Is Sol 5.6 SuperHuman for Bug Bounty? (Ep.186) transcript

And I think that you also need to be gaslighting your model like, "Nope, there's definitely a bug here. Nope, there's definitely a bug here." Because even 56 Ultra came back to JD multiple times at this event. I was like, "Nope, there's not a bug here." He's like, "Yeah, there is. I know there is." And eventually it found [laughter] like found some crazy stuff. >> I know. That's exactly what JD was like too. He's like, "Yes, it is." [music] >> Best part of when you can just, you know, critical think, right?

Yeah, dude. [music] >> If you've been in the bug bounty recon game for any period of time, you know how beautiful it is when some unsuspecting dev or DevOps guy spins up what's clearly supposed to be an internal facing server and accidentally just gives you the keys to the kingdom, right? It's a big payday. It's an easy win. It's a beautiful thing, right? And unfortunately for us, Threat Locker also knows about that and that's why they created their zero trust network access product.

Okay, check this out. This is a product that prevents that unauthorized network access not only at the network level, but also at the device level. Okay, so anybody's connecting to those sensitive internal services, you know that they are authorized as that user, but also the device that they're connecting from is validated. So you get complete introspection into who's accessing these sensitive systems. It's a great product.

Check it out at threatlocker.com. All right, let's go back to the show. >> Yeah, dude. Uh, I've got this, you see this bean bag right behind me right here? I've got this, you know, it's summer right now and it's kind of intense with the girls, you know, at at home or whatever. And, uh, but they've brought this, you know, bean bag in here and and what we'll do is I'll throw like a Netflix show that we're watching together or something like that up on one of my monitors in here because I got the the quad monitor set up. >> Yeah.

And uh and then we can just, you know, still be together, chill, watch a show together, you know, do some activity together, and I can also be getting my my work done during the day. So that's awesome. Yeah, >> it's a pretty good situation. I think I might leave it there for a little while. >> That's awesome. You need to sit on and hack with a laptop sometime. >> Yeah. Yeah. Well, that's that's when now, you know, my little one is is saying like, "Hey, come come sit out here with me.

Snuggle with me." And how am I supposed to say no to that? You know, like so I'm like trying to like text Claude from my phone, [laughter] you know? Hey, it's possible these days. At least, you know, at least it's possible. >> Yes, dude. Well, that's one of the crazy things, man, is like I I totally agree with that. I think that the AI, you know, revolution that's happening right now has come at like such a perfect time for me. >> For you personally. >> Yeah.

Cuz well, I just became, you know, a dad two years ago, and I I didn't, you know, it was via adoption rather than, uh, you know, via having a little baby. And it's very busy and very intense. So, I'm running around doing stuff and very often. And um >> speaking of your hair's been is like kind of intense today, too. >> Dude, >> are you like not cutting it these days or what? [laughter] >> I am. No, I I skipped a haircut and cuz the girls want me to grow it out >> and uh I don't know.

It is very long. You're right. Thanks for calling me out on that. [laughter] Um but [clears throat] yeah, anyway, and I just I'm so blessed that I can just, you know, be going and putting out a you know, fire with the teenagers, right? and then texting Claude, it'd be like, "Oh, try this on this program." Now, just going back to what I was doing, right? [snorts] So, it's >> Hey, speaking of your monitor setup, I actually went the other direction.

I I had two monitors. >> Sorry, I hit I hit my mic. Um I had two monitors and I went down to like one ultra wide. So, you're you're up to four and I'm down to one at this point. >> How do you like that? I I feel like I like to have them blocked out like this, you know? Uh, honestly, the old monitors like were just like kind of a lower DPI and uh, as I mentioned before, I had to get readers and I think that that's like one reason is the lower quality monitor.

So, I'm just excited to have like a really high res high quality monitor. So, >> nice. >> Yeah. >> Nice. Great. >> I forget if I've said this on the podcast before, but you know, I do I do um uh house rens as well. So, we'll like buy a house and we'll fix it up and then we'll we'll typically keep it as a rental. Um, but you know, in that process, I was at this place that they have uh called the Restore, which is a Habitat for Humanity, you know, place where you can go and get like used appliances and stuff like that, right?

And furniture. So, I walk in there one day >> and there's there's like eight 4K HP 27 inch monitors, you know, thin, no bezel, no bezelless monitors. These are like $400 monitors, dude. Freaking shout out to the boys over at Capital One. Capital One has a headquarters here in in Richmond. Wow. >> Right. And they donated a ton of old monitors. Old old monitors to the Habitat for Humanity. So I walk in there, they're like $50 each, bro. >> You bought all four on the spot. >> I literally I bought all of them.

[laughter] >> I was just like, "Yeah, I bought all eight." And I was like, "These are mine." [laughter] you know, and I and I load them all up into the car. I don't even, you know, what am I going to use eight monitors for? But I just stuck them in my closet and I've been giving them out like candy. You know, like a hacker comes over to my house, I'm like, "Hey, monitor." >> Exactly. It's [laughter] like like trickor treat.

Here's a monitor. [laughter] >> That would be hilarious. >> So, uh, yeah, dude. But I mean that was that was probably one of the best finds I've ever had at like a thrift store like a you know that sort of thing because man that was like think about it that was like $3500 worth of monitors. >> Yeah that's true. Yeah. >> Oh my gosh. >> That's really cool. >> So yeah. Anyway, okay let's let's let's get to the meat because we we've got a we got to make a a quick episode today.

Um >> uh let me talk about this this one really quickly first. I'll just um I'm going to pull this up on the screen. Um, so you know, Ian Ian's got a lot going on. Ian Carol uh he's got a lot going on nowadays, but he does he does still speak about the bug bounty uh industry from time to time and when he speaks I listen. Um, and he tweeted this out the other day. There's a trend of bug bounty programs reducing rewards under the guise that they can find issues with themselves with AI.

This is a basically absurd and you don't have to pay bounties for issues you've already found, >> right? It's like it just doesn't seem like a real thing. And I totally totally agree with this. I think that uh I think that that is a crazy thing that Coinbase put out in this uh >> if you find them internally, you'll be paying less in bounties, so you should up it to keep your budget the same. >> Exactly. Exactly. So, what what are they what are they doing? >> Right. >> I don't know.

[snorts] >> I just wanted to call that out. Call programs out if they say like that because that I don't like that. When I read it, I I think that they might just be saying that they don't want to accept low and medium bugs, which I think is reasonable for a short period of time here while everyone's inundated. Like you have to kind of go into triage mode. I mean that not in like a triager mode, but like as if you're in war, right?

