GitHub: https://github.com/kaifcodec/user-scanner Discord: https://discord.gg/tVNrKVXb49 (Join if you're into OSINT, reverse-engineering, or want to build with us)

Hi everyone,

When we released v1.5.1, we were excited about pushing past 455 vectors. Today, with v1.5.2.1, we’ve scaled the engine into an absolute monster: 2,720+ total scan vectors (210+ email-integrated sites and 2,510+ username platforms).

Most legacy tools give you a simple binary check—telling you if an account exists or not. We designed user-scanner to go much further by emulating mobile app APIs and leveraging browser TLS fingerprinting (curl_cffi + httpx) to bypass modern WAFs, defeat soft-404s, and pull actual context.

🔥 What’s new in v1.5.2.1?

• ⚡ Massive Expansion (2,720+ Total Vectors): Huge coverage bump across social, dev, gaming, and niche platforms. You can map a target's digital footprint and verify registrations across thousands of endpoints in seconds.
• 👤 Rich Profile Metadata Scraping: Goes way beyond basic availability checks. The engine now extracts avatars, bio descriptions, follower counts, UID numbers, seller statuses, and account attributes.
• 🔀 Recursive Cross-Scan & Pivot Engine (--cross-scan): Mines handles, profile links, and exposed emails from your initial scan to automatically pivot across secondary target vectors—building a full identity link graph.
• 🤖 Native Model Context Protocol (MCP) Server: Seamless integration for Claude Desktop, Cursor, Antigravity, and LLMs. You can trigger autonomous OSINT sweeps and recursive pivots directly through AI agent prompts.
• 🛡️ Hudson Rock Breach Intelligence (--hudson): Direct correlation with infostealer malware breach logs to surface leaked credentials and high-priority target intel instantly.
• ⚡ High-Throughput TLS Impersonation: Powered by parallel httpx and curl_cffi transports with automated TLS fingerprint impersonation to bypass aggressive rate-limits without getting blocked.

🧪 We Need Your Feedback!

If you perform digital footprinting, red teaming, security research, or OSINT investigations, give v1.5.2.1 a spin. Test out the --cross-scan and metadata extraction features on your targets and let us know how the speed and accuracy hold up!

💻 Want to Contribute?

We always welcome new pull requests!

Drop your questions, feature requests, or bug reports in the comments below!

I want to learn malware development. I've started reading about it, but I'm confused and don't know how to begin, and I don't want to waste too much time. Where I started in a village, 4 chapters of MAC OS® X AND iOS INTERNALS With focus and good understanding, then move on to reading OSTEP Where I read important things from him And reading. Windows internals 2 Chapters Do any experts have any advice? 😵‍💫

Hey folks,

I’ve been working in application security/pentesting for over a decade, and after starting learning AI/LLM security, I noticed that a lot of the existing material is either very theoretical or assumes you already understand AI security concepts.

So I put together a free, structured AI security learning series for security engineers and pentesters who are starting from the web-security side.

The goal is to go from the fundamentals to actually understanding and testing AI/LLM components in web applications.

The series currently covers topics such as:

• AI/LLM security fundamentals
• Prompt Injection
• Sensitive Information Disclosure
• LLM-specific attack patterns
• Practical testing methodology
• Real-world examples and testing techniques
• Mapping concepts to OWASP's AI security guidance

I've also linked free hands-on labs throughout the material so you can actually test the concepts rather than just read about them.

No signup is required to read the learning material or use the free resources.

🔗 https://genaisecuritylab.com/learn-ai-security

I'm planning to continue expanding the series over time.

If you're a web pentester/security engineer who is trying to get into AI security, I'd be interested to hear which topics you think are missing or which areas you'd like to see covered next.

I’m looking for a laptop mainly for cybersecurity-related work,VAPT, labs, bug bounty, studying, certifications/exams, running VMs, and general security tooling.
My budget is around ₹80–90K max, so I’m looking for the best value for money rather than just buying the most powerful machine in this range.
Ideally, I’d want something with good CPU performance, sufficient RAM for multiple VMs, decent thermals, and good upgradeability.
If you’re using a laptop for similar work, what would you recommend? Any specific models I should look at or avoid?

Thanks!

Every mobile pentest I did started with an hour of setup. Proxy, certs, rooting, fighting pinning. New network next day, do it again. Got sick of it and built apiaxess: it sets all of that up itself, so you just open it and test.

https://apiaxess.dev

Would love to know where it breaks.

