Episode 130: Minecraft Hacks to Google Hacking Star - Valentino
Critical Thinking - Bug Bounty Podcast10 Heinä 2025

Episode 130: Minecraft Hacks to Google Hacking Star - Valentino

Episode 130: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Valentino, who shares his journey from hacking Minecraft to becoming a Google hunter. He talks us through several bugs, including an HTML Sanitizer bypass and .NET deserialization, and highlights the hyper creative approaches he tends to employ.

Follow us on twitter at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today's Sponsor: ThreatLocker - Patch Management

https://www.criticalthinkingpodcast.io/TL-patch-management

Today’s Guest: Valentino - https://blog.3133700.xyz/

====== Resources ======

JMX Manager

Stored XSS in reclamos

Command Injection in Vertex AI

whitepaper-net-deser.pdf

free-after-use.go

A Journey Into Finding Vulnerabilities in the PMB Library Management System

emulated-register_globals.php

====== Timestamps ======

(00:00:00) Introduction

(00:02:38) JMXProxy Bug Story

(00:09:46) Intro to Valentino

(00:29:08) HTML Sanitizer bypass on MercadoLibre

(00:37:16) Command injection in Vertex AI

(00:44:10) .NET deserialization, & Argument injection to LFR, & Free after use

(00:51:33) Luck, creativity, and evolution as Hacker

(00:59:31) Issues in file extension validation components, Emulated register_globals, & AI Hacking

Jaksot(166)

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis)

Episode 6: Mobile Hacking Attack Vectors with Teknogeek (Joel Margolis)

Episode 6: In this episode of Critical Thinking - Bug Bounty Podcast we sit down with mobile hacking legend Joel Margolis and get the scoop on his approach to popping bugs on Android.Follow us on twit...

9 Helmi 20231h 39min

Episode 4: H1-407 Event Madness & Takeaways Part 2 w/ Special Guest Spaceraccoon

Episode 4: H1-407 Event Madness & Takeaways Part 2 w/ Special Guest Spaceraccoon

Episode 4: In this episode of Critical Thinking - Bug Bounty Podcast we have part two of our series on the H1-407 HackerOne Live Hacking Event. This time, we have a special guest SpaceRaccoon (@spacer...

2 Helmi 202345min

Episode 5: AI Security, Hacking WiFi, the New XSS Hunter, and more

Episode 5: AI Security, Hacking WiFi, the New XSS Hunter, and more

Episode 5: In this episode of Critical Thinking - Bug Bounty Podcast we talk about the new XSS Hunter, MD5 collisions and using ChatGPT for security, and much more!Follow us on twitter at: @ctbbpodcas...

2 Helmi 202353min

Episode 3: H1-407 Event Madness & Takeaways Part 1

Episode 3: H1-407 Event Madness & Takeaways Part 1

Episode 3: In this episode of Critical Thinking - Bug Bounty Podcast we talk about some of the interesting things we’ve learned from participating in HackerOne's H1-407 Live Hacking event. We cover de...

26 Tammi 202345min

Episode 2: Exploit Writing & Automation / Do you need to know how to program to hack?

Episode 2: Exploit Writing & Automation / Do you need to know how to program to hack?

Episode 2: In this episode of Critical Thinking - Bug Bounty Podcast we talk about exploit writing/automation, some new tools released in the industry (Of-CORS), the age old question of "Do you have t...

18 Tammi 20231h 14min

Episode 1: Introductions, Bug Bounty Reports, and BB Tips

Episode 1: Introductions, Bug Bounty Reports, and BB Tips

Episode 1: In this episode of Critical Thinking - Bug Bounty Podcast, Joel Margolis (aka 0xteknogeek) and Justin Gardner (aka Rhynorater) cover introductions, a couple of cool bug bounty reports, and ...

10 Tammi 202355min