Like you're triaging things like you're triaging um you're trying to stop the bleeding and you're going to start with the most severe vulnerabilities first and work your way down. And so I think having like a temporary pause or whatever on like lows and medium vulnerabilities actually makes sense right now. And when I when I when I read that, it kind of seemed like they might be saying that or that >> that's not what they said though.

You know, like if that's what they said, then that's fine. But what they said is low and medium severity issues are moving out of scope for our public bounty program. Our internal tools are have matured and can catch this class of issue at scale continuously. >> Yeah. They can just catch all mediums themselves. Just all of them. >> That's like >> Well, then catch them, fix them, and then they won't ever make it to the bug bounty hunters reports, right? >> Exactly.

[laughter] >> Yeah. No, true. >> Exactly. So, I don't know. That's kind of BS, but I I you know, I understand only expecting accepting highs and crits in this day and age. That is a little bit sad, you know, and I've always been a big proponent for the medium, >> you know, like that's how I choose my programs typically is like I'll look at the medium b I'll look at the critical bounty and the medium bounty, which is ironic because I almost exclusively submit highs.

Uh [laughter] but uh >> that tells you the quality though. >> Yeah. Well, it's funny because like Yeah. when when you look at my my you know impact and you look at just the majority of my reports like sometimes I'll I'll like spray a bunch of low issues if a company's going to accept some low issue that's everywhere right I'm just like free money but um you know most of the time I'm submitting highs which is something I've struggled with because I would like to submit more crits right um but I don't look look at the high bounty quite as much as I look at the medium and the critical as anchor points when evaluating a program because mediums you know I feel like mediums is what I kind of look at mediums as like paying paying the mortgage, you know.

Sure. You know, you you pop a couple mediums, you pay the mortgage, you're good, and then the crits just go straight into the, you know, into the savings, right? >> Yeah. >> So, I don't know. >> No, I do agree. I think that like for most hunters when you consider like, I don't know, PR L, like if you could put it, you know, privilege required low, drops your high to a medium, >> it it feels so bad if it's going from 3,000 to $300, right?

I mean, like it feels like you just lost the bug. Like, you don't really care about anything. But if their mediums are at 1K and now you're like, "Oh, okay. It went from three to one. It's not it's not." You still feel like you're getting some money. But you're right. There are some companies [clears throat] >> cough Amazon cough that have Amazon that have like $400 mediums and like $5,000 highs and you're just like a single CVSs point here is just going to like wreck my day.

You know what I mean? >> Yeah. Totally. Yeah. And I think the Atlassian program, I want to say, is the same way. Like and I've been hacking on them a little bit with one of my mentees and and like it's we're just fingers crossed. We're like trying to push everything to to high. We're like showing, you know, when we get like these AI bugs that we're hacking on. Um, you know, it's like there we're we're like trying to leak data that like this is very sensitive data, [laughter] >> right?

I mean, really, I will say if companies are going to have that kind of structure, they just need to be kind of lenient with their highs or or if it's bug crowd, they need to be lenient with their P2s. Like as if they're strict with CWE and they're gonna like crank it down to P3 just because or sorry it's VRT just because VRT says it's P3. It's like come on. Like you're just like basically taking money out of their hands for no reason. >> Yeah.

Yeah. I totally agree, man. So I don't know. I think I think it's a little bit of a um I think it's I I think that in general it it works pretty good to try to get people to go for higher impact, right? But I when it get downgraded it's like >> that's that really doesn't move the needle at all, you know, like if it's 300 bucks versus three grand it's like okay well you know >> thanks for saying my report's garbage, you know. >> And you spent so long with it because you're like oh this is a high it's worth the investment and then it's not at the end.

So >> it's not it's a bummer. >> And speaking of that, so GitHub also restructured their program a little bit here. Um and they give uh they are introducing a permanent VIP program where they will pay higher bounties and the entrance to that is clearly qu you know qualified here. One critical finding, two high findings, four medium findings, seven low findings, right? Any of those will get you in. >> Y >> um and then their public uh program is substantially lower bounties.

Highs are 5k instead of 20. Crits are 10k instead of 30. Mediums are 2k instead of 7,500. So I I don't know, man. What do you think about this? >> Uh I've been hacking on GitHub a good bit. I think it's kind of interesting. >> I I don't really love gated access. >> Are you in the VIP program? >> I am. Yeah. Okay. >> But I just don't really love gated access in general. So I think there's a private program on integrity.

We can bleep it if they're not supposed to be known, which I think they're not. and they don't invite you into the private until you've got bugs on the public. And I think famously AWS is that way these days. >> And I something just feels really weird about it, especially for people with like an established track record of like providing real impact to Fortune 100 companies. >> Um >> like it's I don't know. I just like I'm not motivated and I think it's kind of like crappy to have me like work on let's just say Nvidia's like public scope to then find a really valid van get it submitted to them wait for it to triage wait to be accepted all the while I could have just been hacking on their program.

Um so I don't know that I love it but in this case the public program from GitHub is at least still paying bugs and it's still relatively competitive. Um I don't really know what difference it makes to them. Like I I'm just trying to think through the implications of like is this going to like reduce the slop reports or is this just to I I guess one thing it does do is drive engagement like people will be like oh I want to be in that you know I want to be in the VIP so I'll work hard.

Um >> I it does seem like GitHub's like a decent company to focus on right now because I think they're even doing some like either meetup or event or something for people at DevCon and the fact that they're at least still like talking about their bug bounty program and being active. Um and we know some staff working there. Shout out to Cat. And so I we I do know they have some high quality staff members. Oh, yeah. Oh, I didn't know he moved as well.

Did they both previous Cap One people, but uh >> Yeah, they were. That team is It's great. They They're a great team. >> Yeah. >> I don't know. What do you think? >> I I I agree, man. I I Well, to be honest, I've always thought that the GitHub program was a very interesting program because some of their stuff is really, really hardened. Like, if you look for >> I don't know. I'm probably gonna Yeah, as soon as I say this, someone's gonna be like, "Oh, I found an idor there." But I I've like done a decent amount of work trying to find like idors and and privileges stuff and stuff like that.

