Oh you found a weak cipher and tlsv1 enabled. Okay ,and ?

Those are vulnerable to poodle or beast or some other shit.

Okay did you actually exploit those ?

No because they need a lot of traffic.

Then why you didn't do that?

Why waste time writing those shitty stuff really? Are we just filling the report ?

In a risk assessment or GRC work okay I understand that, but informative in Pentssting whyyyyyyyy

Web application security has no shortage of training targets—DVWA, WebGoat, OWASP Juice Shop, PortSwigger Web Security Academy, and many more. But when it comes to **Windows thick-client (desktop) application security**, realistic hands-on practice environments are surprisingly hard to find.

That's why I built **VulnDesk Pro**.

VulnDesk Pro is a **free, intentionally vulnerable Windows desktop application** built with **C#/.NET 8 (WinForms)** that simulates a real enterprise application. Instead of providing the source code, it ships as a compiled executable, so you approach it the same way you would during an actual desktop application penetration test.

The current release includes **31 CTF-style challenges** covering topics such as:

* DLL hijacking / DLL side-loading
* Insecure IPC
* Weak and misused cryptography
* Secrets exposed in process memory
* Reverse engineering & binary patching
* Hardcoded credentials and secrets
* Broken access control / privilege escalation
* Cleartext network communication
* And more...

The idea is to use the same tools you'd reach for during a real assessment—**dnSpy/ILSpy, Process Hacker, Process Monitor (Procmon), x64dbg or WinDbg, Wireshark, DB Browser for SQLite, Burp Suite**, or whatever tools you normally use.

The application is **self-contained**—just download, extract, and run. No .NET installation is required.

> **⚠️ Please use it only inside an isolated VM or lab environment.** VulnDesk Pro is intentionally vulnerable and unsigned as part of the training experience.

**GitHub:**

This is my first open-source security project, so I'd genuinely appreciate feedback from people who perform thick-client or desktop application assessments. If you've got ideas for new challenges, attack techniques, or scenarios that would make it even more realistic, I'd love to hear them.

Hello there!

I’m currently trying to dive into cybersecurity and pentesting, but I am running into a massive wall with my ADHD. Right now, I am trying to focus on the foundational stuff (networking, Linux, basic scripting, etc.), but I am getting incredibly overwhelmed.

It feels like a paradox: the field is so vast that my brain wants to learn everything at once, but the moment I sit down to tackle the slow, dry basics, I under-stimulate, lose focus, or get paralyzed by how much there is left to know.

For those of you who have ADHD and successfully broke into the field (or are currently managing it):

Any working tricks to hack my adhd?

◆ How do you structure your learning?

◆ How do you prevent "rabbit hole" burnout?

◆ What does your study setup look like to keep distractions at bay?

I would love to hear your stories, tips, or even just reassurance that it's possible to get past this initial hurdle. Thanks in advance! sorry if this is a duplicate post. :)

Maybe you will see my post somehwere else too :(

HI everyone,

For the folks who regularly do mobile PT, is it okay for a finding for sensitive data(e.g auth token) stored in memory to be reported .However the dump of memory is done while the app is running, not after closing it.

Does that make sense as a finding?!

I believe it would be a valid finding if we dumped the mem after closing the app.

Thanks in advance !

Hey everyone!

I just created a completely free AWS pentesting lab. It's hosted on Hack Smarter (nothing you need to spin up in your own AWS account). You start with an Access Key and Secret and it's up to you to figure out a way to compromise the full AWS account.

Just wanted to share here since it's free -- no strings attached :)

Do you have a formal QA process for pentest reports before they go out? 

If yes, what does that typically involve? If not, has that ever caused issues? 

Online labs are useful, but building your own ethical hacking environment teaches something equally important: how real systems, networks, services, security controls, and misconfigurations work together.

A home lab gives you a safe, controlled space to practise penetration testing without risking production systems or unauthorized targets. You can run aggressive scans, test exploitation techniques, break configurations, restore snapshots, and repeat the entire process until the workflow becomes familiar.

This detailed guide from Redfox Cybersecurity Academy explains how to build an ethical hacking home lab from the ground up.

What hardware do you need?

You do not need an expensive enterprise server to begin.

For beginner and intermediate labs, the guide recommends focusing on three core resources:

• A processor with virtualization support

• Enough RAM to run multiple virtual machines

• SSD storage for operating systems, snapshots, tools, and vulnerable machines

A system with 16 GB RAM can work for a basic Kali Linux and vulnerable-target setup, but 32 GB provides more flexibility when running several machines together. More advanced Active Directory or red team labs may benefit from 64 GB RAM and additional CPU cores.

Choosing the right hypervisor

Your hypervisor allows you to create and manage isolated virtual machines.

The guide compares three common options:

VMware Workstation Pro

Suitable for desktop-based labs, snapshot management, virtual networking, and importing prebuilt vulnerable machines.

VirtualBox

A free and cross-platform option for learners who want a simple environment without dedicated lab hardware.

Proxmox VE

A scalable bare-metal hypervisor for users who want a dedicated server, remote web management, multiple networks, virtual machines, and containers.

The best option depends on your hardware, budget, and the scale of the environment you plan to build.

