Critical Thinking - Bug Bounty Podcast

Justin Gardner (Rhynorater), Joseph Thacker (Rez0), & Brandyn Murtagh (gr3pme)

A "by Hackers for Hackers" podcast focused on technical content ranging from bug bounty tips, to write-up explanations, to the latest hacking techniques.

  1. 1 DAY AGO

    Episode 170: Claude Code + Tmux, Websockets, and Other Korea LHE Takeaways

    Episode 170: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph their trip to Korea with some quick takeaways from the LHE.  Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! ====== Timestamps ====== (00:00:00) Introduction (00:01:41) Google LHE Debrief (00:09:27) Old AI Exfils & AI report writing (00:18:14) Human Tokens (00:26:13) Protoscope & Caido Websocket Repeater

    33 min

  2. 9 APR

    Episode 169: Attacking OAuth 2.1

    Episode 169: In this episode of Critical Thinking - Bug Bounty Podcast gr3pme goes over some of the changes from OAuth 2.0 vs 2.1 and how Hackers can capitalize. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! ====== This Week in Bug Bounty ====== Intigriti is providing free Burp Pro for Hackers! https://www.intigriti.com/blog/news/intigriti-collaborates-with-portswigger-to-support-ethical-hacking-excellence ====== Resources ====== Django-allauth Account Takeover (ZeroPath Audit) https://zeropath.com/blog/django-allauth-account-takeover-vulnerabilities CVE-2025-4144: Cloudflare Workers PKCE Bypass https://github.com/cloudflare/workers-oauth-provider/security/advisories/GHSA-qgp8-v765-qxx9 CVE-2025-54576: OAuth2-Proxy Auth Bypass https://zeropath.com/blog/cve-2025-54576-oauth2-proxy-auth-bypass ====== Timestamps ====== (00:00:00) Introduction (00:02:16) OAuth 2.0 Standards (00:12:08) Agent to Agent Communication (00:17:19) CVE Case studies

    30 min

  3. 2 APR

    Episode 168: XSSDoctor - Client-side Path Traversal Research

    Episode 168: In this episode of Critical Thinking - Bug Bounty Podcast we’re getting a visit from the XSS Doctor. Jonathan joins us to go through his Client-side workflow, run labs, and diagnose some bugs live. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today’s Guest: https://x.com/xssdoctor ====== Resources ====== The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework https://lab.ctbb.show/research/the-dot-dot-slash-that-frameworks-hand-you URL validation bypass cheat sheet https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet ====== Timestamps ====== (00:00:00) Introduction (00:01:37) Home Automation AI Hack & E-signature bug stories (00:12:15) E-signature bug (00:17:01) XSS DR Intro and Bug Bounty Journey (00:31:51) CSPT Workflows (01:07:57) Wildcard Path Parameters  (01:30:34) Custom Sinks

    1hr 36min

  4. 26 MAR

    Episode 167: Stealing Bugs with Valeriy Shevchenko

    Episode 167: In this episode of Critical Thinking - Bug Bounty Podcast we welcome Valeriy Shevchenko to talk about program management, anchor programs, and Theft in Bug Bounty. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today's Sponsor: Check out ThreatLocker Ringfencing https://www.criticalthinkingpodcast.io/tl-rf Today’s Guest: https://x.com/Krevetk0Valeriy ====== This Week in Bug Bounty ====== HackerOne’s Bug Bounty Maturity Framework: https://www.hackerone.com/blog/program-maturity-framework-bug-bounty-operations Intigriti is hiring a Product Security Analyst https://jobs.criticalthinkingpodcast.io/jobs/product-security-analyst-25ef4706 ====== Resources ====== Valeriy’s Blog https://krevetk0.medium.com/ ====== Timestamps ====== (00:00:00) Introduction (00:03:15) Valeriy's Bug story (00:19:48) Anchor Programs and Bug Hunting Motivation (00:29:50) Stealing Bugs

    52 min

  5. 19 MAR

    Episode 166: Rez0’s Top Claude Skill Secrets

    Episode 166: In this episode of Critical Thinking - Bug Bounty Podcast we talk about Rez0’s Claude Skill Secrets, when AI Generated reports fall apart, and agents vs filters. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today’s Sponsor: Adobe ====== This Week in Bug Bounty ====== Intigriti launched their ambassadors program. https://www.intigriti.com/ambassador Adobe will be at Hack The Bay https://www.hackthebay.org/ Bug Bounty Maturity Framework https://bugbountymaturity.com/ ====== Resources ====== h1-brain https://github.com/PatrikFehrenbach/h1-brain caido skills http://github.com/caido/skills Tweet from Karpathy https://x.com/karpathy/status/2031767720933634100?s=20 Find every inefficiency in your Claude workflow with one prompt https://x.com/shannholmberg/status/2030605364421595468 ====== Timestamps ====== (00:00:00) Introduction (00:08:28) Claude skills (00:30:00) How AI Generated reports fall apart (00:38:44) Orchestration (00:49:10) Agents vs Folders

