Episode 113: In this episode of Critical Thinking - Bug Bounty Podcast we’re breaking down the Portswigger Top 10 from 2024. There’s some bangers in here!Follow us on X at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on X: ====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag!====== Resources ======Hijacking OAUTH flows via Cookie TossingChatGPT Account Takeover - Wildcard Web Cache DeceptionOAuth Non-Happy Path to ATOCVE-2024-4367 - Arbitrary JavaScript execution in PDF.jsDoubleClickjacking: A New Era of UI RedressingWorstFit: Unveiling Hidden Transformers in Windows ANSISQL Injection Isn't Dead: Smuggling Queries at the Protocol LevelConfusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP ServerMiddleware, middleware everywhere – and lots of misconfigurations to fix====== Timestamps ======(00:00:00) Introduction(00:09:56) Hijacking OAuth flows via Cookie Tossing(00:17:30) ChatGPT Account Takeover(00:25:28) OAuth Non-Happy Path to ATO(00:29:24) CVE-2024-4367(00:37:37) DoubleClickjacking:(00:44:54) Exploring the DOMPurify library(00:48:01) WorstFit(00:56:29) Unveiling TE.0 HTTP Request Smuggling(01:06:40) SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level (01:14:05) Confusion Attacks

Episode 112: In this episode of Critical Thinking - Bug Bounty Podcast Joseph Thacker is joined by Ciarán Cotter (Monke) to share his bug hunting journey and give us the rundown on some recent client-side and server-side bugs. Then they discuss WebSockets, SaaS security, and cover some AI news including Grok 3, Nuclei -AI Flag, and some articles by Johann Rehberger.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today’s Guest - Ciarán Cotterhttps://x.com/monkehack====== Resources ======Mstyhttps://msty.app/From Day Zero to Zero Dayhttps://nostarch.com/zero-dayNuclei - ai flaghttps://x.com/pdiscoveryio/status/1890082913900982763ChatGPT Operator: Prompt Injection Exploits & Defenseshttps://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocationhttps://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/====== Timestamps ======(00:00:00) Introduction(00:01:04) Bug Rundowns(00:13:05) Monke's Bug Bounty Background(00:20:03) Websocket Research(00:34:01) Connecting Hackers with Companies(00:34:56) Grok 3, Msty, From Day Zero to Zero Day(00:42:58) Full time Bug Bounty, SaaS security, and Threat Modeling while AFK(00:54:49) Nuclei - ai flag, ChatGPT Operator, and Hacking Gemini's Memory

Kevin Mizu, a security researcher at Bisecure specializing in web app security, discusses the critical vulnerabilities associated with DOMPurify. He explores dangerous allow-lists, improper sanitization techniques, and the significance of managing configurations. Mizu shares insights into his own bug bounty experiences, including the exploitation of misconfigured regex patterns and the nuances of Unicode normalization. The conversations emphasize creative thinking in cybersecurity and the intricate methods used to bypass HTML sanitization, underscoring the complexities in maintaining web application security.

Episode 110: In this episode of Critical Thinking - Bug Bounty Podcast we hit some quick news items including a DOMPurify 3.2.3 Bypass, O3 mini updates, and a cool postLogger Chrome Extension. Then, we hone in on OAuth vulnerabilities, API keys, and innovative techniques hackers use to exploit these systems.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter: https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== Resources ======DOMPurify 3.2.3 BypassJason Zhou's post about O3 miniLive Chat Blog #2: Cisco Webex ConnectpostLogger Chrome ExtensionpostLogger Webstore LinkCommon OAuth VulnerabilitiesnOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account TakeoverAccount Takeover using SSO LoginsKai Greshake====== Timestamps ======(00:00:00) Introduction(00:01:44) DOMPurify 3.2.3 Bypass(00:06:37) O3 mini(00:10:29) Ophion Security: Cisco Webex Connect(00:15:54) Discord Community News(00:19:12) postLogger Chrome Extension(00:21:04) Common OAuth Vulnerabilities & Lessons learned from Google’s APIs

Dive into the latest drama surrounding DeepSeek and the implications of AI in security measures like CAPTCHA and 2FA. Discover the challenges of AI training costs and the vulnerabilities linked to an AI database. Explore innovative vulnerability reporting techniques, highlighting 'report pointers' for credibility. Get insights into alternative reconnaissance methods in bug hunting, and learn how to uncover hidden assets and vulnerabilities using modern tools and AI. An exciting blend of technology and security awaits!

Aaron Costello, a SaaS security expert known for his insights on misconfigurations, dives into the complexities of hacking Salesforce, ServiceNow, and Power Pages. He humorously contrasts hacker stereotypes with dedicated bug bounty hunters. Discussion includes the dangers of file upload vulnerabilities and the significance of proper access controls. Notably, he explores Sockle injection vulnerabilities and the intricacies of Salesforce Apex classes, while emphasizing collaboration in identifying security flaws across various SaaS platforms. Tune in for practical techniques and insider insights!

Dive into the world of cybersecurity as the hosts discuss the intricacies of cross-origin security headers and share insights from their experiences. Discover vulnerabilities in Google's OAuth system and learn about gift card hacking exploits. Explore the importance of teaching kids about tech through fun anecdotes and the role of community in supporting innovative research. With a new co-host and engaging discussions on AI in security, this episode is packed with information for both tech lovers and aspiring hackers alike!

The podcast introduces a new co-host, Joseph Thacker, who shares his journey into full-time bug bounty hunting. Highlights include discussions on double-click jacking and its implications for web security. The hosts delve into the significance of automation in bug hunting, showcasing various tools and techniques. They also explore character set attacks and SVG XSS vulnerabilities, while emphasizing the need for robust defenses. Finally, a look ahead reveals plans for enhanced community engagement and original research initiatives in the coming years.

This week features Sam Curry, a renowned bug bounty hunter known for secondary context bugs, and Johan Carlson, an expert in highly CSP environments. They discuss captivating topics like Blind XSS vulnerabilities, web exploits, and debugging techniques for IoT devices. Matan Bear shares insights on client-side attacks using DevTools, while Mariah Gardner highlights the balance between bug bounty hunting and personal relationships. Together, they explore the dynamic nature of cybersecurity and the importance of continuous learning in the field.

Reflecting on the highs and lows of 2024, the host dives into personal achievements and outlines ambitious goals for 2025. They introduce exciting community initiatives like the Bug Bounty Hunters Guild and Critical Research Lab. Insights into personal inventory reveal valuable lessons learned, emphasizing the importance of community and accountability in the bug bounty world. It's a thoughtful mix of reflection and forward-thinking that promises to inspire fellow hackers.