Episode 179: Maintaining Motivation in Post-AI Bug Bounty World

Title: Transcript - Thu, 18 Jun 2026 15:19:29 GMT
Date: Thu, 18 Jun 2026 15:19:29 GMT, Duration: [00:46:29.30]
[00:00:00.68] - Justin Gardner
Sounds almost like a pen test engagement. You know, it's like—

[00:00:04.28] - Joseph Thacker
No, don't call it that. Then all motivation will drain out of your body and you'll refuse to work on it. YouTube just randomly appears on your screen over and over and over. You can never actually get to work.

[00:00:32.56] - Joseph Thacker
hey, what's up guys? Before we get into the show, I wanted to mention something super quick from our friends at ThreatLocker. And I actually think you all are gonna think it's pretty awesome because so much of bug bounty is often, you know, kind of quoted as like, yeah, but hackers will never exploit that because they can just get in via phishing. Well, that's actually true. You know, most of the time whenever companies get breached, it's because of phishing or access to that user's account, or they do something like do a whole bunch of push notification 2FA, and eventually a user gets so much fatigue they approve it. But they have a solution for this. ThreatLocker has a thing called Zero Trust Cloud Access, right? Which prevents access to cloud resources or SaaS resources based on the device you're logging in from. So if a user gets phished, right? They put in their credentials, like they get phished or they get vished, They, the attacker has their credentials. Maybe they even have a way to get the MFA because they did some sort of SIM swap because they have a hookup at Verizon or AT&T or whatever, right? So they have the credentials, they have the MFA, they still can't get in because the Zero Trust Cloud Access, like, will basically straight up allow or deny people access to resources based on the device you're logging in from. So if you're an enterprise or a company and you're concerned about the highest risk, which really is phishing, this is a way to add another, like, basically impenetrable layer to preventing it and securing sharing your network. Yeah. Back to the show.

[00:01:57.59] - Justin Gardner
Dude, no, my accent is totally the normal accent for the United States, man.

[00:02:02.40] - Brandyn Murtagh
Are you saying you're like the default skin for accents? Yeah, Yeah,

[00:02:06.40] - Justin Gardner
Yeah, Yeah, exactly, dude. No, for sure, 100%. Like anybody— He's the Steve from Minecraft. I think the only strong accent— I mean, okay, you can argue like Boston or something, but that's so niche. But— It's It's

[00:02:17.93] - Joseph Thacker
It's It's not niche. No, New Yorkers sound totally different. People from Chicago and the whole area of Chicago sound different. People in Canada sound different. People in Texas sound really different. People in California sound different.

[00:02:30.13] - Justin Gardner
Like— You think the people in Texas sound substantially different than like the southern— A lot different. —twang of Kentucky?

[00:02:36.18] - Joseph Thacker
Yes, they have like a drawl. It's totally different. Oh, man.

[00:02:40.09] - Justin Gardner
All right, maybe, maybe so. But either way, we have a good representation of accents here. We We

[00:02:43.91] - Brandyn Murtagh
We We do. We do. Solid.

[00:02:46.96] - Justin Gardner
Solid. So, okay. Hey guys, I was thinking though, before we, before we like, you know, get too far into this episode, we haven't had an episode with all three of us for a while. So we should take this opportunity to introduce our voices to the people because I realized I was listening to a podcast for a while and I was like, I actually don't know who is who on this podcast. So the normal accent that you're hearing right now, this is Justin Gardner, Rhinorator. You know, the default skin, the vanilla. Uh, then we've got the Southern draw over here, Joseph Thacker.

[00:03:23.22] - Joseph Thacker
Yeah, I'm Joseph, uh, Rezo, and my accent is from Kentucky, clearly.

[00:03:28.40] - Brandyn Murtagh
And I'm Brandon Grepp, and my accent is the, uh, is the nice sounding one.

[00:03:35.34] - Joseph Thacker
Hey, the intelligence, the intelligent sounding one, right?

[00:03:39.65] - Justin Gardner
Yeah, women do dig that in the US, I have to say. So, and it doesn't help that, you know, Brandon's like 6'3", totally ripped, like, you know.

[00:03:50.31] - Brandyn Murtagh
Not anymore, but one day soon.

[00:03:53.21] - Justin Gardner
Yeah. Well, it's funny because our head of partnerships as well, I'm hoping we can do like a CTBB team slice of life episode soon, but our head of partnerships is also like 6'5", and Brandon's real big too. So it's kind of funny whenever I'm walking with you guys, I feel like I've got like my bodyguards, you know?

[00:04:12.16] - Brandyn Murtagh
Wait, wait, hold on. Who's 6'5"?

[00:04:14.28] - Joseph Thacker
Everett.

[00:04:14.90] - Justin Gardner
Everett. I didn't know that.

[00:04:17.00] - Brandyn Murtagh
Everett is 6'5".

[00:04:18.14] - Justin Gardner
Everett is massive, dude. Yeah. Everett is—

[00:04:20.87] - Brandyn Murtagh
I had no idea.

[00:04:22.32] - Justin Gardner
Yeah. He's super big. Dude, he gave me a hug the other day, and I felt like a little child, you know?

[00:04:28.93] - Brandyn Murtagh
I had no idea.

[00:04:31.05] - Justin Gardner
Yeah. It's funny. I'm 5'10". I think, what, you're like 6'0", Joseph?

[00:04:37.11] - Joseph Thacker
I'm like 5'10.5", yeah.

[00:04:38.52] - Justin Gardner
5'10"? Okay. You're a little bit taller than me. To To

[00:04:41.56] - Brandyn Murtagh
To To be fair though, Rich is quite tall as well.

[00:04:43.89] - Justin Gardner
Yeah. Yeah, he is. He's like—

[00:04:44.95] - Brandyn Murtagh
Like, he's really tall.

[00:04:45.74] - Justin Gardner
He's like 6'2", 6'3". So yeah. Um, we, we do have some— the— me and, me and, uh, Joseph, you know, the— are, are just surrounded by the team of like big boys. We're holding the team down. Um, all right guys. So today the topic is managing hacker motivation. And I think it's also gonna be a little bit of therapy for me, to be honest, guys. Sure. Because I'm really— peeved right now because a bug that I submitted that I thought was really, really, really going to get paid well, I pushed back multiple times and I think the nail just went in the coffin and it got paid like a third of what I wanted it to get paid.