Um or like broken access controls in the web app and haven't had a ton of luck there. But then if you start looking at like some of their more technically complex products and the way that their um tokens are scoped and stuff like that um definitely you know some issues that I would have thought were a lot more obvious uh had fallen out. So it's a little bit of an interesting program because it's like if you are bold enough to go for the technically complex stuff then you know it's actually not that bad.

Uh but if you're trying to go for the basic stuff, idor broken access control, that sort of thing, then I I personally haven't had a ton of luck. >> Yeah. I also think you probably saw we the metrics, we talked about the metrics earlier this year. >> They get a lot of slop and I think it's because of the nature of the way everything is stood up like the um GitHub actions and then like GitHub pages and like other stuff.

Uh, I'll just go ahead and say this outright, like I had RC and GitHub pages >> um in the last two weeks and um like like multiple different ways, but it's intended. It's like apparently if you're a maintainer, it's by design. If you could do it as like a person who is not a maintainer for the repo, then all of a sudden that would be of course valid, but they they expect it they expect that the maintainer of a repo can get RC on the runner.

[snorts] >> And it was actually in their scope. It was in their scope though that if you could get RC on the build runner, it would be accepted. Like it was like under the pages scope. And so I messaged Cat and she was like, "I'm so sorry. That shouldn't have been in there." And so like I don't know if like they had AI help write it or if it was just like a mistake or something from the from the previous program owners, but um >> but still owning up to it, man.

Yeah. Yeah. We'll see. We'll see how all that pans out as well. But I think that that's it's awesome that they owned it. And then for, you know, just swinging back around to this this table though, you know, any any program that has mediums, you know, that are getting paid out, you know, well into the thousands, right? Like PayPal is the same way, right? Like you can get $10,000 for, you know, a medium on PayPal, right?

[laughter] >> And it's like, [clears throat] wow, okay, this is amazing. So, GitHub paying $7,500 for mediums once you're in the the, you know, the VIP program. Like, man, if if somebody just locks in, right, and like becomes a a GitHub, you know, main hacker and then cranks out two mediums a month, >> right? >> Right. Like, two mediums a month is so reasonable, bro. That's like 15k a month. That's crazy. >> That's crazy, >> you know? >> So, >> actually, this is a perfect segue over to the Whiz bug.

So, it was on it was in my section down here. Whiz found a crazy like crossorg RC back onto like GitHub enterprise servers and just straight up github.com. >> So um let me share my screen. >> Yeah, go for it. >> This is the nice thing about the >> it's the nice thing about the uh >> the monitor >> the ultra wide is that on my half split it's not too wide, you know, because if you if you only have the four big like landscape things you have to like minimize your chrome.

This is like a much better width. >> I see. I see you. Um yeah, so they found a vulnerability um in the way like so basically when someone is basically like pushing let's say you're just doing a get push it flows through like a four-step chain. I'll scroll down here and show it. It basically go this is the architecture. So >> it goes through uh Babel a Babeld component then a get o component then a get rpcd um component and then the preceive hook.

What really matters here is the way that it's parsing this Xstat header. So, um the Xstat header is you like has like some like security implications to it, but but what you really need to what you really need to know is that it's kind of funny. It's exactly what you're talking about. If you're willing to get in the technical weeds, you can find good stuff on GitHub. Um but it carries these fields, push option zero, push option one, and some other fields.

And it is semicolon delimited. [snorts] And um you can see right here. >> My question is how did Oh, okay. Oh, it's also it's um Okay, it's on enterprise as well. So, you can go in and and check out the code. >> Okay, I see. >> You're curious. >> How the heck did they find this? You know, like like are you just injecting semicolons into random headers and then being getting verbose errors back? But no, it makes sense if you have uh >> GitHub Enterprise.

Yeah, Soul Ultra. Uh, one of my bugs actually that I submitted recently is on GitHub Enterprise, but um, Soul uh, yeah, we're going to talk more about GBT56 Soul. Uh, I think I'm pretty sure it found this bug. And, um, yeah, specifically is like great at finding these crazy things. And what I was going to mention about the GitHub program is yeah, there's just so many places where they have to do parsing. Um, you know, we've seen a lot of crazy bugs on like GitHub like issues and like in GitHub actions because again it's taking like some fields and having to like translate them and use them and it almost always has to do like build steps where there's like you know a sandbox and doing code execution.

It's like very very complex. >> But basically what happened here is >> the Babeld copies the get push options directly into the XA header without sanitizing semicolons. So you could inject and it's the and um the way that it parsed it, the last write is what was accepted. So if the if the the default Xstat header had in like a push option zero and then you pushed in another push option zero later on into the Xstat header uh via this bug like using the Babel D with your own semicolons, it would overwrite it. >> Um >> Wow.

So yeah, they they basically used that they used that >> uh inject repo. Uh they've injected a hook here. >> Interesting. >> I Yeah, I did not brush up on the escalation to rce, but it looks like that it had to do three separate things. Yeah, inject a non-prod rails env custom hooks directory and then do some sort of patch reversal. >> Yeah, dude. That's that that's pretty sick, man. Uh yeah, when you look at stuff like this man, this this is giving um this is giving Matias and Fron man, you know, like this sort of thing like just random header, you know, semicolon missing, you know, semicolon delimited, like let me just inject something in here.

Yeah. I just >> I don't know. That's one of the things that I feel like there's a good amount of and sure like um missing in the field still like certainly if you have code you can figure this out but like finding the stuff blackbox where you're just like spraying semicolons or curly brackets or something like that like that is so crazy to me. Um, and so yeah, >> unless you have some sort of oracle though to know what it does, it's probably fruitless because like in this case, let's say you did inject.

I mean, I guess you maybe could have like injected a semicolon, got some sort of error, >> reverse engineer that maybe the way it's working. I mean, it would have been like pretty gnarly to figure that out. on off. >> The way the way that I've seen um Matias and Fron do this is is like these are the two people that I've that I know that are just like unbelievably good at blackbox testing, right? Where and it's like, you know, they'll get some error and they'll be like that error just doesn't make any sense, >> right? >> Like there's no reason why that should be an error unless I'm breaking some context here, right?

You know, and then and then they start brute forcing and then they find something that doesn't cause the error, right? Right. And they're like, "Okay, so that's a valid syntax. Why is that valid?" And then they they like work back from that, you know? And I'm just like, and they find some crazy blackbox stuff with that, dude. Like it blows my freaking mind. >> Yeah. They're basically like filling in the dark and they, you know, they're filling different things and kind of like realizing what's there.

