Episode 130: In this episode of Critical Thinking - Bug Bounty Podcast Justin is joined by Valentino, who shares his journey from hacking Minecraft to becoming a Google hunter. He talks us through several bugs, including an HTML Sanitizer bypass and .NET deserialization, and highlights the hyper creative approaches he tends to employ.

Follow us on twitter at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today's Sponsor: ThreatLocker - Patch Management

https://www.criticalthinkingpodcast.io/TL-patch-management

Today’s Guest: Valentino - https://blog.3133700.xyz/

====== Resources ======

JMX Manager

Stored XSS in reclamos

Command Injection in Vertex AI

whitepaper-net-deser.pdf

free-after-use.go

A Journey Into Finding Vulnerabilities in the PMB Library Management System

emulated-register_globals.php

====== Timestamps ======

(00:00:00) Introduction

(00:02:38) JMXProxy Bug Story

(00:09:46) Intro to Valentino

(00:29:08) HTML Sanitizer bypass on MercadoLibre

(00:37:16) Command injection in Vertex AI

(00:44:10) .NET deserialization, & Argument injection to LFR, & Free after use

(00:51:33) Luck, creativity, and evolution as Hacker

(00:59:31) Issues in file extension validation components, Emulated register_globals, & AI Hacking

Episode 129: In this episode of Critical Thinking - Bug Bounty Podcast we chat about the future of hack bots and human-AI collaboration, the challenges posed by tokenization, and the need for cybersecurity professionals to adapt to the evolving landscape of hacking in the age of AI

Follow us on twitter at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

====== This Week in Bug Bounty ======

Improper error handling in async cryptographic operations crashes process

https://hackerone.com/reports/2817648

Recon Series #6: Excavating hidden artifacts with Wayback Machine

https://www.yeswehack.com/learn-bug-bounty/recon-wayback-machine-web-archive

====== Resources ======

This is How They Tell Me Bug Bounty Ends

https://josephthacker.com/hacking/2025/06/09/this-is-how-they-tell-me-bug-bounty-ends.html

Welcome, Hackbots: How AI Is Shaping the Future of Vulnerability Discovery

https://www.hackerone.com/blog/welcome-hackbots-how-ai-shaping-future-vulnerability-discovery

Glitch Token

https://www.youtube.com/watch?v=WO2X3oZEJOA

Conducting smarter intelligences than me: new orchestras

https://southbridge-research.notion.site/conducting-smarter-intelligences-than-me

====== Timestamps ======

(00:00:00) Introduction

(00:04:05) Is this how Bug Bounty Ends?

(00:11:14) Hackbots and handling leads

(00:20:50) Hacker chain of thought & Tokenization

(00:32:54) Context Engineering

Episode 128: In this episode of Critical Thinking - Bug Bounty Podcast we talking Blind SSRF and Self-XSS, as well as Reversing massive minified JS with AI and a wild Google Logo Ligature Bug

Follow us on twitter at: https://x.com/ctbbpodcast

Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io

Shoutout to YTCracker for the awesome intro music!

====== Links ======

Follow your hosts Rhynorater and Rez0 on Twitter:

https://x.com/Rhynorater

https://x.com/rez0__

====== Ways to Support CTBBPodcast ======

Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today's Sponsor: ThreatLocker - Patch Management

====== This Week in Bug Bounty ======

BitK's "Payload plz" challenge at LeHack

====== Resources ======

Make Self-XSS Great Again

Novel SSRF Technique Involving HTTP Redirect Loops

Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments

Gecko: Intent to prototype: Framebusting Intervention

Conducting smarter intelligences than me: new orchestras

Mandark

Lumentis

jscollab

Google Logo Ligature Bug

====== Timestamps ======

(00:00:00) Introduction

(00:03:55) Self-XSS and credentialless iframe

(00:16:50) Novel SSRF Technique Involving HTTP Redirect Loops

(00:25:02) Framebusting

(00:29:13) Reversing massive minified JS with AI

(00:53:12) Google Logo Ligature Bug