[00:05:28.87] - Brandyn Murtagh
Um, yeah. Ouch.

[00:05:32.18] - Justin Gardner
It's a gut punch, man. It's a gut punch.

[00:05:34.43] - Joseph Thacker
See, to me, I think I have the opposite issue, Justin. I feel like I'm down and it's because I'm apathetic about it. Like, I just expect that so much now, which is like a sad state of affairs. And that's kind of what— that's why I put this topic up for, for an episode for us was because I feel like I am not let down anymore, but I'm also not excited anymore. And we can get into that in a minute. But I feel like, yeah, basically whenever you told me about an extremely good bug and excited reaction that you had to it. Yeah. Kind of, I think it was a couple weeks ago. I was like, man, why do I not react that way anymore? And it's like, I think I just have this like innate understanding that the odds it will actually result in some big payout that I expect is so low these days because it might be a dupe or it's going to get downplayed or the company's going to take too much to pay it out. I feel like that just sucks out all of my excitement.

[00:06:28.86] - Brandyn Murtagh
Oh yeah, I mean, I would— it's definitely harder to manage as of this year, I'd say. Prime example, I just got back from an event in Berlin, and I was sitting with a couple of guys, Jayesh, Mikey, um, and a few others. And I was like, man, I just need a response on any of my bugs, just to like, anything. Like, even if it's a no, just give me something. Like, I just need some sort of feedback to keep going. And I didn't realize until we had a slammed event with some logistical things how much that does play into your motivation as a hacker.

[00:07:02.16] - Justin Gardner
Because you—

[00:07:02.37] - Brandyn Murtagh
Yeah. I didn't realize until that event, I feed off that a little bit. So now obviously with the logistics and time slowing down, you definitely need to know how to manage that a bit better.

[00:07:12.99] - Justin Gardner
Yeah. Yeah. Yeah. So I think that is a part of the tricky pieces nowadays with triage slowdowns, payout slowdowns. Um, I think that one of the pieces of advice we've given to like pro hunters for a while is try to keep a pipeline. So you're getting that, you know, dopamine hit, dopamine hit, dopamine hit of bugs getting paid out consistently. Constantly over time. And I think we're kind of seeing, I don't know if we're just in the dark ages right now where it's like, okay, the time has extended out. So our pipeline is delayed and now we're hitting a motivation lapse. Uh, and then it'll equalize out as, you know, do you see what I'm saying? If you keep submitting bugs, then even if the timelines extend, you'll still be getting paid for bugs, you know, 3 months ago. Um, but I don't know if that's the case or whether we're just in a situation where we as an industry really have to disconnect from the outcome of finding the bugs.

[00:08:10.80] - Joseph Thacker
That's what I was going to suggest. It's kind of like, I feel like I need to basically just reinvigorate my love for the finding. And it's like, who cares if this doesn't pay? Who cares if this takes 3 months? Like, I want to like just be excited about the fact that I found it more than anything else. Right. It's kind of like what you tell beginner hackers. It's like, Hey, even if that's a dupe, you found the bug. Like, you know what I mean? But I do think the fact that so much of the findings, like a large percentage of them, are like kind of like independently found by hacking agents, or they pulled such a strong, uh, they had, you know, they pulled so much weight in that bug that it does also feel like it's less of my win. And so I think it's like the storm of both of those things that makes it kind of feel bad.

[00:08:50.74] - Justin Gardner
Dang, that's, that's a really good I totally agree with that. Brandon, do you, do you feel that as well? Yeah, Yeah,

[00:08:56.86] - Brandyn Murtagh
Yeah, Yeah, 100%. I've, I feel like as well that some of the game for some of the recon guys historically as well, because it was less about the hacking and more about improve. Like, you were a recon guy once, weren't you, Justin? It's more about actually like improving your tooling rather than hacking. So taking it back and stripping it back to the, the thing that we're all here to do.

[00:09:18.10] - Justin Gardner
Yeah, I, I actually think that it's, it's different than the, the original recon game though, because I have— and don't, don't get me I still get a little bit of a hit of happiness whenever I see my AI agent, like, find a bug. Of course. For Of course. For

[00:09:30.05] - Joseph Thacker
Of course. For Of course. For sure. Of Of

[00:09:30.37] - Justin Gardner
Of Of course. But back in the day, when I— so I've talked about this on the pod before, but just as a refresher, like, my big thing— I had a couple successes in the recon game, but my big thing was I was very much a competitor in the Route 53 takeover apocalypse, right? Where those were popping left and right. I was a little late to it, but it was still a lot of fun. And You know, so at some point I was getting 3, 4, 5 of these things per week, right? At like $2 grand a pop, $1 to $2 grand a pop. And, and I was like, this is freaking great, you know? And I had like a sound hooked up to my phone. And I just know, you know, that when they stopped, then I knew somebody else was getting them. Right. And I needed to re-optimize. And then I re-optimized and I'd start getting them again. And it was like, yes, yes.

[00:10:18.02] - Joseph Thacker
Yeah. Right.

[00:10:18.75] - Justin Gardner
Fuck it, Sean from Acid Note, you know, like, like, um, So I still think like that feels better than when now I just point AI at it. It's like, oh, I just found, you know, complete auth bypass, like, hurdy-durr, you know, it's like literally— And that's because And that's because

[00:10:35.97] - Joseph Thacker
And that's because And that's because you didn't put in like blood, sweat, and tears into that system, you know?

[00:10:40.52] - Brandyn Murtagh
Yeah.

[00:10:41.07] - Justin Gardner
So that goes to one of my points here on managing hacker motivation, which is community and competition. Like, I think in this, And it's difficult. It's difficult because I think the platforms are not going to hand this to us on a silver platter nowadays, right? Because they are already overrun. But I think as a community, we need to forge competition, you know, either within critical thinking or, you know, maybe within our like ambassador groups or whatever, forge that competition that we would get from the live hacking events. Pretty consistently because we're losing out on other dopamine sources, you know, to fuel the hacking. And if we can kind of lead into, okay, well, Justin is like, hell yeah, because I just beat Sean at Route 53 takeovers for a week until he reoptimizes, you know, and the rush that comes from that, then we might be able to get some of that oomph back.

