Podcast Guru LogoPodcast Guru LogosearchSearchDiscoverMy Podcasts
Apple App Store BadgeGoogle Play Badge
sign-inSign In
menu
close
sign-inSign In
Discover
My Podcasts
Apple App Store Badge
Google Play Badge
<description>&lt;p&gt;Episode 112: In this episode of Critical Thinking - Bug Bounty Podcast Joseph Thacker is joined by Ciarán Cotter (Monke) to share his bug hunting journey and give us the rundown on some recent client-side and server-side bugs. Then they discuss WebSockets, SaaS security, and cover some AI news including Grok 3, Nuclei -AI Flag, and some articles by Johann Rehberger.&lt;/p&gt;&lt;p&gt;Follow us on twitter at: &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/ctbbpodcast"&gt;https://x.com/ctbbpodcast&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Got any ideas and suggestions? Feel free to send us any feedback here: &lt;a target="_blank" rel="noopener noreferrer nofollow" href="mailto:info@criticalthinkingpodcast.io"&gt;info@criticalthinkingpodcast.io&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Shoutout to&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://twitter.com/realytcracker"&gt; YTCracker&lt;/a&gt; for the awesome intro music!&lt;/p&gt;&lt;p&gt;&lt;strong&gt;====== Links ======&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Follow your hosts Rhynorater and Rez0 on Twitter:&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/Rhynorater"&gt;&lt;strong&gt;https://x.com/Rhynorater&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/rez0__"&gt;&lt;strong&gt;https://x.com/rez0__&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;====== Ways to Support CTBBPodcast ======&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Hop on the CTBB Discord at &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/discord"&gt;https://ctbb.show/discord&lt;/a&gt;!&lt;/p&gt;&lt;p&gt;We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.&lt;/p&gt;&lt;p&gt;You can also find some hacker swag at &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/merch"&gt;https://ctbb.show/merch&lt;/a&gt;!&lt;/p&gt;&lt;p&gt;Today’s Guest - Ciarán Cotter&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/monkehack"&gt;https://x.com/monkehack&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;====== Resources ======&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Msty&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://msty.app/"&gt;https://msty.app/&lt;/a&gt;&lt;/p&gt;&lt;p&gt;From Day Zero to Zero Day&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://nostarch.com/zero-day"&gt;https://nostarch.com/zero-day&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Nuclei - ai flag&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/pdiscoveryio/status/1890082913900982763"&gt;https://x.com/pdiscoveryio/status/1890082913900982763&lt;/a&gt;&lt;/p&gt;&lt;p&gt;ChatGPT Operator: Prompt Injection Exploits &amp;amp; Defenses&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/"&gt;https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocation&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/"&gt;https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;====== Timestamps ======&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;(00:00:00) Introduction&lt;/p&gt;&lt;p&gt;(00:01:04) Bug Rundowns&lt;/p&gt;&lt;p&gt;(00:13:05) Monke's Bug Bounty Background&lt;/p&gt;&lt;p&gt;(00:20:03) Websocket Research&lt;/p&gt;&lt;p&gt;(00:34:01) Connecting Hackers with Companies&lt;/p&gt;&lt;p&gt;(00:34:56) Grok 3, Msty, From Day Zero to Zero Day&lt;/p&gt;&lt;p&gt;(00:42:58) Full time Bug Bounty, SaaS security, and Threat Modeling while AFK&lt;/p&gt;&lt;p&gt;(00:54:49) Nuclei - ai flag, ChatGPT Operator, and Hacking Gemini's Memory&lt;/p&gt;</description>

Critical Thinking - Bug Bounty Podcast

Justin Gardner (Rhynorater) & Joseph Thacker (Rez0)

Episode 112: Interview with Ciarán Cotter (MonkeHack) - Critical Lab Researcher and Full-time Hunter

FEB 27, 202567 MIN
Critical Thinking - Bug Bounty Podcast

Episode 112: Interview with Ciarán Cotter (MonkeHack) - Critical Lab Researcher and Full-time Hunter

FEB 27, 202567 MIN

Description

<p>Episode 112: In this episode of Critical Thinking - Bug Bounty Podcast Joseph Thacker is joined by Ciarán Cotter (Monke) to share his bug hunting journey and give us the rundown on some recent client-side and server-side bugs. Then they discuss WebSockets, SaaS security, and cover some AI news including Grok 3, Nuclei -AI Flag, and some articles by Johann Rehberger.</p><p>Follow us on twitter at: <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/ctbbpodcast">https://x.com/ctbbpodcast</a></p><p>Got any ideas and suggestions? Feel free to send us any feedback here: <a target="_blank" rel="noopener noreferrer nofollow" href="mailto:info@criticalthinkingpodcast.io">info@criticalthinkingpodcast.io</a></p><p>Shoutout to<a target="_blank" rel="noopener noreferrer nofollow" href="https://twitter.com/realytcracker"> YTCracker</a> for the awesome intro music!</p><p><strong>====== Links ======</strong></p><p>Follow your hosts Rhynorater and Rez0 on Twitter:</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/Rhynorater"><strong>https://x.com/Rhynorater</strong></a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/rez0__"><strong>https://x.com/rez0__</strong></a></p><p><strong>====== Ways to Support CTBBPodcast ======</strong></p><p>Hop on the CTBB Discord at <a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/discord">https://ctbb.show/discord</a>!</p><p>We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.</p><p>You can also find some hacker swag at <a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/merch">https://ctbb.show/merch</a>!</p><p>Today’s Guest - Ciarán Cotter</p><ul><li><a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/monkehack">https://x.com/monkehack</a></li></ul><p><strong>====== Resources ======</strong></p><p>Msty</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://msty.app/">https://msty.app/</a></p><p>From Day Zero to Zero Day</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://nostarch.com/zero-day">https://nostarch.com/zero-day</a></p><p>Nuclei - ai flag</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/pdiscoveryio/status/1890082913900982763">https://x.com/pdiscoveryio/status/1890082913900982763</a></p><p>ChatGPT Operator: Prompt Injection Exploits &amp; Defenses</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/">https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/</a></p><p>Hacking Gemini's Memory with Prompt Injection and Delayed Tool Invocation</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/">https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/</a></p><p><strong>====== Timestamps ======</strong></p><p>(00:00:00) Introduction</p><p>(00:01:04) Bug Rundowns</p><p>(00:13:05) Monke's Bug Bounty Background</p><p>(00:20:03) Websocket Research</p><p>(00:34:01) Connecting Hackers with Companies</p><p>(00:34:56) Grok 3, Msty, From Day Zero to Zero Day</p><p>(00:42:58) Full time Bug Bounty, SaaS security, and Threat Modeling while AFK</p><p>(00:54:49) Nuclei - ai flag, ChatGPT Operator, and Hacking Gemini's Memory</p>