Episode 190: Hacker Life Coaching & is Rez0 a Claude Shill?

Title: Transcript - Thu, 03 Sep 2026 13:16:25 GMT
Date: Thu, 03 Sep 2026 13:16:25 GMT, Duration: [00:33:51.93]
[00:00:01.01] - Justin Gardner
If you can get access to some sort of, um, you know, cloud provider admin panel or like, uh, cloud provider auth bypass, you can take over the world, bro. 

[00:00:38.96] - Justin Gardner
So you guys know how I've said on the pod a couple times, taking your spiky bug bounty income, right? You get a big bounty and then maybe no bounty for a while and converting it into something that gives you more consistent passive income is a great idea, right? For me, that is real estate. And I've done that a couple times. I have a couple rental properties. It's a great situation. However, I will say I live in the US, and if you're looking at the screen right now, you can see ThreatLocker's write-up of a blog talking about how Romania's land registry, the whole country of Romania, was brought to its knees this past July by a threat actor going in with valid credentials that they got from phishing and end-of-day vulnerabilities and pivoting around and completely destroying the entire system. This whole attack could have been completely avoided had they been using ThreatLocker's technologies like ThreatLocker Patch Management, which uses hash-based detection to find unpatched software, including portable applications that are often missed by traditional tools, and PAM, Privileged Access Management, which prevents them from pivoting around using their local admin rights on different machines. Okay, you can read the whole write-up. It's a great blog post. It's in the description. And if you're interested in using these technologies to protect your company, please book a call with ThreatLocker via the link in the description. Also, just want to give ThreatLocker a shout out. You guys have been such a great supporter of the pod. I really appreciate you guys and you keep us being able to do what we do. All right, that's it. Back to the show. Alrighty. Sup hackers? We've got the This Week in Bug Bounty segment real quick. Um, today we've got 3 items. The first one is Web Fuzzing for Hackers, uh, by Intigriti. And they've been doing this series where Ayub and some guest. In the past, it was the Researcher Zero that did all the Next.js stuff. And this time it's Godfather Orwa. They come on and share some of their expertise on a subject. So this one's Web Fuzzing for Hackers. If you're interested, it's a great read and we'll link it down in the description. Next is also from Intigriti, and I kind of like to highlight these. We got an interview with Ryan Bonner, Roll for Combat, who's a mod on the CTBB Discord. So if you want to get to know Ryan a little bit better, There's a whole interview here where you can read about him. Shout out Ryan. He does an amazing job modding on Discord. So thank you so much for that. And lastly, we've got a new piece of research coming out from Bug Bounty Maturity Framework, which is run by Steve Hernandez, ex-CTBB. And he talks about what happens to bug bounty as discovery of vulnerabilities gets cheaper and what's going to happen to the ecosystem. So he put a blog post out. It's a great read. We'll link it in the description. Some of the stats in here are insane. 334% increase in 3-week growth in Bugcrowd triage volume. Insane. So really good data that for all you data nerds interested in the bug bounty industry. All right. That's this week in bug bounty segment. Let's get to the show.

[00:03:42.90] - Joseph Thacker
All right, dude. So, you know, I'm a Codex maxi these days, and if anybody doesn't know what maxi means, it means like maximalist. But I feel like I keep telling people this in DMs on Discord and they're all like, wait, what? I thought you were a paid shill for Claude, dude.

[00:03:58.88] - Justin Gardner
And so like, like we have an agreement with Anthropic, this little like bug bounty podcast.

[00:04:04.86] - Joseph Thacker
Honestly, if you're out there, Anthropic, please reach out to me. I want an infinite token. But anyways, all that, I mean, I don't even know if I would use it right now. I'm so addicted to Codex. Probably, that probably hurts their ears to hear that. But I've—

[00:04:16.47] - Justin Gardner
Have you seen those? those like posts on Twitter where they're like, you know, this, this person, you know, came up to me and was like, you know, if you offer this thing, then we'll, you know, give you this benefit. And then they're like, that's why. And I wouldn't do that because I'm a person of character. And then bloody bloody bloody, you know, like it's, it's a crazy, crazy little thing they have on Twitter. But— What's What's

[00:04:38.69] - Joseph Thacker
What's What's it called where you— what is that called right at the very end of the joke? You spin it. It's like there's a lot of really funny dark humor ones where like you think it's gonna be dark humor and then it goes soft, but then it goes even darker, you know? Yeah. Bad thing. But anyways, yeah.