Yeah. >> It's almost AI like in my opinion like what what they do sometimes because I think they've seen such a variety of technical stack specifically, you know, in the Amazon environment, right? Uh but like they've seen such a variety of technical stack where they're like I bet that this is this you know and they just know they've paid attention to the syntax of everything that they've ever seen for like so long [laughter] and I'm just like oh my gosh that that's what it kind of feels like with with AI is like okay well >> you know do you ever hand you know AI at HTTP request it's like oh I can tell from this response that this is this framework and I'm like >> I've been doing this for 15 ears and I can't tell you that you know >> like >> yeah it has a very deep heristic of that uh yeah one of the one of my recent bugs that I submitted was um oh yes what was it oh it was a Google bug [snorts] and it was on something called unleash and it was very similar basically I told uh 56 hey I want you to find a crazy bug on on Google and it started looking I think at like anti-gravity or something and it's like oh yeah this is an unleash server And an unleashover always stores its secrets at this path.

Oh, and there they are. Here you go. And it's like, oh, you knew you just knew based on the shape of the the way it was working that it was unleashed. And you also knew where the secrets were because it's just baked into your your brain. But anyways, >> that's nuts, bro. That that is just so crazy to me. And yeah, that's that's where it's like, you know, is it AGI? Is it not AGI? I think it's absolutely AGI for for it stuff. >> I think the question is more is it ASI?

So, let me share my screen here. You know who poses this question? >> Who? >> Hashkitten. And so, if you don't respect us asking this question, let's listen to let's let's read what Hashkitten has to say about this. So, this is the guy who reported WP to Shell. >> This full exploit or is GPT56 sole superhuman? This full exploit was produced in just over 10 hours. Having used every Frontier model since the days of Chad GPT, my belief is that 56 represents a significant step up in security when compared to 5.5.

When reading through the chain it produced, I was astonished by several creative exploitation techniques that I would have previously thought were only the domain of humans. The use of a recursive batch call to avoid the restriction on Git, the cache abuse to apply change set and temporarily escalate to administrator, and the choice of a fake post that ends up calling parse requests hooked to replay the request with the assumed role.

I make no general claims, but I can say with complete confidence that no security researcher could have found and completed this chain in 10 hours. Yeah, >> even if even if I gave them the original bug and asked them to exploit it for RC, I'm not sure it'd be possible in that time frame. And so, yeah, to me, it's not just AGI, it's like almost ASI at hacking. Yeah. Um, and you know, just before this that we started recording, I was telling you I think that everyone needs to upgrade to 56 soul and and specifically 56 soul ultra. >> It has found crazy bugs on hardened targets that I would have never believed.

And it found WP to shell and it I think it also probably found that whiz. Um, so yeah, I know that Opus 5 is quite good and obviously you can find bugs with open source models as ad showed us, but I think to find like crazy hardened things like WP to shell if you throw 56 soul ultra at it, it can find crazy stuff. So >> wow. Yeah, dude. Especially Hashkitten saying that like Hashkitten is probably >> one of those people. >> Yeah, one of the people, you know, and he's like not a chance.

Not a freaking chance. So yeah, I think you know I think we are at a point now where AI is generally more competent than pretty much everybody [laughter] you know in in in uh in the IT field. I mean maybe there's some very very niche mega experts but even as a niche you know mega expert myself you know it's like it's like this thing is really really doing stuff you know. Um so I think specifically but but one thing I do have to be reminded a little bit though reszo is is we are in it which is one you know one field >> right >> right and and and AI stuff is extremely good at it you know if and we have seen it make progress in other areas right the the whole >> I think it's probably coding first >> well yeah math and coding and stuff like that >> yeah but you know other areas certainly The AI is not as good as expert psychologists or like you know uh you know >> how many how many examples can you come up with?

[laughter] I feel like the number of the number of domains there is just so small that the you know that if if they don't if they aren't requiring like humanto human interaction I think that they're probably I think that these top models are better than almost everyone at everything. Um like not hair not hair cutting like not you know all physical task definitely. Well, maybe not. I don't know. >> Physics. Physics is just applied math and it's really good at math. >> Yeah. >> Damn it, dude.

I can't believe we are seeing this in our lifetime, dude. What a crazy thing. What a crazy thing. >> I was just telling somebody that. Yeah. You and I I mean, if you have any kind of like um computer science expertise, you can spin up any project or any application in like 30 hours or less, 40 hours or less. You know, most things you can do in like three hours or less by just literally telling it, "Hey, do this." >> I was actually going to tell you about this.

Maybe we'll we're doing all right on time, so maybe we'll do this. But um I I um we got a puppy recently. A very very cute puppy. Maybe I'll put a picture on the screen right now. Uh but super cute puppy. >> Um puppies are a lot of work. [laughter] A lot a lot of work, right? Um and you have to take them out very very very very often, right? Or else they they will, you know, when they're not potty trained. Yeah. Um, and so, and my daughter is the one caring for this puppy primarily.

Um, and it's a complicated system, you know, that that goes into caring for this. So, I built her an app, you know, with with with Claude, uh, where, you know, it's it's got a mobile app. It's got a parent portal component, you know, and it and it tracks, okay, you know, now is the time. It'll show her a timer. It'll show like a green thing. And you you you know you at first I had it generating SVGs and you were like dude just have it have Nano Banana generate something.

It looks so good now. >> It looks so good, right? >> It looks so freaking good. Um you need to show me. So but yeah, I I literally put put that together in like maybe three hours, right? >> Uh total and it's like would have been hours and hours and hours and 40 50 hours of coding for me to get something that doesn't even look half as nice. >> Yeah. >> I I won't shill it too hard, but yeah, I built Reso's Rascals and I've probably put in like 40 hours.

Amazing. Yeah. >> And it and it I'm not joking. I think it's the most fullfeatured like uh elementary school like learning app that exists. Like it has everything that you can imagine. It has like a thousand lessons and like every subject and has videos and cards they can open and like >> a parent portal and an AI dashboard and like an AI assistant and it's like less than 40 hours. I mean a few years ago this would have taken like three years to build and then would have probably been full of so much tech debt that like the company building it needed like 30 engineers to keep up with it, you know?

It's like I'm one guy who did it in less than a week basically. It's absurd. >> It is absurd man. It is absurd. Anyway, >> uh we are very privileged to be existing in this timeline and I am grateful for it every day. >> Yes. >> Uh and you we are still very early man. We are still very early to all of this you know being able to uh operate with you know at the scale that we do with with cloud code with codecs all that sort of thing.

