Episode 146: Hacking Horror Stories
Critical Thinking - Bug Bounty Podcast30 Loka 2025

Episode 146: Hacking Horror Stories

Episode 146: In this episode of Critical Thinking - Bug Bounty Podcast Justin, Joseph, and Brandyn all sit down to celebrate the spooky season by swapping their scariest bug stories. From frightening fails and firings to hacks with chilling and critical consequences. Grab your flashlight and a blanket for this one!

Follow us on twitter at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater, rez0 and gr3pme on X:

https://x.com/Rhynorater

https://x.com/rez0__

https://x.com/gr3pme

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today's Sponsor: ThreatLocker. Check out ThreatLocker Network Control

https://www.criticalthinkingpodcast.io/tl-nc

====== This Week in Bug Bounty ======

Methodology tips from top Bug Bounty hunters

YesWeHack marks first year of partnership with Singapore’s Government

HackerOne Hacker-Powered Security Report

====== Resources ======

Critical Research Lab

Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office

File Creation via SQLite Injection

====== Timestamps ======

(00:00:00) Introduction

(00:10:11) Crit Research Lab News

(00:21:31) Hacking the World Poker Tour & File Creation via SQLite Injection

(00:30:40) Brandyn's Spooky Bug

(00:38:02) Joseph's Spooky Bug

(00:44:18) Justin's Spooky Bug

(00:54:44) Banking Bugs, LHE Scares, and Workday weirdness.

(01:14:52) Firings and failures

(01:22:49) Bank Bug Redux

(01:35:55) Wedding planning/registry app & Amazon Rufus bugs

(01:40:52) New Relic bug

Jaksot(161)

Episode 81: Crushing Client-Side on Any Scope with MatanBer

Episode 81: Crushing Client-Side on Any Scope with MatanBer

Episode 81: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by MatanBer to go over some recent bug reports, as well as share some tips and tricks on client-side hacking and ...

25 Heinä 20242h 4min

Episode 80: Pwn2Own VS H1 Live Hacking Event (feat SinSinology)

Episode 80: Pwn2Own VS H1 Live Hacking Event (feat SinSinology)

Episode 80: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Sina Kheirkhah to talk about the start of his hacking journey and explore the differences between the Pwn2Own ...

18 Heinä 20242h 49min

Episode 79: The State of CSS Injection - Leaking Text Nodes & HTML Attributes

Episode 79: The State of CSS Injection - Leaking Text Nodes & HTML Attributes

Episode 79: In this episode of Critical Thinking - Bug Bounty Podcast we deepdive CSS injection, and explore topics like sequential import chaining, font ligatures, and attribute exfiltration.Follow u...

11 Heinä 20241h 10min

Episode 78: Less Writing, More Hacking - Reporting Efficiency Techniques

Episode 78: Less Writing, More Hacking - Reporting Efficiency Techniques

Episode 78: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about writing reports. We share some tips that we’ve learned, and discuss ways that AI can (and can’t) help with tha...

4 Heinä 20241h 6min

Episode 77: Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

Episode 77: Bug Bounty Mental - Practical Tips for Staying Sharp & Motivated

Episode 77: In this episode of Critical Thinking - Bug Bounty Podcast Joel and Justin discuss some fresh writeups including some MongoDB injections, ORMs, and exploits in Kakao and iOS before pivoting...

27 Kesä 20241h 50min

Episode 76: Match & Replace - HTTP Proxies' Most Underrated Feature

Episode 76: Match & Replace - HTTP Proxies' Most Underrated Feature

Episode 76: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about Match and Replace and the often overlooked use cases for it, like bypassing paywalls, modifying host headers, ...

20 Kesä 20241h 34min

Episode 75: *Rerun* of The OG Bug Bounty King - Frans Rosen

Episode 75: *Rerun* of The OG Bug Bounty King - Frans Rosen

Episode 75: In this episode of Critical Thinking - Bug Bounty Podcast, Justin and Joel are sick, So instead of a new full episode, we're going back 30 episodes to review.Follow us on twitter at: @ctbb...

13 Kesä 20242h 44min

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: Supply Chain Attack Primer - Popping RCE Without an HTTP Request (feat 0xLupin)

Episode 74: In this episode of Critical Thinking - Bug Bounty Podcast Justin sits down with Roni "Lupin" Carta for a deep dive into supply chain attacks and dependency confusion. We explore the supply...

6 Kesä 20241h 38min