Set up your attacker machine

Kali Linux is commonly used as the attacker system because it includes a large collection of penetration-testing tools.

After importing Kali into your chosen hypervisor, update the operating system and install the tools required for your learning path. These may include:

• Nmap

• Burp Suite

• Gobuster

• FFUF

• Nuclei

• Impacket

• BloodHound

• Neo4j

• Evil-WinRM

• SecLists

Before making major changes, create a clean snapshot. This gives you a reliable restore point when installations fail, dependencies break, or testing damages the environment.

Add intentionally vulnerable targets

Your target machines are where practical learning happens.

You can begin with a single vulnerable Linux machine and gradually expand the environment using:

• VulnHub virtual machines

• Metasploitable

• DVWA

• OWASP Juice Shop

• Vulnerable Windows evaluation systems

• Custom web applications

• Intentionally misconfigured services

These targets allow you to practise reconnaissance, service enumeration, web testing, vulnerability discovery, exploitation, privilege escalation, and reporting.

The goal is not simply to compromise the machine. Document the complete attack path, identify why the weakness exists, understand the impact, and record how it should be fixed.

Build an Active Directory lab

Once you are comfortable with basic Linux and Windows testing, you can create a small Active Directory environment.

A simple setup may include:

• One Windows Server domain controller

• Two Windows client machines

• One Kali Linux attacker machine

• Multiple users, groups, services, and administrative roles

You can introduce controlled weaknesses such as:

• Weak passwords

• Kerberoastable service accounts

• Excessive group permissions

• Misconfigured shares

• Reused credentials

• Weak delegation settings

• Poor local administrator controls

This allows you to practise domain enumeration, credential attacks, lateral movement, privilege escalation, attack-path analysis, and remediation in a realistic environment.

Isolate your lab network

Network isolation is one of the most important parts of lab design.

Intentionally vulnerable machines should not be exposed directly to your home network or the public internet.

Common virtual networking modes include:

Host-only

Allows communication between selected virtual machines and the host without providing normal internet access. This is generally appropriate for vulnerable targets.

NAT

Allows a virtual machine to access the internet through the host. This can be useful when updating Kali or downloading tools, but it should be used carefully.

Custom isolated network

Creates a dedicated virtual segment where only approved lab machines can communicate.

Before testing, verify that vulnerable targets cannot reach external internet addresses. Also confirm that your attacker and target machines can communicate only through the intended lab network.

Install essential testing tools

A useful home lab should support different phases of a penetration test.

Nmap

Use it for host discovery, port scanning, service detection, operating-system identification, and network enumeration.

Burp Suite

Use it to intercept and modify web traffic, inspect requests and responses, test authentication, analyze APIs, and identify application vulnerabilities.

Nuclei

Use template-based scanning to detect known vulnerabilities and common security misconfigurations inside your controlled environment.

BloodHound

Use it to visualize Active Directory relationships and identify possible privilege-escalation paths.

Tools should support your methodology, not replace it. Always verify automated findings manually and understand why a vulnerability is exploitable.

Use snapshots properly

Snapshots make experimentation repeatable.

Create snapshots:

• After a clean operating-system installation

• Before introducing a vulnerable configuration

• Before attempting an exploitation exercise

• Before installing major tools or updates

• After reaching a stable lab milestone

After completing an exercise, restore the target and repeat the process without relying on previous notes. Repetition helps turn individual commands into a practical methodology.

Add complexity gradually

Avoid building a large enterprise environment on your first day.

A practical progression could be:

1. Kali Linux and one vulnerable Linux target

2. A vulnerable web application

3. A Windows target

4. A small Active Directory domain

5. Multiple network segments

6. A cloud or container-testing environment

7. Logging, detection, and incident-response tools

This approach makes troubleshooting easier and helps you understand each layer before adding another.

Practise both attack and defence

A strong ethical hacking lab should eventually show you how attacks appear from a defender's perspective.

You can add logging and monitoring tools such as:

• Elastic Stack

• Wazuh

• Sysmon

• Windows Event Forwarding

• Suricata

• Zeek

• Security Onion

Run your own scans and attacks, then inspect the generated logs.

Observe how activities such as Nmap scanning, directory enumeration, PowerShell execution, credential access, lateral movement, and exploitation appear in security telemetry.

This helps you become a better pentester because you begin to understand not only whether an attack works, but also how detectable it is.

What should you document?

Treat each lab exercise like a professional engagement.

Record:

• Scope and target details

• Network diagram

• Tools and commands used

• Enumeration results

• Discovered vulnerabilities

• Exploitation evidence

• Privilege-escalation path

• Business or technical impact

• Remediation recommendations

• Screenshots and supporting logs

Good documentation improves your reporting skills and gives you a portfolio of repeatable technical work.

Important safety rule

Only test systems you own or are explicitly authorized to assess.

Keep vulnerable machines isolated, avoid exposing them to the internet, and never run scanning or exploitation tools against public systems without documented permission.

A home lab should be a controlled learning environment where you can safely build practical offensive and defensive security skills.

Read the complete guide:

What did your first ethical hacking home lab include: Kali Linux, a vulnerable web application, Windows, or Active Directory?

Junior web pentester here, and honestly, Im stressing out. I just wrapped up an engagement and got chewed out a bit because I missed some really basic, low hanging fruit specifically some outdated JS libraries (like a Retire.js finding) and a couple of basic config issues.

