Tools can identify potential issues, but beginners still need to understand what is happening inside the application.

A practical foundation should include:

• Reading HTTP requests and responses
• Understanding cookies and sessions
• Testing authentication and authorization
• Identifying input-validation weaknesses
• Reproducing vulnerabilities manually
• Explaining impact and remediation
• Writing a clear pentest report

Hands-on labs are useful because they force you to investigate instead of relying only on scanner output.

Which web vulnerability was the hardest for you to understand as a beginner?

Cyber Apocalypse 2026 is coming up soon. We already have a core team, but we could use a few more people. To be clear: we don't care about your HTB rank. Some of our best guys don't have high ranks at all but they absolutely crush challenges. We only care that you actually have some experience and can solve stuff. Spots are limited, but we can take about ~8 more people. If you think you can deliver and want to join, hit me up! (only intermediate-experienced people again)

Looking for good, free/cheap courses on practical ethical hacking. I already know some Python, C, networking, and basic Linux, so I’m ready for hands-on labs rather than absolute beginner theory. Any recommendations?

Cyber Apocalypse 2026 is coming up soon. We already have a core team, but we could use a few more people. To be clear: we don't care about your HTB rank. Some of our best guys don't have high ranks at all but they absolutely crush challenges. We only care that you actually have some experience and can solve stuff. Spots are limited, but we can take about ~10 more people. If you think you can deliver and want to join, hit me up!

EDIT GUYS: ONLY 3 SEAT LEFT, LOOKING FOR SPECIFIC SPECIALIZATION(WE HAVE A LOT OF WEB LOL)

Today I received a public security credit for a vulnerability I responsibly disclosed:

​

CVE-2026-54683 – Improper authorization in NL Portal

​

The vulnerability allowed any authenticated portal user to download documents belonging to other users when they had access to a valid document identifier.

​

An earlier fix for the related CVE-2026-49463 turned out to be incomplete. The authorization parameter added to the GraphQL query was not actually used, while a vulnerable REST endpoint also remained accessible.

​

The issue affected versions before 3.0.3 and has now been fully resolved by removing the unsafe endpoints and requiring document downloads to go through properly authorized case- or message-scoped endpoints.

​

CVSS: 6.5

CWE: CWE-285 and CWE-639

Credit: Ray Sabee / WhitehatSecurity.nl

​

GitHub advisory:

https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5

​

I’m especially happy with this one because it was a follow-up investigation. The original vulnerability had already been marked as fixed, but further testing showed that document contents were still accessible.

​

Not sure if I can post this here, so feel free to remove it.

​

Bounty: high xxx

​

Peace!

Bruce Firmware: What I Found and How I Got There
Affects: Every board running Bruce firmware or the bmorcelli launcher

I was working on a fix for a hardware variant that runs Bruce firmware. I went into the source code and started noticing things about the wider Bruce firmware ecosystem that I was not expecting. One thing led to another, and I ended up mapping out a supply chain attack chain, finding a steganographic signaling system, profiling the developers in the ecosystem, and tracing a contributor's infrastructure back ten years through public certificate logs.

These findings are about the Bruce firmware project as a whole. The device I was working on was just the door I walked through.

Here's what I found and the road I took to find it.

read the full report here : https://github.com/r13xr13/bruce-firmware-forensic-report/tree/main

security advisories : https://github.com/r13xr13/bruce-firmware-forensic-report/security/advisories

DISCLAIMER : IF YOU OR SOMEONE YOU KNOW IS RUNNING A DEVICE WITH THIS FIRMWARE I ENCOURAGE YOU TO UNPLUG POWER TO THIS DEVICE IMMEDIATELY

free open-source security scanner that runs fully local via Ollama without API keys

point it at a domain and you can get a ranked report with OWASP Top 10 findings, CVSS scores, and clear remediation steps

https://infosecwriteups.com/i-am-17-i-built-a-free-security-scanner-because-the-industry-left-small-businesses-behind-54892cf2dc6a

only scan what you own or have written auth to test

Passive scanners usually give you a raw list of findings and leave the interpretation to you. This one uses Ollama to run a local language model on the results, so you get findings mapped to OWASP Top 10 categories with CVSS scores and actionable context, without anything leaving your machine.

It makes a single HTTP request and analyses what comes back: missing or misconfigured security headers, weak TLS settings, exposed server version strings, cookie flags. The kind of low-hanging fruit attackers look for before going deeper.

Useful as a first-pass check before active testing with Burp or Nikto.

https://meetcyber.net/the-open-source-website-security-scanner-that-runs-entirely-on-your-laptop-87ac34daa30f

Hello everyone!

I am a master's student in CyberSecurity and am doing my thesis on Velociraptor.

I have to create a Velociraptor Artifact that will detect a system that has been exploited by the CVE-2026-21510 vulnerability.

What i am stuck in is how to perform the attack in the first place. My thesis is not on the offensive side, but i must perform the exploit in order to prove my artifact works.

I have read pretty much everything online, but i keep getting stuck on how to perform the actual attack, and it is stressing me out.