[00:04:52.73] - Justin Gardner
So yeah, you think Codex is better than Claude, dude? I've been having the inverse experience, but just go ahead.

[00:04:59.64] - Joseph Thacker
Okay. Well, I think that you are a diamond in the rough and you have to admit Codex can also cook up some crazy crap.

[00:05:05.36] - Justin Gardner
Amazing, amazing stuff.

[00:05:06.56] - Joseph Thacker
But anyways, yeah, I mean, every— like a lot of people I know, you know, Douglas and Kieran and JD and stuff, has all been having insanely good results by using Codex. And we're all like, just like waiting for every reset. We all DM each other. I know I've been messaging you, Justin, as soon as there's a reset, like reset, reset, um, that are coming. But, uh, anyways, all I have to say, this is just me before we get into the, uh, because, okay guys. Yeah. So what we're doing today, me and Justin are gonna like let y'all have a little peek into life coaching. Uh, we're gonna life coach each other just a little bit for doing our bug bounty stuff. And I actually have some really, I think some great questions because I really genuinely want Justin's answer on what I should be spending my tokens on. But this little thing at the beginning was just for me to tell you guys that I have been obsessed with Not even the CLI. I love the Codex desktop app on macOS like a complete normie. Like a complete normie. It's so good at browser use. It's so good at computer use. You know, like— Get Get

[00:05:59.37] - Justin Gardner
Get Get off the podcast, bro. Get out of here using the CLI.

[00:06:02.70] - Joseph Thacker
Dude, when you ask Claude, oh, Claude, I need you to go do this thing on my computer, it'll sometimes be like, oh, I can't find the browser. I can't find the plugin. I can't do this. You know what Codex does? Codex is like, okay, let me try the browser plugin. It works perfectly. But if it doesn't work, okay, I'll use browser use. Oh, if that doesn't work, I'll use computer use. Oh, I've got my own built-in browser. And it's like, oh, there's this thing blocked? I'll just hack it and find a zero-day to get, like I did for you. Your Codex is like, I'll just bypass the— I'll hijack this DLL to take over, to bypass the permissions on my Windows machine.

[00:06:32.86] - Justin Gardner
Dude, it's crazy, man. I will say, I think that a little bit of that is because you run a Mac though. I have not had as clean of experience with Codex on WSL Windows because it's like, Like my remote connections keep dropping and it's just, it's not clean.

[00:06:52.26] - Joseph Thacker
Okay. If you have a Mac, switch to Codex for sure. Um, yeah, but yeah. All right, dude.

[00:06:57.92] - Justin Gardner
So, so you're not a, you're not a Claude shill. Okay. That's the first, the first takeaway I want for the—

[00:07:02.92] - Joseph Thacker
That's right. But I am now a Codex shill, but I just don't get paid for it.

[00:07:06.93] - Justin Gardner
Right. Great. Anybody from OpenAI is out there, let us know.

[00:07:09.92] - Joseph Thacker
That's right.

[00:07:10.30] - Justin Gardner
Um, all right, dog. So Yeah, we, like we just said, we have done a little bit of, you know, life coaching. We already covered some of the other areas where we're kind of aligning on our, our goals and vision for the future. And now it's coming to the career portion. Let's first start in bug bounty. And then if we have time, we'll talk about some of the other side projects we got going on.

[00:07:36.26] - Joseph Thacker
Yeah, perfect. Can I ask you my main question?

[00:07:39.00] - Justin Gardner
Yeah.

[00:07:39.31] - Joseph Thacker
And you give me a good answer. So my main question is, and I talk to JD about this a lot, I personally think that Daybreak Soul or Soul/Daybreak Blue can find a bug in almost anything. And I don't even have access to Daybreak Red. I assume one day when I get access to Daybreak Red, it will be even better. So just asking you personally, pre-AI or even post-AI, it doesn't matter. It's all the same question. If you could find the biggest bug of your entire career, Highest severity, highest impact on the world. And I think the first thing that comes to my mind is like, oh, remote RC-style iPhone takeover that persists through reboots like Pegasus, basically a Pegasus exploit. But that is like, one, probably a bajillion people are trying that with top models. And 2, I actually do think that is so secure that it's even out of the realm of Solar Daybreak. So as you go through that mental checklist in your brain right now, as you're starting to formulate an answer, I would love to just hear your thoughts. From the top down, you know, like Pegasus, then like the same thing for Android, then like pre-auth RC on WordPress. But that already happened. That's already been processed. So just like walk me through your thought process. I asked that question and right now we're talking about basically just like impact on the world. We're not talking about bug bounty yet because even WordPress as a shell probably didn't pay that much because it's a bunch of zero days and a lot of companies don't pay for that. Right. So let's just talk about impact first. Then I want to hear your opinion for that same question, but for like monetary payout.