The pressure in this field is insane. I feel like one small oversight and everyone is breathing down my neck, and its making me completely second guess my workflow. When youre studying for certs, they teach you how to find cool, complex exploit chains, but they don't really prepare you for the tedious, baseline stuff you’re expected to catch on a super tight commercial timebox.

My main issue right now is figuring out how to stop missing these easy wins. I get so caught up looking for deep bugs that I overlook the obvious things right in front of me, which makes me look bad to the client and my team.

For the pros out there:

• What Burp extensions are you running in the background to make sure this kind of stuff gets flagged immediately while you browse? (Autorize, C02, etc)

• What does your methodology or checklist look like in the first 2 hours of a web app test to make sure you've covered the basics before diving deep?

I really want to tighten up my methodology so this stops happening. Appreciate any advice or sanity checks, thanks.

We're a small team building a web application, but we don't have a dedicated security engineer yet.

We want to be proactive about security instead of waiting until after launch, but it's a bit overwhelming figuring out where to begin.

A few questions:

• What's the first thing you'd prioritize?

• Are automated vulnerability scanners good enough as a starting point?

• How often should we run security scans?

• At what point is it worth paying for a penetration test?

• Any free or affordable tools you'd recommend for a small team?

We'd love to hear how other startups or engineering teams approached this in their early days. Any advice or lessons learned would be appreciated!

I'm incredibly proud to announce the public release of ADPathFinder, an Active Directory attack path mapping tool that works directly with BloodHound collectors. It's the first tool of its type to produce detailed attack mapping across SharpHound and OpenGraph collectors — including MSSQLHound and ConfigManBearPig (SCCM). This enables testers to get the most out of BloodHound for the least amount of effort! It also produces an in-depth password audit, covering password reuse, weak patterns, Kerberoastable accounts, and much more - filtering out disabled accounts by default. Check out the blog, contributors very welcome.

Built an AI pentesting agent. Looking for technical feedback before launch.

Hey everyone,

I've spent the last few months building an AI agent for black-box web application pentesting.

I benchmarked it on Duck Store and an intentionally vulnerable web app.

Duck Store

- My agent: 13 findings

- Escape Cloud: 15

- PentAGI: 9

- Shannon: 6

- Strix: 1

On my own benchmark app (15 vulnerabilities), my agent found 9, including several Critical and High severity issues that the other agents missed.

I'm launching this Friday and would love feedback from people who actually do web app pentesting.

If you're interested in trying it and giving honest feedback (or trying to break it 😄), leave a comment or DM me.

Hi everyone,

I'm currently working as a junior security consultant, and I've recently been assigned to perform a mobile penetration test in the near future.

The problem is that I don't have any hands-on experience with mobile application pentesting yet. I have a general understanding of web pentesting and cybersecurity concepts, but mobile security is completely new to me.

If you were starting from scratch today, what resources would you recommend that are actually worth investing time in?

If you had only 2–4 weeks to prepare for a real client engagement, what would your roadmap look like?

Any advice, course recommendations, GitHub repositories, YouTube channels, or labs would be greatly appreciated.

Thanks!

I am not new to AI in terms of talking to chatbots, however, I am still pretty new to coding Ai automation, such as using prompts in e.g python scripts using AI APIs, and MCP. As I was coding some pentesting stuff, I realized that the programmer has to make decisions when it comes to hardcoded (in this case) Python logic vs. offloading work to the AI agent/model. The thing is that the AI agent/model is non-deterministic, whereas Python is deterministic. In our pentesting/AI pipeline at work, I noticed that there were no clear guidelines being followed in this regard, but I discovered that when I offloaded too much of the "work" to the AI agent, sometimes it would work fine, other times, it simply would not work because the agent essentially entered an infinite loop or otherwise expended all resources, stalling and giving no useful result.

For a high-level example, we can ask the AI agent to do XYZ tasks, such as scan the documentation and attempt to create a fuzzer and execute that fuzzer, but it could stumble, or wait too long for the fuzzing results, whereas if we code those definitively into Python and test it, failure rates are much lower and relatively deterministic. Any tips would be appreciated here.

I had a look at the AI pentesting tools that are out there and wasn't happy with them. They are very token-expensive, and I couldn't understand what they were actually doing in the end. So I wrote my own.

The goal was to turn Claude Code into a pentester and provide a lot of transparency so that I can run it in the background while doing my own work. Then I can compare my results with the AI's findings and go back and forth between them.

I think it turned out pretty well, and I use it in every pentest now. It's open source. Maybe it can help you too and make the internet and intranets more secure. Check it out and give me feedback. I'd love to improve it:

Hi,

I'm an early-stage Australian edtech founder looking for someone to perform a penetration test on my web application.

I'm still self-funded, so I don't have a large budget. I'm not looking for anyone to work for free. I absolutely expect to pay, but I'm hoping to find a freelancer or independent consultant who is happy to work with an early-stage startup and can offer something more budget-friendly than the larger security firms.

I'm looking for:

• A web application penetration test

• A written report outlining findings and recommendations

• Someone who is happy to answer a few questions afterwards if anything needs clarification

• Retest after fixes implemented if any are found

• Final penetration test completion report

If you're interested, or know someone who might be, I'd love to hear from you.