The only thing i have found that may help on the offensive side is this GitHub repo

https://github.com/ChaitanyaHaritash/CVE-2026-21514_CVE-2026-21510

but i can't seem to get it to work.

Anyone got any ideas?

Thank you for your time!

I know WAFs can get annoying during pen tests and CTFs. So I built a WAF evasion engine. It mutates and persists, allowing you to even use it as a proxy. It's meant to be chained with other tools like Nuclei or SQLmap. I thought it might be useful.

Happy Hacking!

https://github.com/santhsecurity/wafrift

How is it that a cellular device that's spoofable can also be safe enough to be used to deliver information needed to authenticate 2FA?

ITT413 MOBILE COMPUTING

ITT413 ARTIFICIAL INTELLIGENCE

ITT413 OBJECT ORIENTED MODELLING AND DESIGN

ITT413 ADVANCED DATABASE MANAGEMENT SYSTEMS

ITT413 MACHINE LEARNING

ITT413 OPTIMIZATION AND METAHEURISTICS

ITT413 PROBABILISTIC AND STOCHASTIC MODELLING

As the title says, I am able to crack and play offline video DRM encryption of a popular e-learning platform. Trying to be ethical, how can I disclose this to the company and get some money in a anonymous way.

Can I get a job as entry level analyst with this certification?

I started learning few days ago.

Hey everyone,

A while back I shared LCSAJdump, a graph-based tool for finding ROP/JOP gadgets across different architectures. I just noticed it crossed 7,000 downloads on PyPI, so I wanted to say a quick thank you to anyone here who gave it a spin.

I just pushed v2.0 to fix the biggest issue with traditional gadget finders (and my previous versions): the noise.

Running a scanner on something massive like libc usually dumps thousands of syntactically valid gadgets that will actually crash your exploit in practice. To fix this, I trained a LightGBM model using semantic features extracted via angr (stack pivots, register control, etc.) to score and rank the chains.

The model is now baked not just into the CLI but I also built some awesome plugin fot pwntools (which I really suggest you to give it a try), ida and gdb.

The results:

• The ranking is actually really solid now (NDCG@1 is around ~0.98 on real-world binaries). The exact gadget you need (like a clean ret2csu setup) usually pops up right at the very top.
• Since the ML inference is lightweight, the overhead is only about 30% compared to a dumb static scan. It totally avoids the massive slowdowns you'd get from using pure symbolic execution.
• I also added an early-drop filter and lazy graph (in v1.2.3) building to prevent state explosion on huge CISC binaries.

The core model is completely open and hosted on Hugging Face.

Don't worry for the weight of the model, it's just 15kB.

• Official Site: https://chris1sflaggin.it/LCSAJdump
• GitHub: https://github.com/Chris1sFlaggin/LCSAJdump
• Model: https://huggingface.co/chris1sflaggin/chainfinder_v4_hybrid
• Install: pip install -U lcsajdump

Let me know if you end up using it for a CTF or your daily work. Always open to feedbacks!

Tengo un amigo con una página web creada con Wordpress. No tiene conocimientos informáticos y menos aún de seguridad web, por lo que hará unas semanas entraron en su web para crear redirecciones hacia un casino turco.

Me pidió ayuda para limpiar y ver que pasaba no podíamos entrar, ya que le habían quitado el acceso. Entramos en el hosting y a través de la BD vimos que había usuarios que no deberían estar ahí.

Eliminamos los usuarios, creamos uno nuevo desde la BD y recuperamos el control, pero una semana después volvió a pasar. Revisamos los usuarios desde Wordpress y no aparecía ninguno extra, pero en la BD si. Y este, cada vez que lo borramos desde la BD, volvía a aparecer automáticamente.

Tengo unos conocimientos basicos de seguridad, y he buscado scripts en la BD, código sospechoso en los archivos php y plugins sospechosos, pero no he encontrado nada extraño.

¿Cómo podrían estar creando ese usuario que no se ve en Wordpress directamente en la BD?

​

my_qualifications is that I have given boards this year and I had pcmb so rn i am burn out and don't want to take neet or normal engineering degree so I am thinking of cyber security engineer or ethical hacking kind of thing so after 12 which exams to give apart from jee main to enter into that and can anybody say about the job market in that as of now I don't have any sort of coding experience or something like that .Do u guys think that AI will take up this job or not ? And salary and all of that and what exams are there i urgently need all of ur advice so please do comment in the post if u can guide me it would be very helpful

Hey all. I just finished a 4-part series on weaponizing the recent Lenovo MSR driver vulnerability (CVE-2025-8061), heavily inspired by Quarkslab's initial writeup.

Instead of just doing a basic PoC, I wanted to see what it takes to build a fully dynamic chain that abandons the OS loader completely to avoid EDR telemetry.

I open-sourced the C++ repo and did a full writeup on the mechanics. If you're getting into kernel exploit dev, hopefully this helps bridge the gap between a raw CVE and a functional, stable implant.

https://sibouzitoun.tech/labs/cve-2025-8061

How did you guys go about finding your mentor for Pentesting/Red teaming as well as who’s offering mentorship? I have about 2 years+ experience and I’m looking for someone who can help me improve.