エピソード

  • Episode 169: Attacking OAuth 2.1

    Episode 169: Attacking OAuth 2.1
    2026/04/09

    Episode 169: In this episode of Critical Thinking - Bug Bounty Podcast gr3pme goes over some of the changes from OAuth 2.0 vs 2.1 and how Hackers can capitalize.


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!



    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    ====== This Week in Bug Bounty ======


    Intigriti is providing free Burp Pro for Hackers!

    https://www.intigriti.com/blog/news/intigriti-collaborates-with-portswigger-to-support-ethical-hacking-excellence


    ====== Resources ======

    Django-allauth Account Takeover (ZeroPath Audit)

    https://zeropath.com/blog/django-allauth-account-takeover-vulnerabilities


    CVE-2025-4144: Cloudflare Workers PKCE Bypass

    https://github.com/cloudflare/workers-oauth-provider/security/advisories/GHSA-qgp8-v765-qxx9


    CVE-2025-54576: OAuth2-Proxy Auth Bypass

    https://zeropath.com/blog/cve-2025-54576-oauth2-proxy-auth-bypass


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:02:16) OAuth 2.0 Standards

    (00:12:08) Agent to Agent Communication

    (00:17:19) CVE Case studies
    続きを読む 一部表示
    30 分
  • Episode 168: The Doctor is in (devtools)

    Episode 168: The Doctor is in (devtools)
    2026/04/02

    Episode 168: In this episode of Critical Thinking - Bug Bounty Podcast we’re getting a visit from the XSS Doctor. Jonathan joins us to go through his Client-side workflow, run labs, and diagnose some bugs live.


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!


    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    Today’s Guest: https://x.com/xssdoctor


    ====== Resources ======


    Lab.ctbb.show


    URL validation bypass cheat sheet

    https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:01:37) Home Automation AI Hack & E-signature bug stories

    (00:12:15) E-signature bug

    (00:17:01) XSS DR Intro and Bug Bounty Journey

    (00:31:51) CSPT Workflows

    (01:07:57) Wildcard Path Parameters

    (01:30:34) Custom Sinks
    続きを読む 一部表示
    1 時間 36 分
  • Episode 167: Stealing Bugs with Valeriy Shevchenko

    Episode 167: Stealing Bugs with Valeriy Shevchenko
    2026/03/26

    Episode 167: In this episode of Critical Thinking - Bug Bounty Podcast we welcome Valeriy Shevchenko to talk about program management, anchor programs, and Theft in Bug Bounty.


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!


    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    Today's Sponsor: Check out ThreatLocker Ringfencing

    https://www.criticalthinkingpodcast.io/tl-rf


    Today’s Guest: https://x.com/Krevetk0Valeriy


    ====== This Week in Bug Bounty ======


    HackerOne’s Bug Bounty Maturity Framework:

    https://www.hackerone.com/blog/program-maturity-framework-bug-bounty-operations


    Intigriti is hiring a Product Security Analyst

    https://jobs.criticalthinkingpodcast.io/jobs/product-security-analyst-25ef4706


    ====== Resources ======


    Valeriy’s Blog

    https://krevetk0.medium.com/


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:03:15) Valeriy's Bug story

    (00:19:48) Anchor Programs and Bug Hunting Motivation

    (00:29:50) Stealing Bugs
    続きを読む 一部表示
    52 分
  • Episode 166: Rez0’s Top Claude Skill Secrets

    Episode 166: Rez0’s Top Claude Skill Secrets
    2026/03/19

    Episode 166: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Rez0’s Claude Skill Secrets, when AI Generated reports fall apart, and agents vs filters.


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!


