Episode 149: DEFCON Debrief: AI Vulns, Unicode Weirdness, and Wild Vulnerability Chains

Episode 149: In this episode of Critical Thinking - Bug Bounty Podcast The DEFCON videos are up, and Justin and Joseph talk through some of their favorites.
Follow us on X (x.com/ctbbpodcast)
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout toYTCracker (twitter.com/realytcracker) for the awesome intro music!
====== Links ======
Follow your hosts x.com/Rhynorater, x.com/rez0__ and x.com/gr3pme on X:
====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord! (ctbb.show/discord)
We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.
You can also find some hacker swag at ctbb.show/merch!
====== Resources ======
Unicode surrogates conversion (lab.ctbb.show/research/unicode-surrogates-to-r…)
Prompt. Scan. Exploit (youtube.com/watch?v=y_aQQmDMaY4)
Breaking into thousands of cloud based VPNs with 1 bug (youtube.com/watch?v=RNXCnJvE1Zg&list=PL6rD…)
Examining Access Control Vulnerabilities in GraphQL (youtube.com/watch?v=mPo-an8BUXc)
Smart Bus Smart Hacking (youtube.com/watch?v=AOp0QtUORBc&list=PL6rD…)
Passkeys Pwned (youtube.com/watch?v=LCGm5-ZjKK0)
Bypassing Intent Destination Checks (youtube.com/watch?v=kSJBEZkJ4vM&list=PL6rD…)
Gemini Agents in Google Calendar (youtube.com/watch?v=CUxbDRR0A8I)
Exploitation of DOM Clobbering Vuln at Scale (youtube.com/watch?v=JL2PT1Dac3g)
github.com/jackfromeast/TheHulk
Smart Devices, Dumb Resets (youtube.com/watch?v=rLnlLLKISyY&list=PL6rD…)
Mac PRT Cookie Theft (youtube.com/watch?v=T13YfM8z0lE&list=PL6rD…)
====== Timestamps ======
(00:00:00) Introduction
(00:10:10) Prompt. Scan. Exploit
(00:23:52) Breaking into thousands of cloud based VPNs with 1 bug
(00:33:25) Access Control Vulns in GraphQL, Smart Bus Hacking, & Passkeys Pwned
(00:44:10) Bypassing Intent Destination Checks & Invoking Gemini Agents
(00:57:08) DOM Clobbering, Mac PRT Cookie Theft, & Smart Devices, Dumb Resets