Critical Thinking - Bug Bounty Podcast

Episode 197: In this episode of Critical Thinking - Bug Bounty Podcast Joseph, Brandyn, and Ads serve up some tips on how they’re using local AI Models and optimizing their hardware.

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
https://x.com/Rhynorater
https://x.com/rez0__
https://x.com/gr3pme

Critical Research Lab:
https://lab.ctbb.show/

Need a Pentest? We just launched CTBB Pentests!
https://pentest.ctbb.show/

Hack full time? Check out the Full-Time Hunter’s Guild!
https://ctbb.show/fthg

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Sponsored by Intigriti: Join the Waitlist for CrowdRecon!
https://www.intigriti.com/researchers/product/crowdrecon

====== This Week in Bug Bounty ======

Join the H1 Researcher Community Hub on Discord
https://discord.gg/PUhMwsTySt

====== Resources ======

Using Replay Pipelines
https://docs.caido.io/app/guides/replay_test_race_conditions.html

Smashing the token limit with overlapping fragments
https://portswigger.net/research/smashing-the-token-limit

Qwen3.8-Flash-Next-FP4-Local
https://huggingface.co/nvidia/Qwen3.8-Flash-Next-FP4-Local

Prompt Rewriting Tweet
https://x.com/cgtwts/status/2110571916973207906

Muse Spark Open
https://huggingface.co/collections/meta-models/muse-spark-open

Stealth Bench
https://stealthbench.com/

DreadIndex
https://dreadnode.io/research/dreadindex/

Obliterated
https://huggingface.co/OBLITERATUS/feyospace-s1-obliterated

DeepSeek-v4-Flash-DSpark-2x-DGX-Spark
https://github.com/MiaAI-Lab/DeepSeek-v4-Flash-DSpark-2x-DGX-Spark

====== Timestamps ======
(00:00:00) Introduction
(00:04:00) Bugs found with Deepseek
(00:18:15) Caido Race Conditions & Pipeline Session
(00:23:47) Free models in OpenCode, Reset months, and Overlapping Fragments
(00:29:54) Local Models & Hardware Optimization
(00:46:53) Verifiers & Reflections Agents
(00:58:16) Ohmypi, Herdr and other Harnesses
(01:09:20) Muse Spark Open & Stealth Bench, & DreadIndex
(01:18:35) Keeping agents from fighting

Episode 196: In this episode of Critical Thinking - Bug Bounty Podcast we’re talking about how Pentests can help boost morale, the architecture of Building local AI models, and our bug bounty predictions for the future.

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
https://x.com/Rhynorater
https://x.com/rez0__
https://x.com/gr3pme

Critical Research Lab:
https://lab.ctbb.show/

Need a Pentest? We just launched CTBB Pentests!
https://pentest.ctbb.show/

Hack full time? Check out the Full-Time Hunter’s Guild!
https://ctbb.show/fthg

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

====== Resources ======
UniiChat.com
https://x.com/VictorTaelin/status/2108200878553588091?s=20

The model isn't cooperating
https://portswigger.net/research/the-model-isnt-cooperating

Scan for Good
https://www.wiz.io/blog/scan-for-good-critical-ai-exposures

====== Timestamps ======
(00:00:00) Introduction
(00:04:29) UniiChat, Local architecture, and why the model isn't cooperating
(00:12:15) Pentesting Pros and Predictions
(00:31:06) Securing Critical Infrastructure, Cyber Verification, & Pentesting Delivery
(00:40:35) Bug Bounty Future Predictions

Episode 195: In this episode of Critical Thinking - Bug Bounty Podcast we talk to Frans Rosen and get his take on the Bug Bounty Industry and finding enjoyment in hacking during the AI Slopocalypse.

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
https://x.com/Rhynorater
https://x.com/rez0__
https://x.com/gr3pme

Critical Research Lab:
https://lab.ctbb.show/

Need a Pentest? We just launched CTBB Pentests!
https://pentest.ctbb.show/

Hack full time? Check out the Full-Time Hunter’s Guild!
https://ctbb.show/fthg

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam

====== Timestamps ======
(00:00:00) Introduction
(00:02:48) Bug Bounty Update and AI Dissatisfaction
(00:30:27) How Frans Uses AI & Bugs it can't find.
(00:46:16) What the Future holds for Bug Bounty

Episode 194: In this episode of Critical Thinking - Bug Bounty Podcast Justin and Joseph cover Faav’s Microsoft hack, Salesforce adjusting their scope, and if/how Jev can be used for Bug Bounty

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
https://x.com/Rhynorater
https://x.com/rez0__
https://x.com/gr3pme

Critical Research Lab:
https://lab.ctbb.show/

Need a Pentest? We just launched CTBB Pentests!
https://pentest.ctbb.show/

Hack full time? Check out the Full-Time Hunter’s Guild!
https://ctbb.show/fthg

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Sponsored by ThreatLocker - Privileged Access Management
https://www.criticalthinkingpodcast.io/tl-pam

====== Resources ======

How I Could've Accessed 17 Trillion Microsoft Records
https://t.co/ASdR0j7rDN

====== Timestamps ======
(00:00:00) Introduction
(00:04:10) Opus 5.5 & Cyber Verification Program
(00:12:01) Jev, Tac, and CVP
(00:24:45) Turbo Intruder 2
(00:31:33) Salesforce's critical error & Faav's Findings

Episode 193: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Jorian Woltjer to talk through his Bug Bounty journey and all the crazy research he’s done for the Critical Thinking Lab.

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to YTCracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater, rez0 and gr3pme on X:
https://x.com/Rhynorater
https://x.com/rez0__
https://x.com/gr3pme

Critical Research Lab:
https://lab.ctbb.show/

Need a Pentest? We just launched CTBB Pentests!
https://pentest.ctbb.show/

Hack full time? Check out the Full-Time Hunter’s Guild!
https://ctbb.show/fthg

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

====== Resources ======
Cache key injection: Smuggling poison through the door
https://www.yeswehack.com/lab/research-cache-key-injection

====== Resources ======
XS-Leaks
https://xsleaks.dev/

Solving an ORB mystery
https://lab.ctbb.show/research/solving-an-orb-mystery

Research Review #24: Solving an ORB mystery (J0R1AN)
https://www.youtube.com/watch?v=TpXccQbOb48

Stopping Redirects
https://lab.ctbb.show/research/stopping-redirects

Ethical Hacker Groep Nederland
https://www.youtube.com/playlist?list=PL-cT3O--POR-ElvSufpZ1oPfyocmWYeos

====== Timestamps ======
(00:00:00) Introduction
(00:04:19) CTFd status code XS-Leak
(00:18:05) Jorian's Journey & Solving an ORB mystery
(00:33:39) Stopping Redirects
(00:58:55) DNS Rebinding in the browser
(01:08:47) Popunder: weak password prompt
(01:24:33) Declarative partial updates