[00:08:59.98] - Justin Gardner
Hmm. Yeah, I mean, you know—

[00:09:05.26] - Joseph Thacker
If you had an all-knowing AI that could find a bug in literally anything, like zero-day in HTTP/2, or, you know, like the protocol, like whatever, what would you point it at?

[00:09:16.48] - Justin Gardner
I think the answer to that actually aligns in both payout and impact on the world, which is interesting. And I love that. That means our bug bounty ecosystem is sort of doing its job. And I would say it's got to be the cloud providers, dude. You know, if you, if you can get access to some sort of, um, you know, cloud provider admin panel or like, uh, cloud provider auth bypass, you can take over the world, bro. You know, everything is everything is, you know, using AWS or GCP or Azure, right? Like, I think that is the biggest impact.

[00:10:02.25] - Joseph Thacker
All right. So basically—

[00:10:03.00] - Justin Gardner
Every time I—

[00:10:04.16] - Joseph Thacker
Yeah. Go ahead.

[00:10:04.97] - Justin Gardner
Go ahead.

[00:10:05.97] - Joseph Thacker
I was going to say, so basically cloud provider admin panels or RCE on bare metal, like some sort of sandbox escape in there to get RCE on like bare metal somehow on cloud providers or some sort of like, like very impactful cross-tenant IDOR on those, right? That's kind of like your—

[00:10:21.36] - Justin Gardner
Yeah. Or even like an auth bypass. Like the other day when we were hacking on— Oh, that's true. Richard, bleep that if you wouldn't mind. But, uh, when I was hacking on that, like one of the main things that I found that kind of blew my mind was a certificate auth problem. And it just like gave you RCE, you know? And it's like, okay, well, like, so like literally I give you an invalid certificate. And you let me in the front door and that's it. It's game over. Okay.

[00:10:54.63] - Joseph Thacker
So the reason why I asked this question obviously is because I want to focus my tokens on the right thing. And the thing that just came into my head that I'm going to do before this episode releases next week is go apply this to SAML bypasses. There are often so many freaking SAML bypasses for auth and having complete SaaS provider or cloud provider SAML auth bypass would be huge.

[00:11:16.36] - Justin Gardner
Yeah. Same thing for JWT validation, man. JWT validation. Um, I haven't seen it yet, but I imagine the same thing happens with mTLS or something like that. You know, a poorly implemented mTLS.

[00:11:28.79] - Joseph Thacker
I've seen it with Cognito, AWS Cognito.

[00:11:31.37] - Justin Gardner
Yeah. Yep. So, so these, these sort of complete auth bypasses to vertical privilege escalation, you know, somebody has to have access to go in and like fix stuff. for a lot of these companies, right? Um, and I also just recently got a blind XSS where for the first time in like a long time, cause I wasn't doing blind XSS testing actively. Holy crap. That feels good, dude. That feels amazing. You know, like, oh, I've got this. I like, I got the JWT that has like, you know, 50 permissions on it, like impersonate user, like, uh, print session token. I'm like, oh my gosh, this, I have the power.

[00:12:09.83] - Joseph Thacker
Um, that's awesome.

[00:12:10.80] - Justin Gardner
And so. Yeah, I think, I think that's got to be the way to go, man. Um, so are you going after the SHUBs, like find internet melting vulnerabilities? Is that what you're thinking for that?

[00:12:19.72] - Joseph Thacker
Why, why wouldn't you? Like, I just throw all— I throw all of my Codex tokens on both of my subscriptions exactly on that. So I've done it for like— so, um, just as a thing here, like, what, what about reading other people's email on Gmail, right? Like, these are the types of things that it's like. And so yeah, I threw it at Gmail once, I threw it at Google Drive once. Um, obviously it's not Even with all of my Google recon, it didn't find anything on either of those. And I think it's because it is potentially just legitimately secure. And so I think that is one thing where it's like things actually can be secure. There might be some like lower level zero-day that could eventually be found or something. But in general, I think that you can have fully segmented accounts.