So would you >> I think my practical advice to the listener is just like anytime you think like oh it'd be nice to have this just make it. anytime you're hacking and you're like, "Oh, I should try this." Just tell AI to try it, right? Like I think that there's like a heavy heavy uh um bias that we have towards like everything in our life before like kind of pre AAI, especially these new frontier models that can do almost everything is that like uh things were hard and they took time and now they don't as much and so you kind of like can commit to more, you can try more things, you can do more things and if people are still living in that kind of like old mindset, they could like shift out of it to be more, you know, successful. >> Yeah, absolutely, man.

Um, all right. What's next on your list? >> All right, cool. So, I have a bunch of like actually really practical things. Um, >> all right. >> In in in general, I was just going to share about my hacking because I think that anytime I share this stuff, people really like it and it adds real value to their lives. >> Let me say as well before you get into this uh we talked numbers a little bit, Reszo and I did before this uh this episode.

He is freaking killing it in Buck Bounty this year, man. Give Give me some, right? Give me Give me Give me the fist bump through the camera right now. Dude, after doing the episode with ads, I'm like, "No, I need to get on ads level." And after the episode with Brutecat, I'm like, "Oh, I need to get on Brcast level." But you're right. I I'm I'm sure I'm still in very very top percentile. I appreciate that. >> All right.

So, with my hacking, um, you know, obviously up until like let's say end of June, I was full claw full COD code. I had three I had three subs. JD had three subs. We running in the hackbot, everything. I was still using it locally as well. When 56 soul dropped, I and like I I was actually I didn't really translate to it for the first week or whatever. I know we've already talked about it. 56 all is like a huge step up and specifically I was just like oh I should try more on the codeex app.

I'm like now obsessed with the codeex app. I don't think everyone needs to necessarily overhaul their stuff but if you haven't built stuff you should just try using codeex as your harness and then you still add skills. You still add your agent MD and everything but um the thing I love about it is one you don't use dash remote control like you do with um Claude. It's just like always kind of like synced to your phone and then um you can which you know a lot of people manage their agents via like SSH or Termius or whatever but a lot of things that are hard about that is like uploading photos.

Another thing I've noticed like with building your little app Justin you would have never had to use Nano Banana Pro like you only had to do that because you have Claude if you were in Codex you would just say make the art and it it under the hood it uses Imagigen and Image Gen is like the is like you know their latest and greatest dolly or whatever. It's their greatest model. It's like the exact same quality level as the latest Nano Banana Pro and it just knows how to use it natively.

So, it can just like create assets. It can create images and art and like it just does all of that kind of like perfectly. Um, their goal their goal mode is like a little bit better than Claud's I think. GPT56 is kind of like more agentic, so it'll run longer. Um, anyways, I just want everybody to know I'm like fully codeex pilled and I bought a second codeex thing. But, as a part of this, I understand more about how trusted access works.

So, speaking of our friend uh Cat from from GitHub and formerly Capital One, she got denied for TAC for trusted access for cyber through OpenAI. And um I was like, that's kind of weird. So, I reached out to um the OpenAI people like hey, you know, this person's like staff at GitHub and she's like a known trusted bug hunter like and she got denied. Do you have any insight into this? They're like, well, how old is her account?

She's been cloud code pilled and been using cloud code all year. She literally created an account and then tried to get it accessed to TAC, right? You can't do that. So, so if you have an existing, so what I'm trying to say is like for bug hunters out there, this is the practical advice. Don't create a new account and then request access to cyber models, they'll just deny you. It can't be a new account. So, if you have any pre-existing accounts, use that request trusted access for cyber and you're much more likely to be accepted. >> Um, >> let me ask you about that because I I recently my my code my cloud subscription maxed out and I was like, you know what, maybe now's a good time to try codeex.

So, I like switched to Codeex for a project >> and it did great. I mean, it did really well. Um, and so I'm running it, but I I don't think I have TAC. I I like I filled out I filled out like a verification >> that that's that's all it is. So, it's chatgpdyber. >> It's just that. Okay. >> And it's ju it's just like a ID verification. I think basically when they do the ID lookup, if you like don't have any history or I don't know.

I don't know how they do it, but that's all it is. It's just an ID verification. Yeah. >> Okay. Okay. Well, I have not gotten almost any denials from X. >> Same. >> I'm getting way more denials from Claude. >> I have an entire second inbox in X, which by the way, if you haven't checked on that, a lot of good stuff was in there. I found it recently the other day. I was like, "Oh, I have 100 messages in here." But anyways, a bunch of people, almost everyone in there.

Like half of them were like, "How are you not getting blocked? How are you not getting blocked? How are you not getting blocked?" So, I think tag does kind of matter, but those people might not also have a massive system prompt. So, like these top models are very influencable by real valid proof of credentials. And so in my agent MD, I'm like, I'm Reszo. My name's Joseph Thcker. You can go check on my website. You can go check out my blog.

You can go look at my hacker one profile. You know, like this is me. This is why I'm approved. This is okay. And so maybe that's why I don't get any blogs. So if you have something similar, that could be why. >> Yeah, that's interesting. I don't [laughter] >> I don't I I I have my my uh you know, CloudMD file or whatever that I've just had Codeex port over to Codeex. Yeah. is like >> short, >> you know, very short. And I mean, I I have like, don't get me wrong, I do have that, but it's like a paragraph.

It's like, hey, I'm Renerator. Here's my stats. Here's a place. I do verified bug bounty testing. You know, >> maybe these people just don't have that at all, >> you know? Yeah, that's true. That's a good point. >> Yeah. Yeah. >> Okay, cool. So, yeah. Um, that that's the hacking stuff. Let me talk a little bit about um two really cool things. So, one, I think, you know, prompting can still be a little, in general, I think most people are are think it's dead or whatever, but I think it can still be a little underrated.

So, I'm going to share this real quick because I thought it was really cool. >> Let me see this. >> Um, so this is Matt Schumer. He's just an AI guy. These aren't like security people, but he um built this. >> He's just an AI guy, you know? >> Yeah. He's he's not he's not in the hacking space, so you don't have to give him too much respect, but he is a AI guy. um like he's an AI influencer or whatever. So he he said Claude Opus 5 ones one-shot this game and it looks exactly like you know Modern Warfare or something >> and it it one-shot it has audio everything right and that actually is kind of hard to do >> and uh so I was curious how he did it and his problem's actually quite small so I want to read this to you I want you to build this thing it should be utterly perfect visually beautiful everything done at AAA quality from textures to physics anything you can think of and I think here's these two parts are what I think we could apply to hacking that'd be really cool fan out sub agents and have sub aents just tackle each one individually so that it's perfect.