[00:11:37.35] - Joseph Thacker
Yeah.

[00:11:37.54] - Justin Gardner
Mm-hmm.

[00:11:38.90] - Brandyn Murtagh
Yeah, I agree. I would say Some of the, I think it's the HackerOne Ambassador events I've seen, I've seen some great reactions from the community on that because it's very much like a group of hackers or friends getting together in their local segment or community and hacking something together, which does reignite that. And like the times both everyone on this call have collabed at some point, I mean, that's been fantastic. That's been great. Like I've absolutely loved that. So Yeah, I wonder how we could do that better though. We have the Discord channel where we do hackalongs, which is really good, but what else could we do? I know there's some events popping up.

[00:12:16.80] - Justin Gardner
The hackalong that we did yesterday on Adobe was awesome. People are engaging with it and finding their own bugs live, and we're kind of handing leads off, which is really fun. Bus and XSS Doctor were there as well. So I think that's really fun.

[00:12:35.53] - Joseph Thacker
Um, I think another thing is, uh, Justin, or like one thing that we could potentially do, I think this would really help me, is kind of what you did, Justin, at the most recent Bug Bash where you had a friend there who hasn't been to life hacking events before. And so you were just like so thrilled to find stuff with him and to let him find stuff. Like, I feel like it's almost like the whole mentality of like oftentimes giving to others feels a lot better than like taking yourself. And so I wonder if like. Yeah. Collaborating with kind of newer upcoming hackers is like a really great way to kind of feel that again, because you're feeling it on their behalf, right? It's like they haven't ever gotten a big bounty. And so now you're kind of like sharing in the fuel of them, like finding their first critical or helping them like find their first big bounty, you know.

[00:13:15.23] - Justin Gardner
You know what's annoying about that, though, is I've got a bug sitting in pending that's been there for 3 months, you know, and, and that me and my buddy found— that same buddy, we found it 3 months ago. You know, and we got excited and we found a way to leak this data and get around something. And now it's just sitting there for 3 months and it just feels like a gut punch to him. You know, it's like, you know, it's like, okay, well I found this thing. I'm excited about it. It gets through triage and then the program just doesn't respond. So I don't know, man.

[00:13:42.84] - Joseph Thacker
I'm still sitting on that bug that, you know, I shared with you that, cause it's a potential $100K bounty. I've heard nothing, just sitting at PPR for over a month on a Fortune 500.

[00:13:52.00] - Justin Gardner
Yeah. Unlike a very, very big company.

[00:13:54.37] - Joseph Thacker
Yeah. Critical Fortune 500. Yeah. Wow.

[00:13:57.07] - Justin Gardner
Yeah, it's crazy, man. So I don't know. It is. It is certainly a tricky time. I think that another— going back to the collaboration piece, though, it does hurt the green hat a little bit, man. It It

[00:14:10.61] - Joseph Thacker
It It does. I I

[00:14:11.45] - Justin Gardner
I I certainly feel like—

[00:14:14.09] - Joseph Thacker
But you've made more this year. So it's like, it's so confusing because I'm in the same boat. I feel bad about this. And yet I've also made more. And so it's confusing for me.

[00:14:22.72] - Justin Gardner
Yeah. Yeah. I don't know. I don't know, man. It's, it's a, it's a tricky one. Another, another aspect that I had here on my hacker motivation though, is the technical curiosity slash obsession. Like if I, it, I think that's one of the things that AI has also sort of taken away a little bit from me because I don't have to as depthfully understand a product nowadays for me to hack it. It, it becomes. Easier for me to just sit at my 4 Claude panels and just be like— you know? And then have it do the thing. And I feel like I'm not like as engaged with the app.

[00:15:03.71] - Joseph Thacker
You're not entralled. Yeah. So Yeah. So

[00:15:05.09] - Brandyn Murtagh
Yeah. So Yeah. So I would say— I would say in the last event I've just done, I very much done this speedrun of the product ecosystem, got an understanding with Claude and things like that., and I had some okay findings, but when I actually done it myself and spent a significant amount of time in the ecosystem, I escalated the bug like 4 times on 4 separate occasions by doing that myself rather than not letting Claude do it. Because it's, it's like, it's quicker, definitely. But by enabling your, like, making sure you do it yourself as well as Claude and actually looking at things rather than just going, okay, yeah, trust that, trust that, trust that. I escalated this thing 4 times, which I wouldn't have done otherwise. So that for me really solidified like, okay, don't get too lazy on these bigger pain targets or on these events because that context of me as a hacker gaining it is far more valuable than Claude gaining that when it comes to these nuances and just general understanding. So yeah, I'd say definitely try not to outsource all of that. This latest event for me really solidified that. Yeah.

[00:16:13.75] - Joseph Thacker
It's tough though. It's like, there's like such a strong draw to do it, you know? Yeah, Yeah,

[00:16:18.69] - Brandyn Murtagh
Yeah, Yeah, no, and 100, especially like when there's loads of scopes to look at and you want to get good coverage. I agree. But I mean, the results for me personally spoke for themselves. Like, I say this, I still haven't been paid on the bug yet, so I might get GGs because of the whole delay. Um, but like, boom, literally. But the fulfillment was there because I just thought it was so cool, the whole train and how it was built.

[00:16:43.01] - Justin Gardner
No, that was a sick chain, dude. I, yeah. And, and I think, I think that, that is, that reintroduces that technical fascination piece that we all kind of fell in love with. Right. Um, yeah, it's a little interesting, man, because we are coming off this episode. I, Brandon, I know you weren't on it, but we, you know, Rezo and I recorded an episode with Brewcat recently and, uh, the Google hacker. Um, and man, he is using AI in such a passion-filled way. You know, he's, he's taken his depthful, you know, just complete understanding of Google as a, as a target and his passion for that target. And he's automated as much as he can from a code perspective. And then, you know, used AI to fill in the gaps and then used all of that to generate leads, which he then feeds back to his own exploit brain and then, you know, ties it all together. Yeah. So yeah, I think that what, what maybe what I'm trying to do differently is I'm, I'm trying to take Claude's productivity wins and then use that to hack less, you know, and, but really what I should be doing is using it to hack more efficiently and keep my hours the same. Does that make sense? Mm-hmm.