    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    Today’s Sponsor: Adobe


    ====== This Week in Bug Bounty ======


    Intigriti launched their ambassadors program. https://www.intigriti.com/ambassador


    Adobe will be at Hack The Bay

    https://www.hackthebay.org/


    Bug Bounty Maturity Framework

    https://bugbountymaturity.com/


    ====== Resources ======

    h1-brain

    https://github.com/PatrikFehrenbach/h1-brain


    caido skills

    http://github.com/caido/skills


    Tweet from Karpathy

    https://x.com/karpathy/status/2031767720933634100?s=20


    Find every inefficiency in your Claude workflow with one prompt

    https://x.com/shannholmberg/status/2030605364421595468


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:08:28) Claude skills

    (00:30:00) How AI Generated reports fall apart

    (00:38:44) Orchestration

    (00:49:10) Agents vs Folders
    続きを読む 一部表示
    53 分
  • Episode 165: Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows

    Episode 165: Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows
    2026/03/12

    Episode 165: In this episode of Critical Thinking - Bug Bounty Podcast Justin recaps his Zero Trust World experience, before we dive into Permissions issues client-side bugs, New Hardware Hacking Classes, and using AI to hack.


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!



    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    Today's Sponsor: Check out ThreatLocker Ringfencing

    https://www.criticalthinkingpodcast.io/tl-rf


    ====== Resources ======


    bbscope Update

    https://x.com/sw33tLie/status/2029344643154919720


    Matt Brown's Youtube Channel

    https://www.youtube.com/channel/UC3VDCeZYZH7mCihtMVHqppw


    Matt's Twitter:

    https://x.com/nmatt0


    MCP server for HackerOne to search reports

    https://x.com/OriginalSicksec/status/2029503063095124461?s=20


    Caido Skills

    https://github.com/caido/skills


    The Agentic Hacking Era: Ramblings and a Tool

    https://josephthacker.com/hacking/2026/03/06/the-agentic-hacking-era.html


    Announcing AI-driven Caido

    https://caido.io/blog/2026-03-06-caido-skill


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:06:23) bbscope report dumping & Matt Brown Training

    (00:13:10) MCP server for HackerOne to search reports & protobuff success

    (00:24:24) Hacking Mics with Permissions issues client-side bugs

    (00:27:26) Can AI Hack things?
    続きを読む 一部表示
    44 分
  • Episode 164: Tommy DeVoss: From Black Hat to Bug Bounty LEGEND

    Episode 164: Tommy DeVoss: From Black Hat to Bug Bounty LEGEND
    2026/03/05

    Episode 164: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Tommy DeVoss to talk about his origin story, Yahoo bugs, and how Tommy first got Justin into Bug Bounty


    Follow us on twitter at: https://x.com/ctbbpodcast

    Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

    Shoutout to YTCracker for the awesome intro music!



    ====== Links ======

    Follow your hosts Rhynorater, rez0 and gr3pme on X:

    https://x.com/Rhynorater

    https://x.com/rez0__

    https://x.com/gr3pme


    Critical Research Lab:

    https://lab.ctbb.show/


    ====== Ways to Support CTBBPodcast ======

    Hop on the CTBB Discord at https://ctbb.show/discord!


    We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.


    You can also find some hacker swag at https://ctbb.show/merch!


    Today’s Guest: https://x.com/thedawgyg


    ====== This Week in Bug Bounty ======


    Python pitfalls: Turning developer mistakes into vulnerabilities

    https://www.yeswehack.com/learn-bug-bounty/python-pitfalls-turning-developer-mistakes?utm_source=critical-thinking&utm_medium=sponsored&utm_campaign=article-research-python-pitfalls


    ====== Timestamps ======

    (00:00:00) Introduction

    (00:06:22) Yahoo SSRF

    (00:14:56) Tommy's Origin

    (00:44:10) Bug Bounty

    (00:51:47) SSRF Attraction, AI implementation, & Browser Hacking
    続きを読む 一部表示
    1 時間 12 分
  • Episode 163: Best Technical Takeaways from Portswigger Top 10 2025