You should loop on each one and have each sub agent check it visually to ensure it looks AAA. I think I saw another >> good tip. >> I saw another person that said, "Make sure it is perfect compared to what uh to like the other game." >> Yeah. Yeah. Right here. Don't stop until each sub is utterly wowed with the quality when compared to the actual game. So like this is obviously games only, but this like type of thinking can be applied elsewhere.

[snorts] >> Um and and then again it said it right here. loop until it's utterly perfect. Fan out sub agents and then he has he actually uses ultra code. I was gonna tell you this even though I'm Codex build and I'm using I'm using ultra in GPT56. So opus 5 ultra code may also be like maybe better. Um I've never I've not used ultra code much in opus. So >> wow that's interesting. Yeah dude I I will say I have just recently like yesterday it's funny you bring this up started doing something similar to this where I'm like I realize Claude is asking me a lot of questions like what do you want to do here? do should I go this route or this route?

And I'm like, look, just consult a sub agent, right? You know, like just keep consulting a sub agent until it is, you know, until you decide what to do. And if you can just branch if you've got two, you know, do I go left or right, you know, spin up a sub agent for both, you know, and just keep going, right? And I did get some good results out of that. So, um, >> yeah. So, he called this I kind of like the name of this, too.

He called it the gauntlet loop. It says the agent breaks the goal into parts, gives each part a specialist builder, and then ruthlessly blind critically them. Ruthlessly blind critics them where with with a mandate to pass only if the generate artifact is better than some sort of real world equivalent. So, I like this even better because this is abstract, right? It's not talking about games. And I also love the name that it's called the gauntlet loop.

You could even build the gauntlet loop into a skill and just tell it like, hey, use gauntlet loop to hack this, right? And then it would it would kind of do the whole process for you. So, thought that was really cool. >> Yeah, that's pretty sick, dude. That's pretty sick. You got something? >> Wow. Yeah, I do. Uh I'm I'm just thinking I I gotta >> Every time we get on these calls, you're like, "Oh, I need to go do this thing.

I need to go do this thing." >> Yeah, dude. It's a little tricky nowadays, man. It really is because if you're trying and actually, let me I don't know if we'll cut this segment or not, but one here's one of the things. If we're going to cut, we're going to cut it now. Uh and then we'll cut back in later. But um dude, I I kind of feel like maybe LH are not the most efficient use of my time anymore. >> Interesting. Like >> that's what DJ recently told me the same thing. >> Really? >> Douglas said the same thing. >> Yeah.

Cuz I'm I'm thinking like, you know, in the past the bounties were inflated in such a way that like it it it offset the dupe risk, but I think with everybody using like AI and stuff like that, the dupe risk is higher. >> And I als think it also doesn't reward people that go hard as much as it used to, right? Like if you go super hard and you get super deep then and you find a cool bug, you're like sweet, you know, that's not going to get duped.

I know that, right? And things are getting duped, bro. >> And and uh and I'm I'm wondering now if it makes more sense for me to just instead of competing in these legggs, just double down, triple down, quadruple down into the hackpot. >> Yeah. You know, >> having seen what JD and Joel have gotten into and knowing that Matt Brown's out there too, I'm like, if you got started on the IPC, dude, you're just going to dup them all.

Yeah. Yeah. It's it's it's rough, man. It's rough. So, >> we'll see. Well, let's talk about this. >> Isel is Joel also in in the IPC? >> He is. Yeah. >> Ah, >> Anyway, that jerk. I now I've got to message him. [laughter] Okay. I'm sorry. Go ahead. >> No. Well, so I Well, I just want to one extract the practical aspects of this for our listeners, but mostly for me. So, like, so where is the edge? cuz I recently had oh actually do you remember that post I did that got like 60 emoji reacts in the critical thinkers channel that uh where I basically listed out like hey the ways to succeed in bug bounty are basically to be faster to go deeper to be uh to be well networked but anyways basically the point is yeah on that blog post or on that post I basically wrote like a huge thing it was almost like uh exclusive content it was like to succeed in bug bounty you need to either be faster than people and the way you can do this is when you get a new invite you go in there you do the thing whatever you can like smarter than people like with a specific thing like you can be the expert at headless browsers like you can be the Alex Chapman right or you can be the AI guy like I am right and people will drive you leads or your friends will bring you leads like you know if you're big like me maybe everyone brings you less or chat or whatever but if you're >> I found the thing yeah I'll put it in the in the chat for people that uh are critical thinkers it is in the critical thinkers tier >> yeah I'll put it in the description >> yeah everyone can see it but basically uh someone tagged me my whole point in all this was someone tagged me this week and was like what's the new version of that for AI and you're you're and you bringing this up about live hacking events makes me wonder what it is also.

And I think there's a couple things. One is it's like all that same stuff but applied vi, right? So it's like you still have to be faster. You still have to be better. You still have to write better reports. You have to and so but anyways, let's talk about what might be new. The newest thing I think Justin is really deep prompting like really like that like that prompt I I sent you before we started that's basically like hey these epic bugs have been found. we need an equal level epic bug that basically completely bypasses Google's entire off structure on Gmail, right?

That sounds it sounds too big to be true, but like you don't have to apply it to that, right? You can apply it to whatever program you're hacking on. And I think that you also need to be gaslighting your model like nope, there's definitely a bug here. Nope, there's definitely a bug here. Because even 56 Ultra came back to JD multiple times at this event was like, "Nope, there's not a bug here." He's like, "Yeah, there is.

I know there is." And eventually it found [laughter] he like found some crazy >> bugs. I know that's exactly what JD was like, too. He's like, "Yes, it is. >> Yes, [laughter] there is. Stop telling me that." Yeah, exactly. And honestly, I would have stopped. I would have stopped. Like, he he challenges me in the way that he is willing to be persistent. But to me, it just feels like wasting tokens. It's like, what if I send this thing back to this a sixth time and it doesn't find anything, right?

And so, I think one, there's persistence. >> Two, I think anytime you can get your hands on exclusive scope, you have to do it. And that's always been true for bug bounty, but I think now even more than ever, if you can get access to scope that someone else has not found, whether it's the form of a hidden subdomain, whether it's a business access, honestly, hardware is the way to go, dude. They are so good at finding RC and hardware.