[00:18:01.00] - Brandyn Murtagh
Yeah. 100%. Yeah. Brezza, do you have any thoughts on that? I know you've been absolutely crushing, like— I I

[00:18:08.81] - Joseph Thacker
I I don't know, after the episode of Brewcat, I'm like, man, I should have been doing so much better.

[00:18:12.55] - Justin Gardner
Yeah, dude, Brewcat is really crushing.

[00:18:15.44] - Joseph Thacker
It's tough. Yeah, no, I think, uh, what Justin said resonates a lot with me. Like, it felt like that Brewcat took his, uh, normal intentionality with how, how hard he would hack on Google normally himself manually and applied it to his process in a way that I've been more lazy in applying it to my hackbot, which feels silly, right? Because I feel like I've put a lot of intentionality into my hackbot. But I do think like once things are like running and working, it can be easy just to like leave it at that. And I think that he took the time to micro-optimize it in a way that is much, much more effective. Um, But again, I don't know, Justin, it just feels like, it feels like that is almost demotivating to me. You know, now that he did it, I feel like he like stole my thunder by doing it. You know what I mean? Like, uh, yeah.

[00:19:08.48] - Justin Gardner
Yeah. I feel that. Well, the thing with Brute Cat really actually made me realize that systemization is also a really core piece of, of motivation, right? Like I feel like if, when I think about the times where I've looked at a target you know, figured out the patterns, figured out like the, the ways that they are commonly vulnerable, and then integrated that into automation and then seen payoff from that, that is highly rewarding.

[00:19:33.23] - Joseph Thacker
Mm-hmm. So So

[00:19:34.23] - Justin Gardner
So So I kind of have that on my list there as well of like, okay, if I can be really intentional about systemizing for a specific target, even if it is using AI, I think the payoff is still massive. So I don't know, like the, the AI piece is really tricky to integrate here because I think one of the things I try to do is I try to have AI do the systemization for me for each individual target, right? Like, so I'll say like, across all these targets, identify all the, you know, API endpoints, and then break it down and then try to attack it like this, right? But I don't know the specifics for each individual target. Versus actually picking a target, figuring out a way to parse the JavaScript file, you know, JavaScript files, extract all the API endpoints, diff for changes, and then having the AI go after that. I feel like that would be much better. Yeah, Yeah,

[00:20:25.16] - Brandyn Murtagh
Yeah, Yeah, I feel like the sweet spot now I've sort of gone to terms with AI-enabled hacking, if you want to call that, is making sure that you are still doing a good chunk yourself, and especially around either the functionality or services that you find interesting just just from a usability perspective, um, can definitely carry you further. So like, there's a couple of Vong classes which I just really despise and just don't want to look for sometimes. So I'll just go, hey, all right, I've got a basis of a skill, I'll give it some target-specific context, um, I'll hook it up to Kaido and tell it to run through once with like extra high intelligence just to make sure that context is there, and then I'll filter that off so I can focus on the fun stuff. So I feel like there is a bit of a like a meta approaching now where figuring out where you lie as a hacker to still make it interesting. There's a few people in the guild speaking about this as well where you sort of need to learn how to cater it to your workflow rather than just killing all the fun and dopamine.

[00:21:32.72] - Justin Gardner
Yeah, yeah. I I

[00:21:33.50] - Joseph Thacker
I I do think that I haven't applied this yet, but it just, I just had this thought, Justin, as you were talking about what you were talking about on Brandon where you were talking about what you enjoy and what you don't enjoy. I wonder if like goal-based would be almost just as satisfying. You know, if you set yourself a goal and you also assign your agent to that goal, like let's say the goal is ATO, right? Or whatever. And then when you achieve that, I feel like it will probably be super satisfying even if the AI did a lot of it or you did a lot of it because like you're like setting yourself a specific goal. Like I feel like part of what makes it feel less satisfying is when you're just like, find a critical, you know what I mean? Cause I, and I do this because it's effective and it works, right? But, but maybe like actually setting yourself an actual goal, especially In that Brewcat episode, I know we keep mentioning it, but it is, it's fantastic. You know, his passion for YouTube, like whenever he was talking about that section, I was like, that is cool, you know? And he almost had like a passion for OSINT too that kind of like bled through. And I feel like, um, the same vibe kind of comes from like the Fortnite hackers or like the Epic Games hackers. It's like, you know, my goal is to just be able to like kick my friends out of this lobby anytime I want to, you know? And that just kind of feels like, like badass to do. And it's like your goal and you want to do it. And I feel like kind of similar. Yeah. I can see myself being hyper-motivated in that same way. Like, my goal is to steal money out of this bank. You know what I mean? And then I feel like when you actually achieve that, even if AI carried 90% of it because you set that as your intention, it feels like it would be really rewarding.

[00:22:55.81] - Justin Gardner
Don't tell the AI to steal money out of the bank. 'Cause it's like, it's gonna—

[00:23:01.53] - Joseph Thacker
Unless you're in a— You in a— You

[00:23:02.16] - Justin Gardner
in a— You in a— You come back and it's like, I transferred $1,000 from everybody's account. And I'm like, oh.

[00:23:06.33] - Joseph Thacker
With Capital One's life hacking event, they give you a test bed. You know, it's all fake money. Days.

[00:23:11.50] - Justin Gardner
But you're right, you should be careful with that.

[00:23:13.28] - Brandyn Murtagh
Yeah, that, um, that does feed into one of my points, and I didn't know what to call it, but I put it down in my note as the LHE method. And I've seen a couple of hackers do this in the Guild and Critical Thinking. I've also done it myself. But when you are coming off of a break or struggling with motivation, setting yourself up on a target like it's an LHE, where you time-bound it, you get very specific on the scope, you do your like your research on that scope, read all the docs, and treating the next 2, 3 weeks like an LHE, or whether it's 2 or 3 weeks or 50K in bounties, whatever it might be, that does a lot for me because I'm like, right, the boundary is now set in my mind. I will completely crush it up until this point, and then I can relax. And that can be quite rewarding as well, similar to your point, Rosé. Sounds Sounds

[00:24:00.59] - Justin Gardner
Sounds Sounds almost like a pen test engagement.