[00:12:59.10] - Justin Gardner
Especially from a black box perspective. I think that's certainly true. From a white box perspective, You know, yeah, I mean, certainly there, things can be very, very tight, you know, and you just have to go a layer deeper, a layer deeper, a layer deeper.

[00:13:15.34] - Joseph Thacker
Yeah.

[00:13:15.54] - Justin Gardner
Um, so yeah. Okay. So, so for you right now, what I guess tracing that thought pattern back up, you're asking yourself, I've got a, you know, 40x or whatever, uh, you know, the, the Codex, 2 Codex subscriptions are, uh, with, you know, as many resets as we've been getting lately.

[00:13:33.20] - Joseph Thacker
Crazy.

[00:13:33.62] - Justin Gardner
Pretty much infinite compute, you know, and, and what is the way that I can accomplish the most or maximize return? What is your—

[00:13:43.79] - Joseph Thacker
Definitely maximize return. I'm a green hat like most bug hunters, but I think that, like you said, luckily it's aligned, right? So like all these crazy internet melting bugs actually add a huge amount of value to the world also, or they wouldn't be getting paid. So I, you know, another reason why I wanted to like ask this question and I think in general why I think this episode is going to be so key for our listeners is because I've had I think 3 or 4 people asked me now. They're basically— we have a Critical Thinker tier exclusive comment. It's just literally a pinned comment from me. If you remember this like a year and a half ago, that's like— or maybe it's 2 years ago or 2 and a half. That's like, to succeed in bug bounty, you have to do one of these things. You have to be faster than people, you have to be deeper, you have to have a piece of expertise that everyone comes to you for. And I think that that has changed in the AI landscape.

[00:14:27.63] - Justin Gardner
Yeah.

[00:14:28.17] - Joseph Thacker
And sorry, Chapman, but me and JD have Codex cranking on some V8, some V8 RCs. And so Anyways, I think that basically that has changed, and I want to have a good answer to that question, and I don't have a confident good answer to that question. In some ways, those things are still true, right? If you use AI to build the best possible recon and you're finding assets others aren't, that's a good way to succeed. If you have the best automation that's diffing these JavaScript files, and the second Claude has a leak of a new model and you're able to report it to Anthropic, they'll probably pay you, right? So it's still also like Speed, coverage, depth. Um, but in general, even though we have a lot of compute, we don't have infinite. And so, and because it takes a lot of compute to find like an epic zero-day on Gmail, let's say, right?

[00:15:14.72] - Justin Gardner
Mm-hmm.

[00:15:15.13] - Joseph Thacker
And so I think like, um, I want to know where to spend those tokens. That's the whole point. And I think I've already gotten some really great information from you. I think one, cloud providers are a good place to focus on, but actually let's bring this up. There's a little bit of news, a little news sprinkled in here. Amazon dropping their bounties.

[00:15:32.46] - Justin Gardner
Oh yeah, dude. Yeah. That's the— well, bad timing for me to say that, right? Um, yeah, that sucks, dude. I know a lot of people that have been cranking out a lot of mediums on AWS and, uh, that's not going to work quite as well anymore. Um, but I can't say I disrespect the choice from like a, from a, um, like just dealing with the volume perspective.

[00:15:54.51] - Joseph Thacker
Right.

[00:15:55.82] - Justin Gardner
But it, I do sort of dislike it from a, wow, you are a big company and you can afford to pay for the mediums, you know, like just scale and figure it out. You know, like you have infinite money. It's not like AWS is hurting for profit. Right.

[00:16:11.46] - Joseph Thacker
Right. Yeah. They're going to keep printing more and more.

[00:16:14.21] - Justin Gardner
Yeah.

[00:16:14.66] - Joseph Thacker
Uh, Demo specifically said, I'll say Turbo, I guess, uh, specifically said that he got broken up with That was his breakup email. He's really great at cloud provider hacking. But so anyways, my mind went there when we mentioned cloud providers. But yeah, so this gives me some stuff to potentially consider. I hadn't thought about basically SAML-style auth bypasses on major SaaS and major cloud providers. I think this is a really great place to point it.

[00:16:44.87] - Justin Gardner
The other thing that pops to mind just on that is, is let's, instead of, I mean, certainly we should narrow down on SAML and JWT and certificate, but also considering the bigger principle here, which is just auth in general. Like, is there a faulty auth mechanism? A lot of cookies are signed with default, you know, secrets for the various, what is the word I'm looking for? Framework for—

[00:17:13.25] - Joseph Thacker
Yeah.