If so, like if you actually >> I just got shipped a device uh that I'll tell you about as soon as this ends, so we don't have to believe it. Um there's already enough edits in this one >> for that. That sounds good, man. >> Yeah. And so yeah, so I so I think that basically you need to apply the to you need to apply these top AI models to a new scope. Specifically, I think things where you can do that are expensive business purchases, things that you for some reason have access to because of your country or because of your connections, because of your network or hardware, you know. >> Yeah.

Well, it's it's an interesting time, man. And I feel like Yeah, I feel like I really should just block out every distraction right now and just go ham on building Hackbot stuff. And I bet that would pay off a ton. Uh >> yeah, it's it's easy to have FOMO. I've thought about that too. Yeah, there's just like this like anxiety around am I maximizing the benefits that I get from having uh access to these top AI models and being an expert and kind of being early and I think that it can definitely get like give you bad anxiety too.

But >> for sure yeah 100%. And I think also as we're building these thing, one thing that I'm running into a little bit now is I have I take on more projects than I should I think right now. you know, because I know that I have the capacity. You know, I know that I'm I'm doing it, but one of the things that I haven't >> really factored in is like how much freaking context switching is happening. So, literally, I'm using the four monitors and I've got four different projects I'm working on and I'm and and one of the projects has four panes, you know, and and so I'm like boom boom boom boom boom boom boom boom and I do that for three hours and my brain is just completely freaking roasted. >> Me and J were talking about this.

I think this actually rewards people who have ADD. Like I I I love this about to develop some addition. >> Instead of four, instead of four panes in codeex, I have a project level folder for each project and I just bounce between them. It's like, oh, go fix this in rescals. Oh, go fix this AI save your parents. Okay. Oh, go hack this on this program. Oh, go hacker this on that program. You know, >> hey, can I mention one more thing before we drop? >> Yeah. >> Um, just people >> cover any of the any of the like kind of rail rails to shell or the WP to shell. >> Okay.

Do you want to do that, Ted? Yeah, we got to do it. I'm sorry. We got you go. We gota we gota hold some some integrity here. Some technical integrity. Um >> so uh recently uh things been getting popped, let me tell you. Uh so the ethack team uh dropped kind of rails to shell which is a pretty much default configuration rails rce. Um and I don't they actually haven't released the write up for it yet. It's actually kind of new at the time of recording this, but yeah.

Um, there was a PC on GitHub that I found and had AI summarize uh it for me and I think I kind of get it. So, essentially this requires a file upload of any type, right? If you have any sort of file upload, you're you're kind of cooked on Rails right now. So, you upload it. Um, it Rails hands off the image to lib VIPS, uh, lib vips and its decoder sniffs based off of the files contents rather than off of the actual like uh, extension or file type that you passed in.

So, you can upload something as like a a BMP or whatever, but VIPs is going to um, you know, apply whatever it thinks that file type is. Uh, and the ones that they chose for this exploit was a mat mat lab file, which is actually HDF5, which is a file type that's a little bit more complex and meant for like data, right? Like it kind of would for mat lab. Yeah. >> Um, and that sort of thing. Now uh HDF5 has this feature called external storage where the data sets you know the the the data for this file can actually just be in a different file in the file system [clears throat] which is that is a really good uh you know primitive to have in a file type.

So I'm sure that there are other things vulnerable to this similar like now I'm uploading a mat lab file and now actually my you know image data is in Etsy password you know like >> um and that was essentially what it was. So, um, you were able to say like, "Hey, the pixels for this specific file are in, you know, password or whatever, and then it would it would grab it and embed it in it." And you there's a lot of extra stuff you had to do like you need to upload an image and then get like a signed piece and then modify it and and there there were some some more complex pieces to it, but the PC is out there.

But the whole concept that I wanted to give give to the listener here was like I bet that mat lab file thing you know where where it's using this um this HDF5 format will get you LFI or LFD somewhere else in in uh you know in other frameworks as well. >> That's really cool. This feels similar to I found um well I guess AI found a bug. Yeah, it was a local file disclosure in Magento [snorts] where you you had to be an authenticated user or maybe even an admin, but basically when you change like your profile picture or like uploaded some image, you would be like, "Oh, the image is in Etsy password and it would just like pull it and put it into your uh you know make basically make it a image file for your for your profile uh or for that asset and then you can just download it." >> That's crazy, man.

Yeah. What what an what nuts stuff. And I will also say um this bug was reported first by uh OXACB Andre, our man. Cosmic dude. Um but also uh it was reported a few days later later by none other than >> No, it was not. >> Yes, it was. Dude, that guy is just freaking everywhere, man. >> Everywhere. >> I swear, man. Yeah, dude. GMO and Flat, >> they really slurped up a good one when they got Odo Duck, man. you know the history behind that every time it comes up.

[laughter] >> But dude, it's crazy, man. It is crazy. Like Yeah. If I could pick the dream team, you know, it would be it would be tuck and hashkitten and you know that like like that that is >> SL Cyber and Flat Security. Yeah, >> exactly man. Yeah. And um but yeah, GMO actually acquired Flat and and Odo came with it and I'm like they I don't I don't think they know what they got when they >> There's a D there's a diamond in the rough.

They didn't they didn't know that. >> Oh my gosh, dude. Yeah. So anyway, really awesome stuff. You want to hit WP Tellelle and then we'll we'll close it. >> Uh yeah, we kind of talked a little bit about it. Let me see here. Okay, sweet. Yeah, we talked about Hashkitten's thoughts on ASI, but we did not talk about um the way that WP to shell actually works. So um you know whenever hashkitten initially kicked this off basically he saw that soul had solved this like crazy math conjecture and he gave it this massive prompt.

So you can go use this and apply it in like a prompt that you would but I'm going to break down exactly how WP to shell works from the beginning to the end and it's absolutely absurd. And so basically um in WordPress there's a thing called there's a REST API and in there there's a batch a set of like batch uh like a way to basically do multiple requests to the to the API all at once in a batch right so here's an example of it in the in in the blog post it's you know it's a patch to the endpoint the post with a new title and it updates the first title and then here's another post and it updates the second title and you can do all this in one right the thing is it is accessible it it doesn't always work because it it does validate permissions later, but um you're able to call the bast batch rest API unauthenticated and so um you know that's not really a big deal.

