Episode 142: Gr3pme's Full-Time Hunting Journey Update, Insane AI research, And Some Light News

Episode 142: In this episode of Critical Thinking - Bug Bounty Podcast Rez0 and Gr3pme join forces to discuss Websocket research, Meta’s $111750 Bug, PROMISQROUTE, and the opportunities afforded by going full time in Bug Bounty.
Follow us on twitter at: x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts x.com/Rhynorater and Rez0 (x.com/rez0__) on Twitter:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at ctbb.show/discord!
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
Today's Sponsor: ThreatLocker. Check out ThreatLocker DAC (criticalthinkingpodcast.io/tl-dac)
Today’s Guest: x.com/gr3pme
====== This Week in Bug Bounty ======
New Monthly Dojo challenge and Dojo UI design (dojo-yeswehack.com/challenge-of-the-month)
The ultimate Bug Bounty guide to exploiting race condition vulnerabilities in web applications (yeswehack.com/learn-bug-bounty/ultimate-guide-…)
Watch Our boy Brandyn on the TV (x.com/marketingrckstr/status/1967958828424802461)
====== Resources ======
murtasec.com
WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine (portswigger.net/research/websocket-turbo-intru…)
Remote code execution though vulnerability in Facebook Messenger for Windows (vulnano.com/2025/09/remote-code-execution-thou…)
Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex (semgrep.dev/blog/2025/finding-vulnerabilities-…)
Mind the Gap (arxiv.org/pdf/2508.17155)
PROMISQROUTE (adversa.ai/blog/promisqroute-gpt-5-ai-router-n…)
====== Timestamps ======
(00:00:00) Introduction
(00:05:16) Full Time Bug Bounty and Business Startups
(00:15:50) Websockets
(00:22:17) Meta’s $111750 Bug
(00:28:38) Finding vulns using Claude Code and OpenAI Codex
(00:39:32) Time-of-Check to Time-of-Use Vulns in LLM-Enabled Agents
(00:45:22) PROMISQROUTE