[00:24:03.59] - Joseph Thacker
No, don't call it that. Then all motivation will drain out of your body and you'll refuse to work on it. Exactly. you'll refuse to work on it. Exactly.

[00:24:06.75] - Justin Gardner
you'll refuse to work on it. Exactly. you'll refuse to work on it. Exactly.

[00:24:08.68] - Joseph Thacker
Randomly appears on your screen over and over and over and you can never actually get to work. That's what happens when you say the word pentest. It's like, uh, it's like the Hail Mary or not the Hail Mary. What's the Bloody Mary? It's like, yeah, pentest, pentest, pentest, and your screen goes red and nothing can happen anymore.

[00:24:25.44] - Justin Gardner
That's funny, man. Yeah, dude. I don't know. I've certainly used that LAG method before as well, and it does work, especially if you're working on it with um, you know, another person as well.

[00:24:37.04] - Joseph Thacker
Um, I think a similar thing to that that I get from, from my friends is I, for some reason, I don't know if we're just like social creatures, it's probably that, right? We're meant to live in community with others. When someone messages me a lead, I'm so motivated to like find something on it. So like, I work with this Indian hacker guy, he's really cool, his name's like, um, on Discord it's like xitsec or something. But anyways, um, on HackerOne I think it's always Smile. We've been collaborating a bunch and basically he messages me like, hey, this program that I really like hacking on added this new scope today. Like, do you mind to like hack on it yourself or give it to your agent? And for some reason it's almost like if you told me I wanna go to work and the project manager's gonna be like, you have to hack on this today, I'd be like, no, screw off. But whenever he messages me, it's like, hey, hack on this today. I'm like, okay, yeah, that's great. Let's find a bug. Let's do it. And for some reason it's just framed totally different. And I, and like, I really enjoy it. And I mean, we've been doing this for like 2 or 3 weeks now where he'll message me some new scope every day and I just set my local, you know, Cloud on my computer to hack on it. And we've found a bunch of bugs and it's been fun and rewarding. And I don't know why, because it's as if he's like my manager, you know, like telling me what to look at. But for some reason it feels the complete opposite. It feels like this is a fun thing to do, not like an obligation.

[00:25:45.50] - Justin Gardner
Dude, what's the nerd snipe equivalent of like, actually you're getting like manager sniped? Like this guy just like inserted himself as your agent, you know? Like you're the agent now.

[00:25:57.44] - Joseph Thacker
I'm the agent now, exactly.

[00:25:59.83] - Justin Gardner
Oh gosh. Oh Oh

[00:26:00.16] - Brandyn Murtagh
Oh Oh man.

[00:26:00.57] - Justin Gardner
That is kind of interesting though, that agent, just from like a verbiage perspective, like agent is also something that we, you know, give to the AI, but also agent used to be like the person that was managing a high performer, right?

[00:26:14.24] - Joseph Thacker
Like, you know, you have to— Oh, but also when, when you call in, you talk to an agent, like a support agent, and that, and in that situation, the opposite, they're not the powerful one. They're the one that, yeah.

[00:26:22.35] - Justin Gardner
Exactly, dude. What a weird word in English. So sorry, any non-native English speakers that are listening to this and struggling with that, that doesn't make any sense at all. Um, so yeah, anyway, you're welcome for that nice derailing there. Uh, Uh,

[00:26:34.92] - Joseph Thacker
Uh, Uh, Oh, it's fine. I have two points at the bottom of mine I wanted to mention. I feel like two, two things here. One, share your wins. Like, this is always something that should be motivating, but I feel like is one way to kind of keep the love of the game up is like just genuinely share more of your wins. I've noticed that finding more this year, I've shared less of my wins. Um, and I think it's because they almost feel less epic and grand as we talked about before, because AI is helping with it or whatever. But I feel like sharing it when other people are like, oh no, that is a really great finding. All of a sudden you feel better about yourself. You're like, oh yeah, yeah, it is. I knew it was good. I knew it was good. And then similarly, did we drop? No, you're good. Both of you all were like frozen like statues. So I didn't know if we got cut off. And the other, the other thing is like, I think we should gas our friends up, right? Like be more encouraging of each other in this time when it can be kind of tough knowing you're going to wait for 2 months for a bounty or a triage or whatever. Yeah. So I feel like if your friend tells you about a bug, like gas them up, you know, root for your friends.

[00:27:30.17] - Justin Gardner
Yeah, totally. I think the celebration channel in the Full-Time Hunters Guild does that a lot for me, you know, like looking in that channel and seeing what people have, have put in there and what kind of wins that they're having.

[00:27:40.71] - Joseph Thacker
Yeah. I I

[00:27:41.06] - Justin Gardner
I I love that. Yeah. And, and obviously you exemplify that really well as well, Joseph. So I don't know, I just, I just wish that, that some of these things that were the wins that I would be super excited about, I, I, they would, you know, pan out the way that I want them to so that I could celebrate them, but I don't know. Yeah. It's been, it's been a rough couple.

[00:28:03.44] - Brandyn Murtagh
Yeah, I agree on that point as well. One thing that has helped me in this event, because the setup for some of these bugs were insane and it's even more important now, we've mentioned it on a previous episode, I think Joseph, um, take good video POCs. Like, you just got a shout out, Rezo, for the one you recently done, and the team were like, oh my God, this is amazing, it's so clear, thank you so much. But hearing that from the team is good. But also, with these massive backlogs in triage, if you get like NMI'd, you're now—

[00:28:39.57] - Justin Gardner
You're cooked.

