<description>&lt;p&gt;Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.&lt;/p&gt;&lt;p&gt;Follow us on &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/ctbbpodcast"&gt;X&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Got any ideas and suggestions? Feel free to send us any feedback here: &lt;a target="_blank" rel="noopener noreferrer nofollow" href="mailto:info@criticalthinkingpodcast.io"&gt;info@criticalthinkingpodcast.io&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Shoutout to&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://twitter.com/realytcracker"&gt; YTCracker&lt;/a&gt; for the awesome intro music!&lt;/p&gt;&lt;p&gt;====== Links ======&lt;/p&gt;&lt;p&gt;Follow your hosts &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/Rhynorater"&gt;Rhynorater&lt;/a&gt;, &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/rez0__"&gt;rez0&lt;/a&gt; and &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/gr3pme"&gt;gr3pme&lt;/a&gt; on X: &lt;/p&gt;&lt;p&gt;====== Ways to Support CTBBPodcast ======&lt;/p&gt;&lt;p&gt;Hop on the CTBB &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/discord"&gt;Discord!&lt;/a&gt;&lt;/p&gt;&lt;p&gt;We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.&lt;/p&gt;&lt;p&gt;You can also find some hacker swag at &lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/merch"&gt;https://ctbb.show/merch&lt;/a&gt;!&lt;/p&gt;&lt;p&gt;====== Resources ======&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://lab.ctbb.show/research/unicode-surrogates-to-replacement-characters"&gt;Unicode surrogates conversion&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=y_aQQmDMaY4"&gt;Prompt. Scan. Exploit&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=RNXCnJvE1Zg&amp;amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk"&gt;Breaking into thousands of cloud based VPNs with 1 bug&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=mPo-an8BUXc"&gt;Examining Access Control Vulnerabilities in GraphQL&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=AOp0QtUORBc&amp;amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;amp;index=6"&gt;Smart Bus Smart Hacking&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=LCGm5-ZjKK0"&gt;Passkeys Pwned&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=kSJBEZkJ4vM&amp;amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;amp;index=3"&gt;Bypassing Intent Destination Checks&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=CUxbDRR0A8I"&gt;Gemini Agents in Google Calendar&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=JL2PT1Dac3g"&gt;Exploitation of DOM Clobbering Vuln at Scale&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://github.com/jackfromeast/TheHulk"&gt;TheHulk&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=rLnlLLKISyY&amp;amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;amp;index=4"&gt;Smart Devices, Dumb Resets&lt;/a&gt;&lt;/p&gt;&lt;p&gt;&lt;a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=T13YfM8z0lE&amp;amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;amp;index=7"&gt;Mac PRT Cookie Theft&lt;/a&gt;&lt;/p&gt;&lt;p&gt;====== Timestamps ======&lt;/p&gt;&lt;p&gt;(00:00:00) Introduction&lt;/p&gt;&lt;p&gt;(00:10:10) Prompt. Scan. Exploit&lt;/p&gt;&lt;p&gt;(00:23:52) Breaking into thousands of cloud based VPNs with 1 bug&lt;/p&gt;&lt;p&gt;(00:33:25) Access Control Vulns in GraphQL, Smart Bus Hacking, &amp;amp; Passkeys Pwned&lt;/p&gt;&lt;p&gt;(00:44:10) Bypassing Intent Destination Checks &amp;amp; Invoking Gemini Agents&lt;/p&gt;&lt;p&gt;(00:57:08) DOM Clobbering, Mac PRT Cookie Theft, &amp;amp; Smart Devices, Dumb Resets&lt;/p&gt;</description>

Critical Thinking - Bug Bounty Podcast

Justin Gardner (Rhynorater) & Joseph Thacker (Rez0)

Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

NOV 20, 202562 MIN
Critical Thinking - Bug Bounty Podcast

Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

NOV 20, 202562 MIN

Description

<p>Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.</p><p>Follow us on <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/ctbbpodcast">X</a></p><p>Got any ideas and suggestions? Feel free to send us any feedback here: <a target="_blank" rel="noopener noreferrer nofollow" href="mailto:[email protected]">[email protected]</a></p><p>Shoutout to<a target="_blank" rel="noopener noreferrer nofollow" href="https://twitter.com/realytcracker"> YTCracker</a> for the awesome intro music!</p><p>====== Links ======</p><p>Follow your hosts <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/Rhynorater">Rhynorater</a>, <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/rez0__">rez0</a> and <a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/gr3pme">gr3pme</a> on X: </p><p>====== Ways to Support CTBBPodcast ======</p><p>Hop on the CTBB <a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/discord">Discord!</a></p><p>We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.</p><p>You can also find some hacker swag at <a target="_blank" rel="noopener noreferrer nofollow" href="https://ctbb.show/merch">https://ctbb.show/merch</a>!</p><p>====== Resources ======</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://lab.ctbb.show/research/unicode-surrogates-to-replacement-characters">Unicode surrogates conversion</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=y_aQQmDMaY4">Prompt. Scan. Exploit</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=RNXCnJvE1Zg&amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk">Breaking into thousands of cloud based VPNs with 1 bug</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=mPo-an8BUXc">Examining Access Control Vulnerabilities in GraphQL</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=AOp0QtUORBc&amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;index=6">Smart Bus Smart Hacking</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=LCGm5-ZjKK0">Passkeys Pwned</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=kSJBEZkJ4vM&amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;index=3">Bypassing Intent Destination Checks</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=CUxbDRR0A8I">Gemini Agents in Google Calendar</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=JL2PT1Dac3g">Exploitation of DOM Clobbering Vuln at Scale</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://github.com/jackfromeast/TheHulk">TheHulk</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=rLnlLLKISyY&amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;index=4">Smart Devices, Dumb Resets</a></p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.youtube.com/watch?v=T13YfM8z0lE&amp;list=PL6rDwEAPMIRSsWupDGpV4bMf7CiLTF0wk&amp;index=7">Mac PRT Cookie Theft</a></p><p>====== Timestamps ======</p><p>(00:00:00) Introduction</p><p>(00:10:10) Prompt. Scan. Exploit</p><p>(00:23:52) Breaking into thousands of cloud based VPNs with 1 bug</p><p>(00:33:25) Access Control Vulns in GraphQL, Smart Bus Hacking, &amp; Passkeys Pwned</p><p>(00:44:10) Bypassing Intent Destination Checks &amp; Invoking Gemini Agents</p><p>(00:57:08) DOM Clobbering, Mac PRT Cookie Theft, &amp; Smart Devices, Dumb Resets</p>