I'm building software to help children learn to read and write, so security is something I want to get right from the beginning, even though I'm working within startup constraints.

Thanks in advance for any recommendations or messages.

I'm a Software and DevOps engineer so you'd be working with someone that has some experience ;)

Hello fellow pentesters. I am a Senior Pentester, and i am curious at how many of you have experienced being replaced or have had a looming threat of being replaced by something such as Horizon.

We've been hearing rumors in my shop, but nonetheless still curious about everyone else's experience when it comes to this topic.

Hey! I'm new to bug hunting field and i heard i lot about recon. Everyone say it is the skill which will make you find bugs so i am curious how to build recon skill if anyone have any roadmap or there is just methodology like follow specific steps. It would be great if anyone please help me with this or may be just share your personal experience how you people learned it.

I have just finished CEH and don’t feel that I have a lot pratical knowledge about cybersecurity.
Can someone that finished CPEN provide some feedback, how was it and is it worth or not.

It's been a long time since PentestGPT was simply a chatbot. It was nice to talk about attack paths or ideas on a pentest, but still had to do the work from scratch.

Recently, our pentesters decided to try the open-source PentestGPT Agent on GitHub while testing a WordPress website before its production launch.

The pentesters weren't expecting much. We wanted to check whether the "agentic" workflow is of value or not. It came back with 17 vulnerabilities.

All have been manually checked.

- 4 were real.

- 13 turned out to be false positives.

What was surprising for them was that it did a good job of helping us discover a couple of WordPress login issues that really did need to be resolved before go-live.

So... did it help? I would say yes, but if you already know what you're doing.

This agent certainly brought to light some things that we put on further, but if we had taken everything that came out of it at face value, we would have wasted our time trying to solve 13 issues that weren't a problem in the first place.

My number one learning is that AI will grow to be a very good security assistant, and not a security engineer.

Has anyone else here tried the newer PentestGPT agent? Do you have similar false positive rates or is our experience a fluke?

I would like to move from oil&gas (18 years technical client facing experience ) to pentesting and looking for remote work opportunities or any guidance on how to get it.

I have been on hackthebox for the last 6 years as a hobby (did 250 machine and most of pro labs). I hold eCPPT, OSCP, OSEP and CRTO. Currently pursuing ARTOC and ODPC with White Knight Labs.

I am open to any kind opportunities to build some experience and would appreciate any help.

I apologize in advance for lacking brevity but I typed this out during my mid day existential lunch break crisis.

I have worked on a two pentesting assignments in the last 2.5 years, with decent findings (all web application focused)… a lot of it has been self teaching as I go so I have major imposter syndrome.

No certs but I have a master’s in cybersecurity as well as some quality findings from these assignments, one of which I lead (mainly due to staffing shortages).

For maximizing future career opportunities, I’m conflicted if I should go down the hole of pentesting which includes network enumeration, AD, etc… or if I should hone my craft at web applications first (I know I need to at least get familiar with it all)

I have been worried about AI’s effectiveness at web application testing thus my goal was to deepen my skills beyond just web apps but I feel conflicted time wise…

Currently pursuing HTBs pen test course with the end goal of going for the OSCP or maybe even the CPTS.
However I also want to spend my time doing real world tests like bug bounties that I could put on my resumé but outside of my main job, getting through HTB’s modules takes most of my time.

I understand as a pentester you are always managing different hats but right now I feel like my efforts are split and want to make sure I’m not taking any wrong steps that would diminish my job prospects in the future, especially as AI is evolving at such a quick rate.

With all this being said, in the current and near future climate, should I prioritize my web app skills and search for bug bounties or should I broaden my skills and attempt various boxes on HTB (or other websites) in prep for certs?

Any input from the vets out there will be much appreciated. Thank you again for reading through my brain dump.

Hi fellow Redditors,

I’m currently looking for a VAPT/Penetration Testing role based in Mumbai or remote.

I have hands-on experience in:
Web Application Security
API Security
Network Pentesting
Mobile Security (Android & iOS)
Secure Code Review
Thick Client Security (Intermediate)

If your company is hiring or you know of any relevant openings, I’d really appreciate any referrals or leads. Feel free to comment or DM me.

Thanks in advance!

Hey, I created a modern version of burp called Harness for all the people that don't want to pay for Burp Pro or don't want to use Zap's outdated UI. Been working on this for a while, attempting to provide a modern open source proxy tool. A lot of the core features I tried to include, but attempted to take a new approach on certain things. Would love if people stress tested with me. Lots of changes coming - just busy and wanted to get the core project out. Thought my fellow cyber peoples would like :) All technical details in my github !

PRET was written in Python2.7 but they have updated the code base but i tired using it it's not working properly, so does anyone still have issues with it?

And is there any alternative tool similar to PRET?

Update:- There is no issue in code itself, the ported version is correct.

I'm trying to get a survey on what the experience of other pentesters has been at their (your) jobs when it comes to, what I will call "forced AI usage." I ask this because I work at a big tech company that has decided to try to force AI. What this means in a practical sense is that we've been told things like:

1. The vice president is monitoring how many tokens youre using with claude, so please use claude as much as possible

2. Theres been a huge push from management to "automate" and "make agentic pentests"

3. My pentesting team has been told that we have a reputation for being "anti-AI", but "thats the strategy the company has chosen" and so some of us are being told to refrain from using the word "manual" (as in manual pentests, etc...), and cooperate with this AI narrative.