[00:28:40.55] - Brandyn Murtagh
Yeah, exactly. It's so frustrating. So if you can do everything you possibly can, make a good POC video, make a good report, send that off, you'll be reducing your, like, cortisol levels over time. So when you do get a response, it's not going to be an NMI, it'll probably be more of a wholesome one. So definitely take good video POCs if you can. I I

[00:29:02.59] - Joseph Thacker
I I don't think we ever mentioned on the pod, but Justin and, and Brandon, I'm sure you all have noticed this, I feel like there's almost like a clause or like a, um, an instruction that triage is given at some of these companies, or maybe some of the platforms, that's like, if you can't reproduce it but there's a video of them reproducing it and it's a trusted person, you're, you're allowed to just triage it. Because I, I, I feel like I've seen sometimes them triage based on video, but I've never heard that called out anywhere. Even on the pod, we've never mentioned that. But I feel like there is like some sort of like subnote or some subrule where sometimes they're allowed to like just triage it based on video alone. And it feels like sometimes that happens.

[00:29:37.93] - Brandyn Murtagh
Yeah, absolutely. I mean, that happened in this last event. So my report for a certain part of this scope I'm not joking, every triage person came up to me and they're like, dude, like, that is a whole day of triage. Like, the setup is insane. They're like, the report is like a university essay. They're like, can you just send us a video and just like talk us through? I was like, yeah, of course, don't worry. Um, so I've done another video. But yes, that is most definitely a thing, but it's not openly spoke about. It's like a hidden rule.

[00:30:08.71] - Justin Gardner
Yeah, I, I will say though You know, and that definitely does help and get things expedited. I think more than ever though, in this era, if the triage teams can differentiate themselves by responding quickly and dealing with reports fast, then you are going to stand out from the crowd even more than you did prior to this AI era, you know, and I know it's super hard and that you're dealing with a bunch of garbage, but, um, like, man, if I had a team that responded to me within the first, like, 72 hours, submitting a report, I would be hype to hack on them. You know, like, I don't even, you know, I mean, the bounties still have to be at least like 7, you know, 7K or something. But like, that's not where my standard was.

[00:30:50.91] - Joseph Thacker
We were on a call and this happened. Someone mentioned, oh, we were on the Guild monthly meet. So everyone, yeah, for the listeners. So the Full-Time Hunters Guild has these monthly check-ins and we run a monthly check-in and somebody was on there and they were like, I submitted a report yesterday and got paid today. And me and Justin were both like, we're going to need you to actually tell us we need to audit that program. And then he said no. that program. And then he said no.

[00:31:09.10] - Justin Gardner
that program. And then he said no. that program. And then he said no. No. And then we were like, we're going to find your H1 profile. And And

[00:31:14.86] - Joseph Thacker
And And so then I pulled up his HackerOne profile and figured out what program it was. But really, I mean, this is like a diamond in the rough these days. So triage, if you can. And I've heard really great things specifically about the Anthropic team, just to give a single company a shout out here. They will almost always triage within a day or two and often pay within like a week or two, I think. And so, yeah. So companies like that get noticed in our community. Very easily.

[00:31:38.96] - Justin Gardner
Yeah, but before Joel dropped off the, the pod, he did something for the Critical Thinkers. He wrote this script that, um, you know, you can use to like pull a bunch of stats across bug bounty platforms. And, uh, I, I wonder, I got to go back and see if that still works because one of the metrics that you could pull is like, you know, across all of your platforms, which ones, you know, which programs respond the fastest, you know? And I think that would be a very interesting metric right now if we're struggling with with, um, you know, motivation to say, all right, you know what, even if it takes a little bit of a, a hit to my, my bounty earnings, if I can, you know, hack on a program that's lower bounties but faster response time, that might feel good right now, you know.

[00:32:21.89] - Brandyn Murtagh
Yeah, yeah, I feel like the— isn't there a stat on— I can't think of what it's called. Yeah, there is a— Like Like

[00:32:27.99] - Joseph Thacker
Like Like being able to see it at scale across all companies.

[00:32:30.19] - Brandyn Murtagh
I see, yeah, because everyone I click on is like under 50%, and I'm like, oh, this is Is there any light out there? I don't know, but it would be nice to find one.

[00:32:40.55] - Justin Gardner
I also want to, one thing that I've thought about creating for the critical thinkers is a browser extension that hooks into like HackerOne or Bugcrowd. I don't know how many of the stats are present on Bugcrowd, but that looks at the percentage of bugs that are considered, you know, low, medium, high, critical, and just assume a normal distribution and tell us where this company give us like a directional up or down arrow on whether this company typically pays above or below the average for the distribution across low, medium, high, critical, right? Does that make sense?

[00:33:20.45] - Joseph Thacker
Interesting. Yeah. I thought you— I thought there's two directions you could go there. One, I thought you were going in the direction of like they're less likely to basically downgrade your reports, like they're more likely to upgrade or retain severity. But I think what you meant is within their bounty range, do they typically pay? Where do they pay in the distribution of their bounty range?

[00:33:35.82] - Justin Gardner
No, I think the first one, the one that's saying like, okay, is this company more likely, like, are they typically, how do I phrase this? Are they paying like out at medium, high, critical within, with like above or below the industry standard distribution? So is this, is this company be, you know, more likely to pay a high, right, than most companies? That's kind of what I would like to know. So, so, so you can say, okay, like, look, if this, if this company's got super fast triage times and they're more likely to pay on the high end of their bounty table rather than the lower end than industry standard, then that would be a really interesting thing for me to know as far as like deciding what target to hack on.

[00:34:19.55] - Joseph Thacker
Does that make sense? When you say industry standard, you mean, or when you say bounty table, you mean like on the high and crit end, not on the high and crit range?

[00:34:27.88] - Justin Gardner
Yes, exactly. Not within the range, just paying high or crit. So like, let's say we look at the Hacker Powered report and say, okay, on average, you know, 25% of bugs are highs, you know, right? 43% are mediums, you know, 12% are crits or whatever. And then like—

[00:34:43.01] - Joseph Thacker
For this company, all of their bugs, 90% are medium and 10% are low and they've never paid out a high or crit. It's like, I don't want to look at this company at all.

[00:34:50.50] - Justin Gardner
Absolutely not. You know, so I think that would be an interesting thing and just kind of get a directionality arrow up or down on whether this this company is greater or lesser than the industry standard on those metrics.