[00:17:13.55] - Justin Gardner
And what is it? I think Cookie Monster by Ian Carroll is a good tool to maybe give your AI to like just start eating up some of those, those, uh, those cookies. And, um, yeah, but generally trying to apply, look at, looking at your corpus of reports and saying, where have I found auth bypass in the, in the past? Where have I found ways to get arbitrary account takeover? And then using that to, you know, just go ham because I think that is a lot easier to get in my opinion than RCE.

[00:17:43.51] - Joseph Thacker
Mm-hmm.

[00:17:44.30] - Justin Gardner
Like, like I think every, everybody has auth. Not everybody has something where they do something so sketchy that you're gonna get RCE, right?

[00:17:51.35] - Joseph Thacker
Yeah, I got— kind of true. But did you see the new, um, is it Next.js had an RCE in like a file format converter, like AVIF?

[00:17:59.90] - Justin Gardner
Yeah.

[00:18:00.25] - Joseph Thacker
AVI?

[00:18:01.35] - Justin Gardner
Yeah.

[00:18:01.46] - Joseph Thacker
Yeah. Like stuff like that. I think anything that's like processing videos or images and stuff, these models can find crazy RCEs in.

[00:18:07.50] - Justin Gardner
Um, but anyways. Yeah, it's certainly, that's true. But, and, and I think there are RCEs out there. I mean, we saw that with WP to Shell and, and Rails, you know, almost Rails to Shell or whatever. Um, yeah, but I think that it's way more common to get an auth bypass.

[00:18:24.98] - Joseph Thacker
Uh, yeah.

[00:18:25.78] - Justin Gardner
So I don't know, maybe I'm off base there. Maybe you should look at the frameworks.

[00:18:29.15] - Joseph Thacker
Yeah, that's true. The frameworks are good because then they apply a lot of places. Um, okay. Second follow-up question here, which is similar but very different. And it sounds like it might be super relevant to what you've been doing lately, is if you could go farm 100 3K highs or criticals instead of looking for this one internet melting bug, if you had to find a bunch of small ones, What heuristic would you recommend I basically look to to know where to point it? Because like you and I both have access to thousands of programs, right? There's publics across all of the, all of the platforms. Then we both have access to a bunch of privates. Like, and it's really hard right now to know, like, you can't really test programs because you're gonna wait months to hear back. And so it's like, if, if right now I have like— I don't have Granola listening, but if I had Granola listening to summarize these notes, I want to hear like what you what you're— well, I'm basically going to copy and paste whatever you say to my AI right now for knowing which program to hack on, assuming that it can pull the metrics. So if it can pull— the things I want you to think about is, would you rather look at a program that's actively paying but has active hunters looking at it, or would you rather look at a program that looks totally dormant, or a program that has bad payout stats but maybe no one's looking at them? So you can just basically for free spend one day and submit 1,000 bugs on them. You know what I mean? What are your kind of like, how would you kind of look through that problem or what would you recommend to your mentees or like your core group who like are just getting into hacking or for me specifically?

[00:19:51.31] - Justin Gardner
So, okay, I've got an answer for that because I just did it, which is, well, first I'll jump back to the first question, which is I would rather find the big bug, you know, than the 100 smaller bugs.

[00:20:04.97] - Joseph Thacker
Yeah.

[00:20:05.46] - Justin Gardner
I am using the 100 smaller bugs personally. Yeah. Yeah. The— I am personally finding the smaller bugs right now, you know, the criticals or highs on a program that pays $3K for crits or whatever, because I'm trying to validate my, my hack bot and like scale a little bit better and like iron out some of the, the, um, problems with it and that sort of thing. Um, and it is working marvelously. Um, and I think that the way I chose this—

[00:20:37.11] - Joseph Thacker
Why did you— yeah, exactly. Why did you choose that one?

[00:20:39.85] - Justin Gardner
Because they have— shit, I don't know. I don't know if I want to say this, Rezo. You're pushing me, man.

[00:20:48.99] - Joseph Thacker
I mean, don't leak the program.

[00:20:50.65] - Justin Gardner
No, I'm not gonna leak the program. I'm just— but like, this is a good methodology. Um, all right, I'm just gonna tell you guys a couple pieces of it. One, um, it is a program that pays quickly. Okay. And so I, that was one of my main metrics was like, hey, AI, go look at all the programs that I have access to, and find the ones with the best stats for paying out quickly.