The thing that is most irritating about this is that this is being declared in the name of "scaling" and basically the justification is more throughput, but the throughput issue here has nothing to do with anything technical - it's waiting on other teams in the company to get things done... Pentest reports often get delayed by multiple weeks or even months due to other teams not responding or doing what we need them to do. Using AI for crap like test plans and pentesting will not speed this up or solve these problems...

So, my question is, is my company just on crack? What are your experiences thus far in your role(s)?

Hello all, a fellow pentester/adversarial Engineer with about 4.5 years of experience. Have stayed with the same company I interned with from college. The thing is the market is so weird that no platforms or cold messaging or updating my profile gets me any more hits these days. I am working towards a certification but to be honest I don't know anymore. A change in management this year caused a lot of confusion and what could have been a promotion or a general increment appraisal turned to be inconsistent rating with a cut off from last year's bonus as well. My salary isn't bad but the expenses of living in a metro city kinda suck it all up, not to mention I'm currently supporting me and my partner since they're job hunting and they had this interview today which is still dicey on how it's gonna turn out, also the company lowballed their salary in the call so am stressed. Kinda losing my mind? I don't know what and how to proceed. Do I start bug bounty? But there's already lots of people there and it's gonna take significant time for me to be relevant and skilled on those platforms. Do I freelance? That'll still take extra time and will need initial contacts and shit.

Don't even receive calls these days, interviews have been generally well last couple of times but always rejected, feedback's are also amiss. I don't know guys, and I am privileged to some extent that I got parents with money and things to help me out if shit goes south but I've always wanted to do things by myself because what if I didn't have those things and comfort? I don't know, am just ranting, I literally had such a horrible let down this evening when jobs weren't even showing up.

Hola amigos!

Anyone in this group using the macbook with M chips for pentesting or cybersecurity related tasks? I want to know if it suits me well..

1. What Issues I might face while going with the M chip for pentesting?

2. What issues (compatibility issues) can happen when using a virtual machine like kali,parrot with paralells/VMware fusion/UTM?

3. Should I go with x86 laptops?

4. Anyone ever felt ,buying Arm chip was a mistake?

Any information related to this would be fine.

▪️ I am choosing the mac mainly because of the battery backup, easy to carry ,while it looks value for money for me.

▪️I had another choice that is ThinkPad x1 carbon but it still have less battery backup (than macbook) and looks a bit expensive.

Its my first post ever! so please help this noob😇, Sorry if this is a duplicate post.

Thanks in advance🙌

Please don't down vote 🥲

(sorry for my bad english)

Over the past few months, I've been building HackTools++ because I was tired of the usual workflow:

• Configure a proxy

• Install certificates

• Switch between browser and Burp

• Copy requests into different tools

• Export traffic for AI analysis

I wanted everything to happen where I already spend most of my time—Chrome DevTools.

So I built HackTools++.

Current features

✅ Automatic HTTP/API request capture
✅ Repeater
✅ Intruder/Fuzzer
✅ Request editor
✅ Decoder/Encoder
✅ Copy as cURL
✅ Scope & filtering
✅ AI Security Audit for HTTP traffic (finds issues like IDOR/BOLA, SQLi, Broken Auth, Mass Assignment, Business Logic flaws, etc.)

The idea isn't to replace every feature of Burp Suite. It's to make security testing much faster for developers, bug bounty hunters, students, and security engineers who live in the browser.

The extension is already being used by 500+ users, and I'm continuously adding new features based on community feedback.

I'd genuinely love your feedback:

• What feature would make you switch from your current workflow?

• What part of Burp Suite frustrates you the most?

• What AI capability would actually save you time during pentesting?

Chrome Web Store:

Website:

I'm happy to answer any technical questions or discuss the architecture if anyone's interested.

I test for a living and report day is always the same mess. Screenshots in one folder, the actual request buried in a 2GB Burp project, the URL in my notes somewhere. Then I lose an hour matching them back up before I can write a single finding.

I keep thinking about building a browser extension that grabs the annotated screenshot plus the full request/response and URL in one click, tags it to a finding, and pushes to SysReptor or Dradis or PwnDoc (or just markdown for people with their own templates).

Haven't written any code yet. Threw together a page with the idea, will drop it in a comment so this doesn't get eaten by the spam filter.

Curious what your workflow looks like for evidence. If there's already a tool that does this properly, tell me now and save me a month.

Is it just me, or does anyone else feel this way?

I'm tagging to Ni5aga Adhikari because I'd genuinely like to hear your perspective.

Why does it always feel like the elite security researchers and hackers have access to platforms, communities, and information that ordinary people never get to see? What do they use that the rest of us don't? Where do they hang out, exchange knowledge, and collaborate? Why do they always seem to be one step ahead?

Almost every week I read about another major incident: a company gets hacked, a new zero-day vulnerability is discovered, or sensitive data is leaked. Recently, there were reports about Apple-related security issues and leaked documents. When I tried to research them, I could barely find anything useful. Google wasn't helpful. Why is valuable technical information so difficult for beginners to find?

