Archive | Critical Thinking - Bug Bounty Podcast

[HackerNotes Ep.116] Auth Bypasses and Google VRP Writeups

We've got Portswigger’s SAML Roulette writeup, as well as some Google VRP reports, and a Next.js middleware exploit.

Mar 22, 2025

[HackerNotes Ep. 115] Mentee to Career Hacker - So Sakaguchi

Justin and So Sakaguchi sit down to walk through some recent bugs, before having a live mentorship session. They also talk about Reflector, and finish up by doing a bonus podcast segment in Japanese!

Yujilik

Mar 14, 2025

[HackerNotes Ep.114] Single Page Application Hacking Playbook

We're diving into Single Page Applications (SPAs) and how to attack them. We also cover a host of news items, including some bug write-ups, AI updates, and a new tool called Hackadvisor.

gr3pme

Mar 07, 2025

[HackerNotes Ep.113] Best Technical Takeaways from Portswigger Top 10 2024

We’re breaking down some of the best takeaways from PortSwiggers Top 10 of 2024. There’s some bangers in here!

Yujilik

Mar 01, 2025

[HackerNotes Ep.112] Interview with Ciarán Cotter (MonkeHack) Critical Lab Researcher and Full-time Hunter

We've got Monke breaking down some of his cool bug chains, some fresh WebSockets research ideas, a bunch of AI news, prompt injection research and some newsletters. Check it out below.

gr3pme

Feb 21, 2025

[HackerNotes Ep.111] How to Bypass DOMPurify with Kévin Mizu

In this episode Justin interviews Kévin Mizu to showcase his knowledge regarding DOMPurify and its misconfigurations. We walk through some of Kevin’s research, highlighting things like Dangerous allow-lists and URI Attributes, DOMPurify hooks, node manipulation, and DOM Clobbering.

Yujilik

Feb 14, 2025

[HackerNotes Ep.110] Oauth Gadget Correlation and Common Attacks

A DOMPurify 3.2.3 Bypass, Ophion Security Cisco Webex research, a new postMessage Chrome Extension, and a whole lot of OAuth research. Check it out below.

gr3pme

Feb 07, 2025

[HackerNotes Ep. 109] Creative Recon - Alternative Techniques

In this episode of Critical Thinking - Bug Bounty Podcast we start off with a quick recap of some of the DeepSeek Drama that’s been going down, and discuss AI in CAPTCHA and 2FA as well. Then we switch to cover some other news before settling in to talk about Alternative Recon Techniques.

Yujilik

Feb 03, 2025

[HackerNotes Ep.108] How to Hack Salesforce, ServiceNow, and Other SaaS Products With Aaron Costello

Justin and Joseph bring on Aaron Costello to discuss SaaS security and misconfigurations as a bug class. He also gives some in-depth examples on research he's performed on Salesforce, ServiceNow, and Power Pages.

gr3pme

Jan 27, 2025

[HackerNotes Ep.107] Bypassing Cross-Origin Browser Headers

Justin and Joseph are tackling the subject of cross-origin security headers. They also cover some news items including Google’s OAuth login flaw, RAINK, and gift card hacking

Yujilik

Jan 17, 2025

[HackerNotes Ep.106] Announcing our new Co-Host...

We announce our new co-host of the podcast: Joseph Thacker Aka Rez0! We also cover some cool research including doubleclickjacking, character set attacks, SVG XSS, CSPT and a bunch more. Check it out below.

gr3pme

Jan 11, 2025

[HackerNotes Ep.105] Best Moments of 2024 on the Pod

We're back with another Best-of episode recapping some of our top moments of the year. This one captures some of the cooler tips and takeaways from this years episodes along with links to the original episode. Check it out below.

Yujilik

First Back

1 2 3 4 5 6

Next Last