Episode 200: Cloud Hacking w/ Nick Copi

Episode 200: In this episode of Critical Thinking - Bug Bounty Podcast JD sits down with Nick Copi to pick his brain about Cloud Hacking. They talk through what actually qualifies and the cloud, threat models, and how providers can use and misuse cloud services.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Check out Justin’s Dojo on YesWeHack!https://www.criticalthinkingpodcast.io/ywh-dojoToday’s Guest: https://x.com/7urb01====== Resources ======Content-Type Override to Stored XSS on Public Objectshttps://blog.voorivex.team/content-type-override-to-stored-xss-on-public-objects====== Timestamps ======(00:00:00) Introduction(00:03:16) Client-side Cloud Service Bug(00:13:38) Cloud Provider Dashboards(00:24:08) Larger Cloud Threat Model(00:37:33) Approach to Hacking Providers that use the Cloud(00:59:53) Identity Services & S3 Buckets

Episode 199: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Brandyn and JD reflect on their experience at a Hardware LHE. They cover some of the bugs they found, what their prep time looked like, and using AI in IoT hacking.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Join us for NahamCon IN PERSONhttps://www.criticalthinkingpodcast.io/Nahamcon====== This Week in Bug Bounty ======Check out Justin’s Dojo on Yes We Hack!https://dojo-yeswehack.com/====== Resources ======Matt Brown Security Traininghttps://training.brownfinesecurity.com/l/products====== Timestamps ======(00:00:00) Introduction(00:07:11) LHE Bugs(00:30:03) Prep Time & Procedure(00:38:41) IoT Hacking with AI

Episode 198: In this episode of Critical Thinking - Bug Bounty Podcast we're back with the spookiest bug stories we've had this year. We're talking government hacks, summoning global agents, low payouts/long triage times, and possibly the scariest thing of all for us: Dealing with JD's technical issues...Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmehttps://x.com/xssdoctorCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Join us for NahamCon IN PERSONhttps://www.criticalthinkingpodcast.io/NahamconSponsored by Intigriti: Join the Waitlist for CrowdRecon!https://www.criticalthinkingpodcast.io/Intigriti-CrowdRecon====== Timestamps ======(00:00:00) Introduction(00:03:08) Full Auth by Migration Endpoint & RCE Sandbox, artifacts, & Blobs(00:16:46) Summoning a Global Agent & Preying on Vulnerable Chatbots(00:27:25) 3d Printer hacks via Tickets (00:34:20) Hacking Healthcare and Governments(00:47:52) Dispatcher RCE & the Tale of 3 Bugs(01:01:05) Pwning IoT Devices (01:10:15) Intuition Hacks & Scary Low Payouts(01:18:25) Hackbot Horror Stories

Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Sponsored by Intigriti: Join the Waitlist for CrowdRecon!https://www.criticalthinkingpodcast.io/Intigriti-CrowdRecon====== This Week in Bug Bounty ======Join the H1 Researcher Community Hub on Discordhttps://discord.gg/PUhMwsTySt====== Resources ======Using Replay Pipelineshttps://docs.caido.io/app/guides/replay_test_race_conditions.htmlSmashing the token limit with overlapping fragmentshttps://portswigger.net/research/smashing-the-token-limitQwen3.8-Flash-Next-FP4-Localhttps://huggingface.co/nvidia/Qwen3.8-Flash-Next-FP4-LocalPrompt Rewriting Tweethttps://x.com/cgtwts/status/2110571916973207906Muse Spark Openhttps://huggingface.co/collections/meta-models/muse-spark-openStealth Benchhttps://stealthbench.com/DreadIndexhttps://dreadnode.io/research/dreadindex/Obliteratedhttps://huggingface.co/OBLITERATUS/feyospace-s1-obliteratedDeepSeek-v4-Flash-DSpark-2x-DGX-Sparkhttps://github.com/MiaAI-Lab/DeepSeek-v4-Flash-DSpark-2x-DGX-Spark====== Timestamps ======(00:00:00) Introduction(00:04:00) Bugs found with Deepseek(00:18:15) Caido Race Conditions & Pipeline Session(00:23:47) Free models in OpenCode, Reset months, and Overlapping Fragments(00:29:54) Local Models & Hardware Optimization(00:46:53) Verifiers & Reflections Agents (00:58:16) Ohmypi, Herdr and other Harnesses(01:09:20) Muse Spark Open & Stealth Bench, & DreadIndex(01:18:35) Keeping agents from fighting