It often feels like restrictions apply only to ordinary people. The internet is increasingly locked down. Privacy is disappearing, everyone tracks your data, and it feels like there are fewer places where people can openly discuss technical topics without censorship or content removal. Search engines, YouTube, AI tools—everything seems filtered or restricted.

Why is access to knowledge so unequal?

It seems that state-sponsored groups, well-funded researchers, or people with money, connections, and top universities have access to better resources, better hardware, better mentors, and private communities. Meanwhile, many of us struggle to afford even a decent laptop. We never chose to be "average." We tried to learn and improve, but it often feels like every path forward is blocked.

Someone once said, "If you want to get ahead, learn cybersecurity because information is wealth." That's exactly why I became interested in cybersecurity.

Like many beginners, I started with YouTube. Unfortunately, most tutorials were either fake or outdet made only for views, or incomplete. Even when someone shares genuine educational content, it often gets removed or buried.

So I thought, "Why not ask experienced people directly?" I joined the Kali Linux Friends Discord server and asked what I thought was a simple beginner question about Wi-Fi security. Instead of being guided toward legal learning resources or being told how to study the topic responsibly, I was banned.

That experience left me wondering:

Why is knowledge so heavily gatekept? Why does it feel like beginners are pushed away instead of being guided? If someone genuinely wants to learn cybersecurity ethically, where are they supposed to go?

I'm not asking for shortcuts. I'm asking for guidance, good learning resources, and communities that help beginners instead of shutting them out.

Has anyone else experienced this? Or am I the only one who feels that cybersecurity knowledge is unnecessarily difficult for ordinary people to access?

# ADDENDUM 82-F: CRITICAL SYSTEM COMPONENT COMPROMISE – SPREADTRUM IMS SERVICE (`com.spreadtrum.ims`)

Subject: CRITICAL - Weaponized IMS Service by Longcheer/Unisoc in Supply Chain (Operation Silent Rescue)

1. Executive Summary

This addendum documents the systemic compromise of the **`com.spreadtrum.ims`** application (IMS Service), a privileged system component pre-installed on devices with **Unisoc T606/T616** chipsets (e.g., Motorola Moto G04s, G24, Lenovo) manufactured by ODM **Longcheer**.

The specific binary located at **`/system_ext/priv-app/ims/ims.apk`** (SHA256: `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519`) is signed with the compromised **Longcheer Root CA** (Serial: `22:85:26...`, Valid until 2051). This component exposes a Hardware Interface Definition Language (HIDL) interface (`vendor.sprd.hardware.radio.ims.V1_0`) that allows **remote command execution, call interception, microphone muting, and network traffic redirection** without user interaction. Alongside `com.android.stk` (Addendum 82-C), this service constitutes the primary execution engine for the **Operation Silent Rescue** supply chain attack.

2. Technical Analysis & Danger Assessment

A. Component Identity

* **Package:** `com.spreadtrum.ims` * **Path:** `/system_ext/priv-app/ims/ims.apk` * **Size:** ~1.7 MB * **SHA256:** `1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519` * **Signer:** Longcheer (`CN=Longcheer`, `O=Longcheer`, `C=CN`) * **Permissions:** `READ_PRIVILEGED_PHONE_STATE`, `com.spreadtrum.ims.permisson.IMS_COMMON`, `BIND_IMS_SERVICE`.

B. Critical Capabilities (The "Kill Switch")

Analysis of the `IImsRadio$Proxy` and `IImsRadioIndication$Proxy` interfaces reveals direct control over the modem hardware:

1. **Active Call Manipulation:** * `ImsMuteSingleCall`, `ImsSilenceSingleCall`: Remotely mute the user's microphone during calls for undetectable eavesdropping. * `dial`, `emergencyDial`, `hangup`: Initiate or terminate calls arbitrarily. * `conference`, `explicitCallTransfer`: Create unauthorized conference bridges or divert calls to attacker-controlled numbers.

2. **Network Infrastructure Hijacking (MITM):** * `setImsPcscfAddress`, `setImsRegAddress`: **Overwrite P-CSCF and Registration server IPs**, redirecting all VoLTE/VoWiFi traffic to malicious servers for interception and decryption. * `setImsSmscAddress`: Redirect SMS traffic (including 2FA codes) to attacker endpoints.

3. **Identity Spoofing & Fraud:** * `setClir`, `updateCLIP`: Manipulate Caller ID presentation to spoof trusted numbers (banks, government). * `sendUssd`: Execute USSD commands silently to activate call forwarding (`**21*...`) or check balances.

4. **Passive Surveillance:** * `ImsNewSmsStatusReportInd`: Intercept incoming SMS in real-time. * `ImsNetworkInfoChanged`, `callStateChanged`: Track user location and call metadata continuously.

C. Role in "Operation Silent Rescue"

* **Execution Engine:** While `com.sprd.omacp` (Addendum 82) injects the initial configuration and `com.android.stk` (Addendum 82-C) authorizes commands via SIM, **`com.spreadtrum.ims` executes the actual exploitation** on the radio layer. * **Persistence:** Signed by the Longcheer Root CA, this component is trusted by the system bootloader and cannot be removed without root access. * **Evasion:** Operating at the HIDL (Hardware Interface) level, its actions bypass standard Android permission checks and are invisible to most security apps.