[00:21:17.02] - Joseph Thacker
Nice.

[00:21:18.53] - Justin Gardner
And then I'm going to work on that program. And because, you know, it's taking me 5 to 10 minutes per report right now, right? So, you know, if I'm, if I, I don't really care what the payout is, if it's 5 to 10 minutes per report, right? Right. So I'm just working on validating my AI, you know, flows with this and finding the bugs, working out the kinks, that sort of thing. The other piece of this is there are some targets that are a lot more conducive to being hacked by AI. You know, they expose a lot of API endpoint maps and they provide, um, some specific mechanics of the target are more conducive to consistent AI hacking, like over a longer period of time rather than, uh, point in time Justin's driving the AI to hack on this.

[00:22:21.33] - Joseph Thacker
Yeah.

[00:22:21.80] - Justin Gardner
Um, and I've tried to laser in on those.

[00:22:25.44] - Joseph Thacker
Well, I was going to say, yeah, another thing is whenever you said more API maps, the thing that jumped to my mind before you said that was, um, things with command line tools. Like, I really love, like, the cloud hacking is actually not that bad because the models themselves can like spin up a resource or tear down a resource or poke around, you know, like—

[00:22:43.74] - Justin Gardner
Great point.

[00:22:44.94] - Joseph Thacker
Because of like gcloud and AWS CLI, like these sort of things really allow the models to like manage their own environment. Oh yeah, Meta has that language because of what ads did. There's like a language for—

[00:22:57.70] - Justin Gardner
FBDL, yeah.

[00:22:58.84] - Joseph Thacker
Yeah. So I think anytime you can find something like that or even make your own would be pretty cool.

[00:23:04.58] - Justin Gardner
Yeah, I've done that and it's very helpful. And I have that as a specific part of my hackathon is I have tooling, you know, I will assign— I'll have the manager look at the agents that are running and say like, hey, what are they doing that could be useful in an iterative way? And then spin up a tooling agent to, to make a tool that is then shared out to all the other agents.

[00:23:33.42] - Joseph Thacker
Yeah.

[00:23:33.76] - Justin Gardner
Specifically for that purpose. Right. And then it gets refined over time and, you know, oh, the tooling agent hacked this up, I'll fix it and update it, you know, and, and, you know, it starts working. The other piece of that, just to add one more little indicator here, is if you can hack in an ecosystem with multiple apps that are related to the same company and all have a lot of deep functionality in them, then I think that's a really good environment. So, and they're all sort of architected similarly and like share components.

[00:24:12.61] - Joseph Thacker
Then doing it all in like the same task or session all of a sudden gives her a lot of cross-pollination of like ideas and understanding. Is that what you mean?

[00:24:19.84] - Justin Gardner
Yes. If you have a way to cross-pollinate. Yeah. So that's, I think, all I'll say on that front. But I think—

[00:24:27.57] - Joseph Thacker
Just as an example, for example, what you're talking about is like, let's say you are really good at hacking Google. That would make sense because Google has like 30 Android apps. And so you could have a whole system that's like hacking Google Android apps because one, they're going to be using similar APIs and similar auth and they have similar developers like that. That's what you mean, right?

[00:24:46.01] - Justin Gardner
Yeah, that's right.

[00:24:47.05] - Joseph Thacker
Yeah.

[00:24:47.54] - Justin Gardner
Yeah. Yeah. Do you, I mean, have you had similar experiences to that or?

[00:24:52.94] - Joseph Thacker
Yeah, I do like doing horizontal hacking instead of like vertical hacking. Like, um, you know, saying like, hey, let's look for this bug or like, let's look for this thing across a bunch of different desktop apps. I have a, um, an Italian hacker who I'm working with right now, um, who has basically found a really unique way to do ATOs. And he's already reported it to like 7 companies and, and he needed an account for a specific company and I gave him an account. So he's given me like a small, a small cut of it. But then I'm also like, dude, this, this thing is going to get gobbled up by like triagers and program managers at some point. Like it's gonna leak at some point, you know, not maybe not now, but at some point it's gonna get out. And so like, if you want me to like help you scale this up and report it like all like this week, like I'd be super happy to help you. And so he took me up on it.

[00:25:40.10] - Justin Gardner
Nice.