[00:35:02.32] - Brandyn Murtagh
Surely we've got some contacts that could help us with that if this isn't a thing. I feel like it should be a thing, like in general, like that would be quite nice.

[00:35:10.76] - Justin Gardner
Yeah, I've got a couple weeks to code this and get it to the critical thinkers before somebody hears this podcast and then hands exactly that to Claude and then makes it. I guess they could make it and give it to the community themselves.

[00:35:23.51] - Brandyn Murtagh
I think as well, doing bug bounty adjacent things can do a lot for some people if it's like your thing or your personality type. So doing talks and conferences for— before I started bug bounty, I just didn't do it. Then I had the freedom during bug bounty to do that. And I was like, okay, this actually does something, like I enjoy it. So using that to get you motivated to hack, because you're like, oh yeah, you can tell these war stories and then you think, I actually do want to go and find some more stuff now. Can do a lot.

[00:35:54.96] - Justin Gardner
Yeah, I actually, you know, I do this podcast every week where I do that. And, you know, I don't know, man. It's interesting you say that, because I sort of actually feel like it's the opposite. Like, I feel like if I don't do enough hacking, and I'm not succeeding, you know, in the hacking that I'm doing, it is really hard for me to come on the pod. You know, and, and like talk about stuff. Like I, and it's not only because I have a high commitment to, I need to be like crushing the thing before I talking about doing the thing. Uh, but I think it's also just like bug bounty, succeeding at bug bounty fills me up a little bit, you know, like I'm not getting the fulfillment by talking about it. I'm getting the fulfillment by doing it.

[00:36:39.78] - Joseph Thacker
Yeah. But I think that's you. It It

[00:36:41.34] - Justin Gardner
It It overflows. Yeah.

[00:36:42.71] - Joseph Thacker
Yeah. I think that's a little bit you though. But what's interesting is I'm the same as you, but in a different way, but I'm gonna make a case for Brandon's thing as well. So in my opinion, I do kind of like love this method of distribution because I feel like it is the most effective way to reach a lot of people. When I do a conference talk, it feels like these 30 people came in here, they kind of pay attention, they kind of didn't, they left, and like I wasted all of my time setting all this up and coming here and doing this. And that was kind of annoying, and it was like the worst way to actually reach people with this information, whereas the podcast feels like an ideal conduit. But to Brandon's credit, and I think that this is why a lot of people really love talking at conferences, and I'm not downplaying their reality or experience at all, is because I think for the people that are in that room that do pay attention, that do care, it matters a lot. Like, it matters a ton. Mm-hmm. And like, you know, obviously I know Brandon spoke to a company And I went down and spoke at like HackerOne Empower like 2 years ago or something. I still get messages from like staff and triagers that were like, "Hey, I remember you coming and talk to us in Dallas and it was so awesome. Thank you so much for coming." And that really does feel rewarding. And I think that that's the experience that some people get when they're speaking at conferences. You know, they like make a really big difference in like 3 people's lives.

[00:37:56.65] - Justin Gardner
Sure. And And

[00:37:56.98] - Joseph Thacker
And And that can be hyper meaningful. And I think, you know, that's easy to understand why that would be so meaningful and like rewarding for them.

[00:38:03.46] - Brandyn Murtagh
Them. Yeah, I agree. And like, if I'm talking about old bugs or like cool assessments I've run, I just want to do more of it. Like, especially if I'm going through a bit of a lull where maybe I can't be bothered to hack, or triage is just beating me up lately. When I go out and talk about that, I'm like, right, okay, we need to get this momentum going again. Like, it needs to happen. That— it really does do something for me.

[00:38:28.50] - Justin Gardner
It does, it does make you realize what a crazy life you have. Yeah, I think as well, like it is a reality check because we spend so much time with each other, you know, in our other, you know, members of the, you know, top-tier hacker community that we're like, oh, this is normal. This is not even remotely normal.

[00:38:43.90] - Joseph Thacker
That's exactly what I was going to tell you, Justin. Like, you live in a very small bubble and we live in a day and age when there's instant access to information. If you weren't in this tiny bubble and you didn't have access to like all of the other cool reports and findings that you see via X and that you see via blog write-ups and that you see in the Guild chat and the CT chat, like you would basically feel like you were a god among men walking around Virginia being like, I'm the best hacker ever were there ever was. And maybe you still do that anyways, but you know, I think, but really, really though, I do think that like we live in this like kind of weird time where like social media makes us all feel like we're less than we actually are. When, you know, 30 years ago when you didn't know about everyone else who's doing epic crap all across the world, you would be like much more proud of the work that you were accomplishing.

[00:39:30.13] - Justin Gardner
Yeah, that's a good point. Yeah, that is a good point. Okay, but I will also say to this, you know, in counterpoint to my own thing, I did go to Zero Trust World in Orlando with, you know, ThreatLocker, shout out to them, they're awesome sponsors. And, you know, I've done plenty of talks before at DEF CON, you know, Bug Bounty Village, other areas. But I went to this ThreatLocker thing, man, and I was doing a pretty basic intro to web security workshop. And then, you know, everybody comes into the room and then they fill up the room and they're like, "Justin, we need to move you to a bigger room." So like literally, right, like 5 minutes before the talk is supposed to start, we migrate like 600 people into this other room, you know? And I'm standing there and it's like row, row, row, row of people, you know? And I was like, actually, this is pretty freaking sick. You know, and, and I realized like that's not even, you know, 10% of what we get on an average, you know, podcast episode. Really cool. Um, so it is, it is kind of hard to, you know, wrap your mind around the scale of all that, but it was pretty sick to be like on a stage stage with a full audience, you know, and that was, that was pretty motivating, I have to say.

[00:40:41.21] - Brandyn Murtagh
Um, yeah, so I mean, some people despise that though, and which I completely like appreciate it's not your thing, but if it is, then lean into it.

[00:40:51.63] - Justin Gardner
Yeah. Um, okay. I think I've worked through most of mine. I'm just gonna hit these last two points really quick. Um, health is another one that I've really, I've really— Heath. Heath.

[00:41:01.71] - Joseph Thacker
Heath. Heath. You, you wrote Heath here.