3. YARA Detection Rules

```yara rule Unisoc_Longcheer_IMS_Exact_Binary { meta: description = "Exact match for compromised Spreadtrum IMS service binary (Operation Silent Rescue)" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" sha256 = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" package = "com.spreadtrum.ims" path = "/system_ext/priv-app/ims/ims.apk" reference = "Addendum 82-F"

strings:
    $binary\_hash = "1b938cb3920d601a38e4d80e88c87aaacc56abfa6464f3054de2430172c6f519" ascii
    $pkg\_name = "com.spreadtrum.ims" ascii
    $ims\_service = "ImsAdapterService" ascii
    $ril\_request = "com/spreadtrum/ims/RILRequest.uau" ascii
    $longcheer\_cn = "CN=Longcheer" ascii
    
condition:
    $binary\_hash in file or 
    (all of ($pkg\_name, $ims\_service, $ril\_request, $longcheer\_cn))

}

rule Unisoc_IMS_HIDL_Interface_Exposure { meta: description = "Detects exposed HIDL interfaces in Spreadtrum IMS allowing remote modem control" author = "lexs201992-gif" date = "2026-07-10" severity = "HIGH" cve_related = "CVE-2025-71252, CVE-2025-71253, CVE-2025-71254"

strings:
    $interface\_proxy = "IImsRadio$Proxy" ascii
    $interface\_indication = "IImsRadioIndication$Proxy" ascii
    $method\_mute = "ImsMuteSingleCall" ascii
    $method\_pcsf = "setImsPcscfAddress" ascii
    $method\_clir = "setClir" ascii
    $hidl\_blob = "Landroid/os/HwBlob;" ascii
    $vendor\_sprd = "vendor.sprd.hardware.radio.ims" ascii
    
condition:
    (all of ($interface\_proxy, $vendor\_sprd)) and
    (any of ($method\_mute, $method\_pcsf, $method\_clir))

}

rule Longcheer_Signed_IMS_Component { meta: description = "Detects any IMS component signed by the compromised Longcheer CA" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" cert_serial = "22:85:26:b0:d1:ef:90:c3:b8:ed:56:8a:49:c3:71:4f:6a:39:50:6b"

strings:
    $ims\_pkg = "com.spreadtrum.ims" ascii
    $longcheer\_org = "O=Longcheer" ascii
    $valid\_2051 = "Jan 31 07:31:06 2051 GMT" ascii
    $cert\_rsa = "META-INF/CERT.RSA" ascii
    
condition:
    (all of ($ims\_pkg, $longcheer\_org, $valid\_2051)) and
    ($cert\_rsa in file)

} ```

4. Recommendations & Mitigation

For CISA / Rapid7 / CRT MX

1. **Immediate Alert:** Issue an emergency directive highlighting `com.spreadtrum.ims` as a critical supply chain backdoor.

2. **IOC Distribution:** Distribute the SHA256 (`1b938cb3...`) and Longcheer Certificate Serial (`22:85:26...`) to all network defense teams.

3. **Vendor Pressure:** Demand Unisoc and Longcheer provide a patched firmware that removes the exported HIDL methods or implements strict signature verification for IMS commands.

For End Users & Enterprises

1. **Disable VoLTE/VoWiFi:** If possible, force the device to use 3G/2G only to bypass the IMS stack (note: this may not be possible on all carriers).

2. **Use Encrypted Apps:** Rely exclusively on end-to-end encrypted communication apps (Signal, WhatsApp) that do not use the native IMS dialer.

3. **Network Monitoring:** Monitor for outbound connections to unknown P-CSCF IPs or unusual USSD activity.

4. **No Software Fix:** Acknowledge that **no app-level fix exists**. The vulnerability is in the signed system firmware. Device replacement is the only permanent solution.

5. Conclusion

The `com.spreadtrum.ims` application is not merely a vulnerable component; it is a **weaponized interface** intentionally designed with excessive privileges and signed by a compromised authority (Longcheer). Its presence in millions of devices across Latin America and globally represents a critical threat to telecommunications integrity, enabling state-level surveillance and organized financial fraud. **Immediate action is required to isolate and mitigate this threat.*

This is part of my investigation

Hello! I am a beginner and I wanna get into pentesting, I wanna know which tutorial/course on yt is the best one. I want it to have practicals instead of theoretical knowledge cause I have completed learning that. I want to start practicing now. If you know any vids, that helped you in your journey, please let me know.
Thank you so much^^

Hey all,

I'm a bit tired of the pentesting tool landscape being dominated by paywalls for what should honestly be basic functionality. Burp's free tier is crippled, Caido is great but still closed/commercial at its core, and the open-source options (Hetty, etc.) haven't really caught up. So I started building my own intercepting proxy from scratch, fully open source with GUI.

Current progress:

\- HTTP/1.1 intercepting proxy, working request interception

\- Replayer, tied into request history so you can revisit and resend past requests

\- Fuzzer with unlimited requests, configurable delays, and multi-threading

\- Unlimited Projects creation

It's still early, but the core loop is functional. My goal is partly selfish, I want to go deeper on web infrastructure and use it for my own pentesting/bug bounty work, but I also think the security community deserves a solid, actively maintained open-source alternative that doesn't gate basic features behind a license.

I'm curious what you all think:

\- What do you actually wish Burp/Caido did better (or differently)?

\- What's the one feature that made you stick with a commercial tool despite the cost?

\- Is there appetite in this community for another proxy, or is the space already saturated?