[00:25:40.83] - Joseph Thacker
That's part of what I'm working on this week. But anyways, that basically—

[00:25:44.45] - Justin Gardner
We've only got a couple more minutes here to cover some bug bounty stuff, unfortunately, because we spent too much time yapping about normal life, life coaching stuff. But one of the things I wanted to ask you was, yes, what is— what does your ideal workday look like and how are you moving towards that? Like, like, so I'll let you think about it while I explain another thing here.

[00:26:08.95] - Joseph Thacker
Yeah.

[00:26:09.11] - Justin Gardner
Like, for me, the answer to that question is, like, I would like to have something churning in the background where I know that I can get my, my income from hacking, you know, that's largely automated. That's what I did when I was in Japan with the Route 53 Takeovers was I was able to live carefree in Japan for, you know, a couple of years because Route 53 Takeovers was paying for everything, you know. And that was beautiful. And so if I have that, I have the flexibility to like take engagements I want to do or, you know, go deeper on a specific technology that I really want to hack if I know that I'm getting my, you know, X amount of bugs per month coming through the automated pipeline. What about you?

[00:26:55.44] - Joseph Thacker
Sorry, I was adjusting my mic. Also, I'm muted. Yeah, I think I don't know. I mean, obviously I think Singularity did pretty well, um, you know, the blog post me and JD put out about that. But Opus puts out enough false positives where it's kind of annoying, like where I, you know, I was kind of like working on that all day. Like I was like triaging things and reporting them and optimizing the system and tweaking things. And so I don't know if I was ever at like that, like coastal phase, but, um, yeah. So I think for me, I would say my ideal workday is to just do what I want. while that having the byproduct of providing for my family in a way where I continue to thrive and succeed.

[00:27:34.33] - Justin Gardner
Yeah.

[00:27:34.73] - Joseph Thacker
So I don't know that there's any kind of type of work or thing that I'm doing that really matters. As long as I'm in the trenches with doing bug bounty and also just sprinkling in kind of stuff that I enjoy, like that recent NetHack blog, I kind of stochastically jump from thing to thing. And as long as I have To be honest, maybe the takeaway, you know, and this is more not technical, but maybe the takeaway is I definitely get the most joy out of it when I'm not constantly being interrupted. So maybe it's more about just preserving my work time, even if it's not going to be a full 8 hours. Maybe it's like 4 hours or 3 hours or even 2 hours, you know, where I just tell McCall like, hey, during this time, like, don't let the kids interrupt me. Um, because I think that sometimes work can feel stressful if I feel like there are things that I need to get done that then I can't get done. I don't know if you have that same sort of like angst.

[00:28:25.56] - Justin Gardner
Yeah, for sure. Yeah, that's— yeah, the focus time, the flow state, that is hard. That is hard to achieve, man.

[00:28:34.34] - Joseph Thacker
Yeah.

[00:28:34.99] - Justin Gardner
Yeah.

[00:28:35.84] - Joseph Thacker
But I, but I think right now I do really like doing kind of similar to what you're talking about. This is where I thought you were going to go with it. But I definitely love having hacking agents basically like grinding on something in the background as I'm doing something more manual upfront. And sometimes it's work-related and sometimes it's not. It's like, right, I'm responding to my friends on Discord and then now switch over I check on it, I keep it going, I switch back. With a lot of these Codex bugs that I've been working on, they take days. They take days of it working and then them being like, oh, this is a bug. And I'm like, yeah, but that's like 2 contrived steps that no human would take to get that RCE. Go find it more full cloud to local RCE with very normal user behavior. And then it runs for a day and then I run out of tokens and then there's a reset and then eventually I'm able to get there. Um, I've, I have a really sick RCE from like a 3D printer company where basically you just, you just like open the 3D print file and if you like ever save and edit it, it's like, bam, calculator pops. And like, it's just like such a sick thing.

[00:29:41.03] - Justin Gardner
That's great, man.

[00:29:42.32] - Joseph Thacker
Yeah.

[00:29:43.02] - Justin Gardner
That's amazing.

[00:29:43.76] - Joseph Thacker
Yeah. Uh, so yeah, I don't really, I don't really know that I have a great answer to that question in that regard.

[00:29:48.10] - Justin Gardner
Yeah. Yeah. Yeah. I, I think that doing your day-to-day and just having, you know, the output of it, you know, is, is great. I feel like it, it, if I have a hard time justifying that unless I have like something going in the background. So I think that's why I prefer to do it that way. But, um, surprised you, you're having Opus kick out a bunch of false positives.