[00:41:03.36] - Justin Gardner
Oh dude, I did. I did. I misspelled it in the doc. Don't call me out like that live on the podcast. This is our private document. Oh yeah. Yeah. You know? Um, no. Uh, just, I think if I'm not taking care of myself, if I'm not managing cortisol levels, like you said, Brendan, or if I'm not, if I'm not, you know, getting my workouts in or eating healthy or staying hydrated, I think it is really hard for me to like, even as a neurotypical, right. Which everybody always makes fun of me for. Uh, like it's very hard for me to lock in and, and like feel excited about all that stuff. Cause your body's just not. You know, and we, we have a very sedentary job, you know, uh, and it's very much like your body is completely still and you're like locked in staring at the screen, right? Yeah. So we really do have to— you have to counterbalance that actively.

[00:41:52.71] - Joseph Thacker
Guys, I turn 35, uh, tomorrow. I bought readers last week. Oh, I bought some readers. I noticed when I'm trying to read something super close or I'm trying to like cut the kids' toenails, I can't see super close. And it's because we stare at screens all day long. I was asking AI like When do most people get readers? It's like about age 45. Like, oh my goodness, I'm deteriorating my eyes by 10 years, huh? Do Do

[00:42:16.57] - Justin Gardner
Do Do we take out like life insurance on him? Is that what—

[00:42:20.05] - Brandyn Murtagh
I think we might have to.

[00:42:21.36] - Justin Gardner
I think we might have to do that. Shit. Keenan insurance or something like that.

[00:42:25.80] - Joseph Thacker
I've always had like 20/10 vision, man. I can, and I can still see perfect like far, but just like right here, all of a sudden I can't read small anymore. It's the worst. Oh my Oh my

[00:42:33.17] - Justin Gardner
Oh my Oh my gosh. That is crazy.

[00:42:34.78] - Brandyn Murtagh
I would say that's a huge point for me. There's been cases during events where I have like abandoned every aspect of life other than hacking. And it's taken me a while to get out of that hole of just like not feeling good. I don't feel good, so therefore after the event I'm sort of just like in no man's land. I can't get into hacking. So I— for me, that's, that's quite a big part.

[00:42:59.11] - Justin Gardner
Yeah, it's really worth it. It's really worth it. All right, last item on my, on my list here. I fixed it to health for you, uh, Joseph, so it's not heat anymore, it's health. Last point was just, man, such a good takeaway from Franz a while ago on an episode with him where he said that he likes to stop hacking right when he's found something, you know, found something very interesting, which is like—

[00:43:21.09] - Joseph Thacker
No one can do this. The this. The

[00:43:21.51] - Justin Gardner
this. The this. The edging of bug bounty. Like, it's like—

[00:43:23.63] - Joseph Thacker
It's just another example of how he's a superhero. It's It's

[00:43:25.82] - Justin Gardner
It's It's like, exactly. It's like, oh, I guess I'll just go right up to the thing, you know? But it's really, really— I've tried it a couple times and it's— It's, it's good, man. You are, you are raring and ready to get back to the, you know, the computer. So, uh, I don't know if you can pull it off, maybe do it. Don't do it in a situation where you might get dupes because, you know, dupes exist. But that is a pretty epic tip. I thought.

[00:43:51.63] - Joseph Thacker
I already have a hard time coming back down to earth to spend time with my kids and family because I can't stop thinking about hacking. I don't know. I don't need more of that.

[00:43:58.57] - Justin Gardner
Yeah, that's a good point. That's the point. You gotta, you gotta balance that.

[00:44:01.55] - Brandyn Murtagh
There's no way I'm capable of doing that. I respect it because it clearly works for him, but it's just, there's no chance.

[00:44:07.73] - Joseph Thacker
I do think the biggest upside of it is it's like, um, a lot of times, I'm sure you guys experience this, you show up back to your computer in the morning and you're like, now where was I? What was I doing? But I feel like with that tactic, you won't. You, you sit down, you're like, yeah, right there in my replay tab. I just gotta go after it, right? I need to refresh my auth and then hit it up.

[00:44:25.73] - Justin Gardner
Yeah, totally. Um, all right, any— anything else you guys want to— want to mention here before you wrap? I think we got time for one more if we need to.

[00:44:33.78] - Brandyn Murtagh
No, I think it's, uh, I've tidied off everything. But one thing I would say that was interesting speaking to some program managers as well is that a lot of the things we're seeing now around the increased volume and payout delays and things like that, all of the budgets that we're interacting with were decided last year before this kicked off. Now, I don't know what that means for this year when budgets are decided again and headcounts and things like that are decided, new contracts, but we're dealing with this problem because everything was decided last year. So I'm hoping that means after we get through this, it's going to get better. I would say so around the triage times and the payouts and things like that, but— Yeah. But for people that haven't managed a bug bounty program or anything like that, that is a very big problem that people are having because they're like, well, we're going to run out of money in the bounty wallet. So do we try and downgrade stuff so we can still pay everyone, or do we just pay everything out at max and run out? So something to consider for people.

[00:45:40.32] - Justin Gardner
Yeah, that is a hopeful thought for the next year. Hopefully one year is all they need in rebounties. Mm-hmm. So absolutely. All right. GG, gents. Hope we're, uh, hope we got some, uh, motivation back up from, uh, from this episode. I'm gonna go. I know I've got some things I wanna implement, so that's the pod. Yeah. Perfect.

[00:45:59.86] - Joseph Thacker
We're good guys. Peace.

[00:46:01.05] - Brandyn Murtagh
Peace. See See

[00:46:01.51] - Joseph Thacker
See See you.

[00:46:02.88] - Justin Gardner
And that's a wrap on this episode of Critical Thinking. Thanks so much for watching to the end, y'all. If you want more critical thinking content, uh, or if you wanna support the show, head over to ctbb.show/support. Hacker.hackerspace.com/discord. You can hop in the community. There's lots of great high-level hacking discussion happening there on top of the masterclasses, hackalongs, exclusive content, and a full-time hunters guild if you're a full-time hunter. It's a great time, trust me. I'll see you there.

[00:46:27.03] - Brandyn Murtagh
Bye.