    53 min

  6. 12 MAR

    Episode 165: Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows

    Episode 165: In this episode of Critical Thinking - Bug Bounty Podcast Justin recaps his Zero Trust World experience, before we dive into Permissions issues client-side bugs, New Hardware Hacking Classes, and using AI to hack. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today's Sponsor: Check out ThreatLocker Ringfencing https://www.criticalthinkingpodcast.io/tl-rf ====== Resources ====== bbscope Update https://x.com/sw33tLie/status/2029344643154919720 Matt Brown's Youtube Channel https://www.youtube.com/channel/UC3VDCeZYZH7mCihtMVHqppw Matt's Twitter: https://x.com/nmatt0 MCP server for HackerOne to search reports https://x.com/OriginalSicksec/status/2029503063095124461?s=20 Caido Skills https://github.com/caido/skills The Agentic Hacking Era: Ramblings and a Tool https://josephthacker.com/hacking/2026/03/06/the-agentic-hacking-era.html Announcing AI-driven Caido https://caido.io/blog/2026-03-06-caido-skill ====== Timestamps ====== (00:00:00) Introduction (00:06:23) bbscope report dumping & Matt Brown Training (00:13:10) MCP server for HackerOne to search reports & protobuff success (00:24:24) Hacking Mics with Permissions issues client-side bugs (00:27:26) Can AI Hack things?

    44 min

  7. 5 MAR

    Episode 164: Tommy DeVoss: From Black Hat to Bug Bounty LEGEND

    Episode 164: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Tommy DeVoss to talk about his origin story, Yahoo bugs, and how Tommy first got Justin into Bug Bounty Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! Today’s Guest: https://x.com/thedawgyg ====== This Week in Bug Bounty ====== Python pitfalls: Turning developer mistakes into vulnerabilities https://www.yeswehack.com/learn-bug-bounty/python-pitfalls-turning-developer-mistakes?utm_source=critical-thinking&utm_medium=sponsored&utm_campaign=article-research-python-pitfalls ====== Timestamps ====== (00:00:00) Introduction (00:06:22) Yahoo SSRF (00:14:56) Tommy's Origin (00:44:10) Bug Bounty (00:51:47) SSRF Attraction, AI implementation, & Browser Hacking

    1hr 12min

  8. 26 FEB

    Episode 163: Best Technical Takeaways from Portswigger Top 10 2025

    Episode 163: In this episode of Critical Thinking - Bug Bounty Podcast It’s that time of year again! We’re looking at the Portswigger Research list of top 10 web hacking techniques of 2025. Follow us on twitter at: https://x.com/ctbbpodcast Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io Shoutout to YTCracker for the awesome intro music! ====== Links ====== Follow your hosts Rhynorater, rez0 and gr3pme on X:  https://x.com/Rhynorater https://x.com/rez0__ https://x.com/gr3pme Critical Research Lab: https://lab.ctbb.show/  ====== Ways to Support CTBBPodcast ====== Hop on the CTBB Discord at https://ctbb.show/discord! We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc. You can also find some hacker swag at https://ctbb.show/merch! ====== Resources ====== Parser Differentials: When Interpretation Becomes a Vulnerability https://www.youtube.com/watch?v=Dq_KVLXzxH8 XSS-Leak: Leaking Cross-Origin Redirects https://blog.babelo.xyz/posts/cross-site-subdomain-leak/ Playing with HTTP/2 CONNECT https://blog.flomb.net/posts/http2connect/ Next.js, cache, and chains: the stale elixir https://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixir SOAPwn: Pwning .NET Framework Apps Through HTTP Client Proxies And WSDL https://watchtowr.com/wp-content/uploads/SOAPwnwatchtowr_soappwn-research-whitepaper_10-12-2025.pdf Cross-Site ETag Length Leak https://blog.arkark.dev/2025/12/26/etag-length-leak Lost in Translation: Exploiting Unicode Normalization https://www.youtube.com/watch?v=ETB2w-f3pM4 ORM Leaking More Than You Joined For https://www.elttam.com/blog/leaking-more-than-you-joined-for/ Novel SSRF Technique Involving HTTP Redirect Loops https://slcyber.io/research-center/novel-ssrf-technique-involving-http-redirect-loops/ Successful Errors: New Code Injection and SSTI Techniques https://github.com/vladko312/Research_Successful_Errors ====== Timestamps ====== (00:00:00) Introduction (00:02:33) Parser Differentials: When Interpretation Becomes a Vulnerability (00:11:02) XSS-Leak: Leaking Cross-Origin Redirects (00:18:25) Playing with HTTP/2 CONNECT (00:22:10) Next.js, cache, and chains: the stale elixir (00:29:15) SOAPwn: Pwning .NET Framework Apps Through HTTP Client Proxies And WSDL (00:34:27) Cross-Site ETag Length Leak (00:41:47) Lost in Translation: Exploiting Unicode Normalization (00:47:27) ORM Leaking More Than You Joined For (00:54:07) Novel SSRF Technique Involving HTTP Redirect Loops (00:58:40) Successful Errors: New Code Injection and SSTI Techniques

    1hr 8min
See All (170)

About

A "by Hackers for Hackers" podcast focused on technical content ranging from bug bounty tips, to write-up explanations, to the latest hacking techniques.

Information

  • Creator
    Justin Gardner (Rhynorater), Joseph Thacker (Rez0), & Brandyn Murtagh (gr3pme)
  • Years Active
    2023 - 2026
  • Episodes
    170
  • Rating
    Explicit
  • Copyright
    © Critical Thinking Podcast
  • Show Website
    Critical Thinking - Bug Bounty Podcast

You Might Also Like