Harley & Ariel - Bug Bounty Village & Hackbots (Ep. 185)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Jul 30, 2026 · 1:23:13
This episode features Bug Bounty Village creators Harley and Ari discussing the event's massive expansion, the new "ZenOptic" CTF, and advanced hacking techniques, including a super-admin bypass and a physical ATM cash extraction flaw.
Key Takeaways:
• Harley details a critical bug on a multi-tenant podcast platform where he chained a mass assignment vulnerability with a pre-generated magic link to bypass MFA and gain super-admin access across all tenants 05:13.
• Ari shares a story from his pentesting days involving a wallet app where he exploited sequential account numbers to extract cash from a physical ATM, highlighting the tangible risks of banking vulnerabilities 10:10.
• Bug Bounty Village is expanding significantly this year, having bought out the entire Flight Club venue for the opening happy hour to accommodate the massive crowd 09:10.
• The official CTF features a simulated AI lab called "ZenOptic" with complex attack surfaces including CLI tools and backend admin panels, rewarding high-quality report writing alongside technical findings 27:00.
• Harley discusses his "Hackbot" architecture, which utilizes over 30 specialized AI agents for recon, attack, and triage, emphasizing the need for robust safety hooks to prevent unauthorized data modification 15:40.
• Exclusive swag includes a limited edition t-shirt collab with Misreants and interactive challenge coins that unlock color-changing badges when binary flags are solved 38:30.
The creators emphasize the importance of community connection and technical collaboration at DefCon, urging attendees to engage with the lounge areas and the official CTF.
Sources:
- [05:13](https
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
My dream is to have someone tell me like, "Hey, you know, I I didn't know about Book Bounty. I found out about it in the village. In the village, I you know, I found a 5K crate or something." Like that would be >> that's my dream, man. One day someone will walk up to me and tell me that happened. [music] >> Best part of when you can just, you know, critical thing, right? Yeah, dude. >> If you've been in the Bug Bounty recon game for any period of time, you know how beautiful it is when some unsuspecting dev or DevOps guy spins up what's clearly supposed to be an internal facing server and accidentally just gives you the keys to the kingdom, right? It's a big payday. It's an easy win. It's a beautiful thing, right? And unfortunately for us, Threat Locker also knows about that and that's why…