Episode 128: New Research in Blind SSRF and Self-XSS, and How to Architect Source-code Review AI Bots

Episode 128: In this episode of Critical Thinking - Bug Bounty Podcast we talking Blind SSRF and Self-XSS, as well as Reversing massive minified JS with AI and a wild Google Logo Ligature Bug
Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts Rhynorater and Rez0 on Twitter:
x.com/Rhynorater
x.com/rez0__
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
Today's Sponsor: ThreatLocker - Patch Management (criticalthinkingpodcast.io/TL-patch-management)
====== This Week in Bug Bounty ======
BitK's "Payload plz" challenge at LeHack (yeswehack.com/page/yeswehack-at-lehack-2025)

====== Resources ======
Make Self-XSS Great Again (blog.slonser.info/posts/make-self-xss-great-ag…)
Novel SSRF Technique Involving HTTP Redirect Loops (x.com/infosec_au/status/1937103837334323472)
Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments (github.com/assetnote/surf)
Gecko: Intent to prototype: Framebusting Intervention (x.com/intenttoship/status/1937135319142293805)
Conducting smarter intelligences than me: new orchestras (southbridge-research.notion.site/conducting-sm…)
Mandark (github.com/hrishioa/mandark)
Lumentis (github.com/hrishioa/lumentis)
github.com/xssdoctor/jscollab
Google Logo Ligature Bug (jefftk.com/p/google-logo-ligature-bug)

====== Timestamps ======
(00:00:00) Introduction
(00:03:55) Self-XSS and credentialless iframe
(00:16:50) Novel SSRF Technique Involving HTTP Redirect Loops
(00:25:02) Framebusting
(00:29:13) Reversing massive minified JS with AI
(00:53:12) Google Logo Ligature Bug