[00:30:15.96] - Joseph Thacker
Yeah.

[00:30:16.50] - Justin Gardner
Because, or, or like problems, because I, I have just had none of that. Like, like every single bug that goes through my, my tool and hits vulns, you know, is valid. And I've even had it like, I've had to tell it like, hey, be less intense about duping or validating. You know, because maybe I was just a little concerned that all of them were valid. And so I'm like, maybe I'm missing some, you know, like, yeah, I don't know.

[00:30:51.00] - Joseph Thacker
Yeah.

[00:30:51.25] - Justin Gardner
Yeah. Yeah. Yeah.

[00:30:52.75] - Joseph Thacker
I don't know. It's like, again, this was pre-Opus 5. Like you, your system got set up post-Opus 5. And so Opus 5 is definitely better. Um, you know, when we started it was Opus 4 and then we went through the whole gamut from 7 to 8. Um, and then I kind of you know, once Soul came out, which is before it was 5, I think, um, I have kind of basically did a hard switch, but we, we are rebuilding. Uh, so Singularity V4 is being spun up as we speak.

[00:31:19.00] - Justin Gardner
So nice, man.

[00:31:19.95] - Joseph Thacker
And another thing that I do want to circle back with on a future week is outsourcing. Um, yeah, like I both am considering, you know, I think you recommended in the past me outsourcing, um, like, uh, accounting.

[00:31:33.34] - Justin Gardner
Mm-hmm.

[00:31:33.94] - Joseph Thacker
I've considered doing that. 100%.

[00:31:35.79] - Justin Gardner
Accounting, you must outsource. Uh, I'm actually thinking about outsourcing, uh, you know, triage of, of the hack bot. I've got, uh, a couple friends that are, you know, trying to learn hacking and stuff like that.

[00:31:48.59] - Joseph Thacker
Yeah. They would learn a ton from it and save you the time. Give them a split of it.

[00:31:53.01] - Justin Gardner
Yeah, exactly. Just, you know, even if it's like a couple percent, like, okay, great. Now I don't have to think about it. Like, and, but they have to do a good job with it. Right. So it kind of aligns with multiple areas of my goals, which is like, sure, I want to be pouring into the community. helping my friends learn how to hack, giving them an income stream, reducing mental friction for myself, you know, like all of those are really aligned, you know.

[00:32:14.77] - Joseph Thacker
Yeah, it is. Yeah, I don't know anyone locally that hacks otherwise. I mean, I guess I could still do it for someone locally.

[00:32:19.29] - Justin Gardner
You gotta make them, bro. You gotta make them. My, my 3— yeah, 3 out of my 4 closest friends that are local hack.

[00:32:29.28] - Joseph Thacker
Wow.

[00:32:29.94] - Justin Gardner
Because— and they didn't hack before. I was like, you gotta come hack with me. Like, let's Let's do it, bro. And then they'll hop in and then they'll like find something and they'll catch the bug. And then they're like, oh my gosh, this is amazing. And then they, they, you know, 3, 3 out of my 4 closest friends nearby have, uh, submitted bugs very recently, you know? Wow. That's awesome.

[00:32:49.23] - Joseph Thacker
I do have to do that.

[00:32:50.75] - Justin Gardner
Yeah. All right, man. Um, we got to call it a wrap there, but, um, I think that we should definitely do more of these, uh, you know, just essentially doing the life coaching live on the pod and like asking each other the hard questions that, uh, you know, help us determine what is going to help us perform in bug bounty in this period and whether that is aligned with the lives that we want to live as full-time bug hunters and dads and, you know, husbands and, and all that. So good, good shit, man.

[00:33:20.28] - Joseph Thacker
Yep. Thank you so much.

[00:33:21.91] - Justin Gardner
All right.

[00:33:22.30] - Joseph Thacker
GG.

[00:33:23.01] - Justin Gardner
Peace. And that's a wrap on this episode of Critical Thinking. Thanks so much for watching to the Y'all, if you want more critical thinking content, uh, or if you want to support the show, head over to ctbv.show/discord. You can hop in the community. There's lots of great high-level hacking discussion happening there on top of masterclasses, hackalongs, exclusive content, and a full-time hunters guild if you're a full-time hunter. It's a great time, trust me. All right, I'll see you there.