It might allow you to kind of like spam or something but uh what soul um realized whenever it was doing code review here is that [snorts] this is the order of events that happened for those uh batch requests. So it checks that it um has the required and valid parameters. Then it sanitizes those parameters. Then it runs the permission checks and then it executes the endpoint call back. You know, it actually like does the thing.

[snorts] And so um when it's doing this, it actually breaks it down into uh a couple different things like it it it loops over all of the requests for validation and it loops over all the requests for um actually like matching them to execute. And so there's a vulnerability in that here. You can see where um for each request it does is it um you know is there an error which is where it does the error checking and then if there's not an error continue and [snorts] so um the the val whenever it validates it can basically get out of sync with the matches because it sends in this uh this array of requests twice.

First to validate and then and then second to actually execute it. And so um or first to validate it and then also to match it. So you can see here I'll read this. [snorts] Do you spot the vulnerability here? If we take is w uh WordPress error single request branch the validation array is updated but because of the continue the matches array isn't updated. So basically you can desync between your validation and what will eventually get executed.

Right? So now you're hopefully kind of um you can you can imagine as the first one is n and then the next one is n plus one. So if you can basically fake validation by having a valid request followed by an invalid request. Now all of a sudden your um you know your invalid request can be whatever you want it to be. So that was like the first primitive in this chain of bugs. [snorts] And then um and also I took notes because this is very very complex.

Um so the next thing that kind of is an issue is um in the v2 post endpoint there is a check right here that says if it's an array then do uh absolute uh like you know uh do the absolute value of the integer for each um parameter in the array for each you know entry in the array otherwise um you just like let it go through if it's a scalar string such as fubar it will just get interpolated directly into the raw SQL query.

So here here's a nasty bug. It even says this here's a nasty bug. Basically if you're author not in [snorts] um and normally this would never even get past validation. You know you got to remember if you're looking at this request and something is and if you're looking at like a request to the REST API and [snorts] the author is not a array it would normally just error out of validation. But because we have a desync, we can bypass that validation.

And then now um if it is a string and [clears throat] not a not an array, we now have straight up SQL injection. Um as it says here, this would normally be a problem when calling this route directly as the public author exclude parameter must be an array of integers. But because it's via this batch API, we have our validation execution mismatch allowing us to neatly sidestep the parameter validation. So here's what it looks like. you have a request with a invalid path.

So this fails validation um and then this one is able to bypass and slide in where the body author exclude is set to fooar and fooar can now be a SQL injection. The issue here is that um is that uh it's a get request. So um and get requests are not allowed via the batch API. However, soul figured out that um you can just nest this basically use the validation bypass recursively. [snorts] So, uh it's really neat here.

Uh it does the it does the broken um validation so that it gets into the second thing. Then it does the broken validation again and then you get in and you can uh do the author exclude uh with the method via get in order to um uh exploit the SQL injection. So now there is SQL uh injection in WordPress which would be a huge deal right pre-auth um and if you download weak hashes you can actually crack hashes and become an admin via that but obviously there's often going to be secure passwords and so that reduces the impact and so um hash kitten set it back to soul trying to figure out how to get like full RC and so as a little bit of context here it explains to you how the cache works I'm going to have to read my notes on this because it's crazy uh but basically [snorts] um with the SQL injection and post that you can now use unionbased injection which is right here to fake the posts that come back.

They these posts gets put into the cache and then that cache eventually down here gets compared to the inmemory um it gets compared to what's actually in memory. And so then those get compared and it and it does like kind of like a um a merge of sorts and that allows us to control certain fields. And so um yeah, if when the database row and the in-memory cache disagree, WordPress prefers the in-memory fields which we fully control.

So there's a neat feature called embeds. Um normally just the access to this cache isn't a big deal because it doesn't actually write to the DB, but there's a special feature called embeds which do get written to the database. And so um that's that's yeah normally we're only controlling what's in memory but um because we can write to the DB it can create a mismatch between those and then it basically does like a merge.

The thing is um the access to the post type we have um is not that uh powerful [snorts] but there's a special type of post that we have access that this gives access to called a customized change set. And um it says soul hones in on a special type of post called a customized change set. So, whenever you draft um an edit in your site's WordPress, sometimes there's a customized change set that get executed. And I'm going to just jump to the punch line here.

Basically, inside when it's processing a customized change set, it does this right here, WP set current user, and it sets it to whatever the user ID is in the change set. You can see right here, user ID 1, user ID 1. User ID1 is the administrator. So basically um we're able to with that access to the in-memory um data and the and to the cache through the SQL injection we're able to set up a change set post type to execute what we want as administrator.

The thing is we don't have access to the post content which is a field which the change set type uses. So now it has to figure out how to get access to the postcontent um parameter and it is so complex. I will leave this as an exercise to the reader. Basically there's like this treebased um like parent node based relationship. It says WordPress anticipated having a scenario where like you make a post a parent of itself and it causes a bunch of issues.

So then they have they have this way that you can resolve this and what that allows you know there's some sort of nuance here that soul basically figured out in order to be able to uh resolve and control the post content. Um and so the question is kind of like how do you do that? And it's through what's called is a is a hook. So in WordPress there's a uh there's a notion of like hooks that can be run at certain points and it figured out how to use this parse request hook which is genius because what it does is it replays the entire batch API request from the beginning.

So the entire you know payload that we were sending in earlier will now get um sent in again but all as an admin. So the exploit is like pretty genius. Basically uh I'm going to skim past this again. If anybody read all of this in full and understands it fully, they are superhuman. But here's the really clever part. In the original batch request, Soul included a request to create a new administrator. That fails on the first pass through batch v1 because it's executing as guest.

But then on the second pass once we did all of that setup and it passes back through as an administrator, it executes uh it creates an administrator so that the call succeeds and a new admin is created. So, is GPT56 soul super superhum human? In my opinion, absolutely. >> All right. All right, man. I think that's the pod. That That is a crazy bug, though. >> Yeah, it is. Sweet. Thanks, guys. Sorry for this short episode. >> And that's a wrap on this episode of Critical Thinking.

Thanks so much for watching to the end, y'all. If you want more critical thinking content, [music] uh, or if you want to support the show, head over to ctbb.show/isord. You can hop in the community. There's lots [music] of great highlevel hacking discussion happening there on top of master classes, hackalongs, exclusive [music] content, and a full-time hunters guild if you're a full-time hunter. It's a great time, trust me.

All right, I'll see you there.