extension

postLogger Webstore Link

Common OAuth Vulnerabilities

nOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover

Account Takeover using SSO Logins

Kai Greshake

====== Timestamps ======

(00:00:00) Introduction

(00:01:44) DOMPurify 3.2.3 Bypass

(00:06:37) O3 mini

(00:10:29) Ophion Security: Cisco Webex Connect

(00:15:54) Discord Community News

(00:19:12) postLogger Chrome Extension

(00:21:04) Common OAuth Vulnerabilities & Lessons learned from Google’s APIs

Episode 109: Creative Recon - Alternative Techniques Feb 06, 2025

Show notes

Episode 109: In this episode of Critical Thinking - Bug Bounty Podcast we start off with a quick recap of some of the DeepSeek Drama that’s been going down, and discuss AI in CAPTCHA and 2FA as well. Then we switch to cover some other news before settling in to talk about Alternative Recon Techniques

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to https://x.com/realytcracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor - ThreatLocker. Check out their Managed Detection and Response!

====== Resources ======

Resources

Wiz Research Uncovers Exposed DeepSeek Database

Bypass Bot Detection

Tweet from sw33tLie

rsc 2fa

Stealing HttpOnly cookies with the cookie sandwich technique

Report Pointers for Collaborative Chains

Clone2Leak: Your Git Credentials Belong To Us

Deanonymization via cache

GoogleChrome related-website-sets

====== Timestamps ======

(00:00:00) Introduction

(00:02:03) DeepSeek debacle and Bypass Bot Detection

(00:23:48) Stealing HttpOnly cookies with the cookie sandwich technique

(00:30:54) Report Pointers for Collaborative Chains

(00:34:43) Clone2Leak: Your Git Credentials Belong To Us

(00:40:04) Deanonymization for Signal and Discord

(00:41:53) Alternative Recon Techniques

Episode 108: How to Hack Salesforce, ServiceNow, and Other SaaS Products With Aaron Costello Jan 30, 2025

Show notes

Episode 108: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph bring on Aaron Costello to discuss SaaS security and misconfigurations as a bug class. He also gives some in-depth examples from Salesforce, ServiceNow, and Power Pages.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to https://x.com/realytcracker for the awesome intro music!

====== Links ======

Follow your hosts on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor: AppOmni. Get AppOmni's Definitive Guide to SaaS Security https://www.criticalthinkingpodcast.io/AppOmni

Today’s Guest:

https://x.com/ConspiracyProof

====== Resources ======

Aaron's Blog

https://www.enumerated.ie/

Data Exposure and ServiceNow: The Elephant in the ITSM Room

https://www.enumerated.ie/index/servicenow-data-exposure

Salesforce Lightning - An in-depth look at exploitation vectors for the everyday community

https://www.enumerated.ie/index/salesforce

Lightning Components: A Treatise on Apex

Security from an External Perspective

https://go.appomni.com/hubfs/Collateral/AppOmni_Labs_White_Paper_Apex_Security.pdf?utm_campaign=Network%20Computing&utm_source=referral&utm_content=network_computing

Microsoft Power Pages: Data Exposure Reviewed

https://appomni.com/ao-labs/microsoft-power-pages-data-exposure-reviewed/

====== Timestamps ======

(00:00:00) Introduction

(00:03:00) Aaron Costello, Arbitrary File Upload, & App Cache Manifest Poison bug

(00:13:37) SAAS Misconfigurations as a bug class

(00:43:27) SalesForce Misconfigurations

(01:11:30) Microsoft Power Pages

Episode 107: Bypassing Cross-Origin Browser Headers Jan 23, 2025

Show notes

Episode 107: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph are tackling the subject of cross-origin security headers. They also cover some news items including Google’s OAuth login flaw, RAINK, and gift card hacking.

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to https://x.com/realytcracker for the awesome intro music!

====== Links ======

Follow your hosts on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor - ThreatLocker. Check out their Managed Detection and Response! https://www.criticalthinkingpodcast.io/tl-mdr

====== Resources ======

A Proud Dad's Tale of Two Bug Hunting Daughters and Their Responsible Disclosures

Google’s OAuth login flaw

Rez0's Ai tweet

Rez0's Follow-up

Raink from BishopFox

Gift cards security research

Top 10 web hacking techniques of 2024

Cross-Origin-Opener-Policy: preventing attacks from popups

====== Timestamps ======

(00:00:00) Introduction

(00:05:13) Hacking with your kids

(00:09:46) H1/bc pentests

(00:12:23) Google’s OAuth login flaw

(00:18:01) Raink & Rez0's AI tweets

(00:28:46) Giftcard hacking & Portswigger top 10 voting

(00:34:23) Cross Origin Web Headers

Episode 106: Announcing our new cohost... Jan 16, 2025

Show notes

Episode 106: In this episode of Critical Thinking - Bug Bounty Podcast we are pleased to announce our new co-host of the podcast: Joseph Thacker Aka Rez0! We discuss Joseph's transition to full-time bug bounty hunting, his goals, and what he’s looking forward to bringing to the pod. We also cover some news items including doubleclickjacking, character set attacks, SVG XSS, and more.

Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

------ Links ------

Follow your hosts Rhynorater & Rez0 on twitter:

https://x.com/Rhynorater

https://x.com/rez0__

------ Ways to Support CTBBPodcast ------

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Check out our new SWAG store at https://ctbb.show/swag!

Resources

DoubleClickjacking: A New Era of UI Redressing

https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html

XBOW Validation Benchmarks

https://github.com/xbow-engineering/validation-benchmarks

Jorian tweet

https://x.com/J0R1AN/status/1871586792455163975

Simplified Payload

https://portswigger-labs.net/xss/charset.php?x=%1b$B%1b(B%3Ca%20href=javas%1B(Jcript:alert(1)%3Etest%3C/a%3E&charset=

SVG XSS Payload

https://x.com/garethheyes/status/1876953751245783534