Episode 196: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about how Pentests can help boost morale, the architecture of Building local AI models, and our bug bounty predictions for the future.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== Resources ======UniiChat.comhttps://x.com/VictorTaelin/status/2108200878553588091?s=20The model isn't cooperatinghttps://portswigger.net/research/the-model-isnt-cooperatingScan for Goodhttps://www.wiz.io/blog/scan-for-good-critical-ai-exposures====== Timestamps ======(00:00:00) Introduction(00:04:29) UniiChat, Local architecture, and why the model isn't cooperating(00:12:15) Pentesting Pros and Predictions(00:31:06) Securing Critical Infrastructure, Cyber Verification, & Pentesting Delivery (00:40:35) Bug Bounty Future Predictions

Episode 195: In this episode of Critical Thinking - Bug Bounty Podcast we talk to Frans Rosen and get his take on the Bug Bounty Industry and finding enjoyment in hacking during the AI Slopocalypse.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Sponsored by ThreatLocker - Privileged Access Managementhttps://www.criticalthinkingpodcast.io/tl-pam====== Timestamps ======(00:00:00) Introduction(00:02:48) Bug Bounty Update and AI Dissatisfaction(00:30:27) How Frans Uses AI & Bugs it can't find.(00:46:16) What the Future holds for Bug Bounty

Episode 194: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph cover Faav’s Microsoft hack, Salesforce adjusting their scope, and if/how Jev can be used for Bug BountyFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Sponsored by ThreatLocker - Privileged Access Managementhttps://www.criticalthinkingpodcast.io/tl-pam====== Resources ======How I Could've Accessed 17 Trillion Microsoft Recordshttps://t.co/ASdR0j7rDN====== Timestamps ======(00:00:00) Introduction(00:04:10) Opus 5.5 & Cyber Verification Program(00:12:01) Jev, Tac, and CVP(00:24:45) Turbo Intruder 2(00:31:33) Salesforce's critical error & Faav's Findings

Episode 193: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Jorian Woltjer to talk through his Bug Bounty journey and all the crazy research he’s done for the Critical Thinking Lab.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== Resources ======Cache key injection: Smuggling poison through the doorhttps://www.yeswehack.com/lab/research-cache-key-injection====== Resources ======XS-Leakshttps://xsleaks.dev/Solving an ORB mysteryhttps://lab.ctbb.show/research/solving-an-orb-mysteryResearch Review #24: Solving an ORB mystery (J0R1AN)https://www.youtube.com/watch?v=TpXccQbOb48Stopping Redirectshttps://lab.ctbb.show/research/stopping-redirectsEthical Hacker Groep Nederlandhttps://www.youtube.com/playlist?list=PL-cT3O--POR-ElvSufpZ1oPfyocmWYeos====== Timestamps ======(00:00:00) Introduction(00:04:19) CTFd status code XS-Leak(00:18:05) Jorian's Journey & Solving an ORB mystery(00:33:39) Stopping Redirects(00:58:55) DNS Rebinding in the browser(01:08:47) Popunder: weak password prompt(01:24:33) Declarative partial updates

Episode 192: In this episode of Critical Thinking - Bug Bounty Podcast Justin lays out some goals and tips on PoC Creation.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Sponsored by ThreatLocker - Privileged Access Managementhttps://www.criticalthinkingpodcast.io/tl-pam====== This Week in Bug Bounty ======LHE at Ekoparty, open to all Ekoparty Attendeeshttps://www.yeswehack.com/fr/page/live-hacking-event-banco-galicia-yeswehack-ekoparty-2026Builders & Breakers | Building Hackbots: Models, Harnesses and Human Expertise with Hamid Kashfihttps://www.youtube.com/watch?v=MYK9-66qe6w====== Resources ======Get Justin’s exclusive masterclass for more informationhttps://www.ctbb.show/discord====== Timestamps ======(00:00:00) Introduction(00:05:33) PoC Creation Goals & Formats(00:15:01) Nuts and Bolts of Python & HTML Files

Episode 191: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph talk about successes in scaling their hackbots, and brainstorm possible ways to stretch their AI subscriptions.Follow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: [email protected] to YTCracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater, rez0 and gr3pme on X: https://x.com/Rhynoraterhttps://x.com/rez0__https://x.com/gr3pmeCritical Research Lab:https://lab.ctbb.show/ Need a Pentest? We just launched CTBB Pentests!https://pentest.ctbb.show/Hack full time? Check out the Full-Time Hunter’s Guild!https://ctbb.show/fthg====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!====== This Week in Bug Bounty ======How to use Codex for Bug Bounty research: explore broadly, validate rigorouslyhttps://www.yeswehack.com/learn-bug-bounty/llm-series-codex====== Resources ======Herdrhttps://herdr.dev/====== Timestamps ======(00:00:00) Introduction(00:02:43) Rez0's Sick Caching Bug(00:11:38) Hackbot Scale & Hardware Spend(00:19:16) Stretching your Subscriptions(00:27:53) Herdr.dev & LHE's with Total Bounty Pools