    Episode 163: Best Technical Takeaways from Portswigger Top 10 2025
    2026/02/26
    Episode 163: In this episode of Critical Thinking - Bug Bounty Podcast It’s that time of year again! We’re looking at the Portswigger Research list of top 10 web hacking techniques of 2025.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== Resources ======Parser Differentials: When Interpretation Becomes a Vulnerabilityhttps://www.youtube.com/watch?v=Dq_KVLXzxH8XSS-Leak: Leaking Cross-Origin Redirectshttps://blog.babelo.xyz/posts/cross-site-subdomain-leak/Playing with HTTP/2 CONNECThttps://blog.flomb.net/posts/http2connect/Next.js, cache, and chains: the stale elixirhttps://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixirSOAPwn: Pwning .NET Framework Apps Through HTTP Client Proxies And WSDLhttps://watchtowr.com/wp-content/uploads/SOAPwnwatchtowr_soappwn-research-whitepaper_10-12-2025.pdfCross-Site ETag Length Leakhttps://blog.arkark.dev/2025/12/26/etag-length-leakLost in Translation: Exploiting Unicode Normalizationhttps://www.youtube.com/watch?v=ETB2w-f3pM4ORM Leaking More Than You Joined Forhttps://www.elttam.com/blog/leaking-more-than-you-joined-for/Novel SSRF Technique Involving HTTP Redirect Loopshttps://slcyber.io/research-center/novel-ssrf-technique-involving-http-redirect-loops/Successful Errors: New Code Injection and SSTI Techniqueshttps://github.com/vladko312/Research_Successful_Errors====== Timestamps ======(00:00:00) Introduction(00:02:33) Parser Differentials: When Interpretation Becomes a Vulnerability(00:11:02) XSS-Leak: Leaking Cross-Origin Redirects(00:18:25) Playing with HTTP/2 CONNECT(00:22:10) Next.js, cache, and chains: the stale elixir(00:29:15) SOAPwn: Pwning .NET Framework Apps Through HTTP Client Proxies And WSDL(00:34:27) Cross-Site ETag Length Leak(00:41:47) Lost in Translation: Exploiting Unicode Normalization(00:47:27) ORM Leaking More Than You Joined For(00:54:07) Novel SSRF Technique Involving HTTP Redirect Loops(00:58:40) Successful Errors: New Code Injection and SSTI Techniques
    続きを読む 一部表示
    1 時間 8 分
  • Episode 162: HackerOne Training AI on Bug Bounty Data?

    Episode 162: HackerOne Training AI on Bug Bounty Data?
    2026/02/19
    Episode 162: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph sit down with HackerOne Founder & CTO Alex Rice to discuss concerns of Using Hacker Data for AI and decreasing bounties.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today's Sponsor: Join Justin at Zero Trust World in March and get $200 off registration with Code ZTWCTBB26https://ztw.com/Today’s Guest: https://x.com/senorarroz====== This Week in Bug Bounty ======XML external entity: The ultimate Bug Bounty guide to exploiting XXE vulnerabilitieshttps://www.yeswehack.com/learn-bug-bounty/xml-external-entity-guide-xxe?utm_source=Critical_Thinking&utm_medium=Youtube&utm_campaign=XXE_Critical_Thinking&utm_id=XXE_CTBug Bounty Maturity Frameworkhttps://bugbountymaturity.com/====== Resources ======Confidential Information and Confidentiality Obligationshttps://www.hackerone.com/terms/general#:~:text=HackerOne%20may%20use%20Confidential%20Information%20to%20develop%20and/or%20improve%20its%20Services%20(for%20example%2C%20to%20identify%20trends%2C%20and%20to%20train%20AI%20models)%20provided%20such%20use%20does%20not%20result%20in%20disclosure%20of%20Confidential%20Information%20to%20unauthorized%20third%20partiesOwnership and Licenseshttps://www.hackerone.com/terms/community#:~:text=8.%20Ownership%20and%20LicensesI argued with an AI regarding HackerOne using Hacker reports to train PtaaShttps://bugbounty.forum/post/183ff0fc-eb9e-47f8-991d-c0aa5b0bba71HackerOne PTaaS (likely training their AI on private reports data)https://www.reddit.com/r/bugbounty/comments/1r5hixk/hackerone_ptaas_likely_training_their_ai_on/What Makes Agentic PTaaS Different in Real Environmentshttps://www.hackerone.com/blog/agentic-penetration-testing-as-a-service#:~:text=Our%20agents%20are,real%20enterprise%20constraints====== Timestamps ======(00:00:00) Introduction(00:08:44) HackerOne AI Terms of Service (00:24:56) Agentic PTaaS(00:38:09) Selling data(00:43:49) Decrease in Bounties
    続きを読む 一部表示
    53 分