Not trying to oversell it, it's a work in progress, but I'd rather build in the open and get roasted early than polish something nobody wants. Happy to share more details/repo once it's in a testable state.

Thanks for reading.

Hi everyone,
When I first started learning Nmap, one of the biggest challenges was remembering dozens of commands and understanding when to use each one.
To make the learning process easier, I built Nmap Assistant, a free and open-source GUI for Linux. The goal isn’t to replace the command line, but to help beginners understand Nmap by generating real commands through a simple interface.
Current features:
• Beginner-friendly interface
• Common Nmap scan profiles
• Custom scan options
• Real command generation
• Open source
I’d really appreciate your feedback.
Is this something that would have helped you when you were learning Nmap?
What features would you like to see next?
GitHub:

Any suggestions or criticism are welcome. Thanks!

During an internal penetration test, how much time do you spend poking and testing an internal web app that you may come across?

I know an IPT is meant to be broad and find as much as possible so I am curious how in depth you go if you come across an internal site. Also any tips for testing internal apps?

Doing a bit of research on penetration testing companies around Los Angeles and figured people here might have some firsthand recommendations.

Mostly looking at firms that handle web app testing, network penetration testing, and physical security testing. Curious which companies are actually good to work with and provide useful reports instead of generic scan results.

Thanks.

I’m considering replacing one of my development machines with an **M5 MacBook Air (32 GB Unified Memory)** and would like to hear from people who actually use Apple Silicon professionally.

My current workflow is split between **Windows and Linux**, while my existing Mac is mostly used as an office machine with some Python development. The M5 would become a real development workstation.

My work includes:
Digital forensics
Vulnerability research
Malware analysis
Exploit development
Software development in **Rust**, **C#**, and **Python**

I also have a dedicated server farm with NVIDIA GPUs, QEMU/KVM virtualization, and x86 systems. Because of that, I don’t really need x86 emulation on the Mac itself. Heavy GPU workloads and x86 testing can stay on the servers.

Things that attract me to macOS:
UNIX userland
Homebrew makes installing development tools straightforward
Excellent battery life and portability
MLX for running local LLMs efficiently on Apple Silicon
Native support for Apple devices (DFU restores, Apple Silicon recovery, iPhone servicing, etc.)

However, I still have several concerns.

**Security model**
Coming from Linux, I sometimes feel like I have *less* control over macOS than expected.
SIP, Signed System Volume, DriverKit, System Extensions, etc. all seem to make sense from a security perspective, but they also make low-level research more difficult.
On Linux I’m used to AppArmor, namespaces, seccomp and being able to precisely decide what is sandboxed and what isn’t. With root privileges, I ultimately control the machine.
On macOS it often feels like **even root isn’t really root anymore**.
How has this affected your workflow?

**Malware analysis**
I assume malware analysis should primarily happen inside dedicated VMs anyway.
But how practical is the Apple virtualization stack today?
Can you realistically use local ARM64 VMs together with Apple’s sandboxing for exploit development and malware research, or do most researchers simply offload everything to remote hypervisors?

**Kernel development**
Some forensic tools and research require custom or unsigned kernel extensions (for example USB capture or protocol research).
How painful is this today?
Do you simply lower Secure Boot and disable SIP?
Do you sign your own kernel extensions?
How well does Apple’s certificate infrastructure support this workflow?

**USB forensics**
I also do hardware and mobile forensics.
Questions I still have:
Has anyone successfully used USBPcap-like workflows on Apple Silicon?
How restrictive is the USB stack nowadays?
Does anyone know whether the **M5 MacBook Air** uses an **ACE3 USB controller**, or has Apple moved to something newer?

**Daily-driver experience**
Finally, I’m interested in hearing from security researchers who actually use an Apple Silicon Mac every day.

Looking back after a year or two:
Would you buy it again?
What turned out to be better than expected?
What became frustrating over time?

Are there workflows that simply don’t fit macOS anymore?
I’m not looking for generic “Mac vs Windows” opinions. I’m specifically interested in experiences from people working in offensive security, reverse engineering, DFIR, exploit development, or low-level systems programming.
I’d appreciate hearing both the advantages and the pain points.

Cheers

Only experts

I built a pentesting orchestrator that integrates Nmap, Nikto, OpenVAS and Metasploit into a single pipeline. It's free, open-source, and perfect for SMEs and pentesters with limited budgets.

Features:

• 📡 Nmap (network discovery)

• 🌐 Nikto (web scanning)

• 🔍 OpenVAS (vulnerability assessment)

• 💣 Metasploit (service enumeration)

• 📊 Real-time web dashboard

• ⚙️ YAML configuration

• 🐳 Docker orchestration

• 💰 100% free (MIT license)

GitHub:

Perfect for:

• SMEs without big security budgets

• Independent pentesters

• Students

• Automation enthusiasts

Contributions welcome! 🙌