Episode 134: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Diego Jurado to give us the scoop on XBOW. We cover a little about its architecture and approach to hunting, the challenges with hallucinations, and the future of AI in the BB landscape. Diego also shares some of his own hacking journey and successes in the Ambassador World cup.

Follow us on twitter at: https://x.com/ctbbpodcast
Got any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.io
Shoutout to https://twitter.com/realytcracker for the awesome intro music!

====== Links ======
Follow your hosts Rhynorater and Rez0 on Twitter:
https://x.com/Rhynorater
https://x.com/rez0__

====== Ways to Support CTBBPodcast ======
Hop on the CTBB Discord at https://ctbb.show/discord!

We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

You can also find some hacker swag at https://ctbb.show/merch!

Today’s Sponsor - ThreatLocker User Store
https://www.criticalthinkingpodcast.io/tl-userstore

Today’s Guest: https://x.com/djurado9

====== This Week in Bug Bounty ======

Announcement of our upcoming live hacking event at Nullcon Berlin, taking place on September 4-5
https://www.yeswehack.com/page/yeswehack-live-hacking-nullcon-berlin-2025?utm_source=sponsor&utm_medium=blog&utm_campaign=lhe-nullcon-berlin

Bug Bounty Village Speakers 2025
https://www.bugbountydefcon.com/2025-speakers

Talkie Pwnii Caido showcase
https://www.youtube.com/watch?v=4NITbv-_C9w

Caido Masterclass – From Setup to Exploits
https://www.youtube.com/watch?v=HjZxwcBJl7Y

Access Control vs Account Takeover: What Bug Bounty Hunters Need to Know
https://www.bugcrowd.com/blog/access-control-vs-account-takeover-what-bug-bounty-hunters-need-to-know/

====== Resources ======

CVE-2025-49493: XML External Entity (XXE) Injection in Akamai CloudTest
https://xbow.com/blog/xbow-akamai-cloudtest-xxe/#akamai-cloudtest-xxe---X

====== Timestamps ======
(00:00:00) Introduction
(00:05:56) Diego's ATO Bug
(00:12:01) H1 Ambassador World Cup and work with XBOW
(00:20:57) XBOW's CloudTest XXE Bug
(00:49:59) Freedom, Halucination, & Validation
(01:07:24) XBOW's Architecture
(01:23:50) Humans in the Loop, Harnesses, and Xbow's Reception
(01:44:21) Ambassador World Cup plans for the future