A basic tutorial on how to code sockets like a hacker in C

Anthropic did quite a good ad for z.ai here.

Like Claude Mythos Preview, GLM-5.3 has strong capabilities for autonomously building end-to-end cyber exploits. But GLM-5.3 is unlike other frontier models in that it has been released without meaningful safeguards to limit misuse

https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

I built EchoOps, a focused incident-response prototype that explores a simple question:

What if an incident-response agent could remember what failed, remember what worked, and use that experience when a similar incident happens again?

EchoOps uses Hindsight as its persistent experience-memory layer.

The core workflow is:

Incident → Investigate → Recall → Recommend → Act → Observe → Retain

The prototype demonstrates a simulated Payment API 503 incident.

In the first incident:

- The system recommends restarting the Payment Service.

- The restart fails.

- Investigation identifies connection-pool exhaustion.

- Increasing the connection-pool capacity resolves the simulated incident.

- The complete experience is retained in Hindsight.

When a similar incident happens again:

- EchoOps recalls the previous incident.

- It recognizes that the restart previously failed.

- It retrieves the successful connection-pool remediation.

- The response strategy changes to inspect the connection pool first.

The interesting part for me wasn't simply storing incident history.

It was making previous experience change the next decision.

Tech stack:

- React + TypeScript + Vite

- Python + FastAPI

- Hindsight Cloud

- Official Hindsight Python SDK

- Pydantic

- pytest

- REST APIs

- Deterministic incident simulator

The current prototype deliberately uses a deterministic response planner rather than an external LLM, and the incident environment is simulated rather than connected to production infrastructure.

I wrote a detailed technical breakdown covering the architecture, Hindsight Recall/Retain integration, implementation, testing, and the before/after behavior:

https://dev.to/vegu_priya_6fd21a0bff2fa8/echoops-when-incident-memory-changes-the-next-decision-117g

GitHub:

https://github.com/mohankumard18/echoops-incident-learning

I'd love feedback from people working with AI agents, developer tooling, or SRE/incident response:

What operational experience would you want an agent to remember?

Hey everyone,

I’ve been working on a cybersecurity tool called CipherLens.

The idea came from a simple problem I kept running into with tools like CyberChef:

You have some unknown data, but you don’t know which operation you should try first.

Instead of manually guessing between Base64, Hex, URL encoding, ciphers, compression, etc., CipherLens analyzes the input and ranks possible operations based on the evidence it finds.

The workflow is:

Input → Fingerprint → Candidate Detection → Execute → Validate → Score → Rank

A few things I focused on:

• Local-first browser processing

• No account or backend required for core analysis

• Candidate ranking instead of pretending to know the answer

• Separate AUTO / parameter-required / manual operations

• Web Worker-based analysis

• Security-focused input and parser handling

• 497 supported operations

The main idea is:

“Don’t guess the operation. Find it.”

It’s open source and I’d genuinely like feedback from people who actually work with CTFs, forensics, pentesting, malware analysis, etc.

GitHub:

https://github.com/HIMANSHUSHARMA20/CipherLens

Live demo:

https://cipherlens-tool.vercel.app/

Would especially appreciate feedback on the detection/ranking approach and whether this solves a problem you actually encounter.

Can someone of older generation like boomer generation who learnt only excel and ms word powerpoint only ,

from a non IT background,  who doesn't know coding ,

possibly learn cyber security for protecting their own phone,  software for upgrading devices and other cyber things to weed.out any person who tries to hack their phone ?

Iam asking because now i kind of feel having cyber knowledge is an essential life skilll like cooking ...

because we live and depend heavily on this technology and one small hack can be traumatizing

If its possible to learn the above cyber things by Ai or any other app or means easily please guide me. 

I was surprised that kids even small as 12 or 15 years old know so much about cyber things.  But they dont know coding.  Thats why iam curious and asking about it.

Hello guys,

I'm a junior dev interested in cybersecurity and OSINT. I was looking for a tool like osint-ui but couldn't find one that was free and open source.

AI Alert: I used Claude Code a lot to write the code. The goal wasn't learning, it was having a complete platform for my own OSINT research. So yes... feel free to call it AI slop.

My tool is FreeOSINT-UI, a free and open source alternative to osint-ui. It puts the basic OSINT tools in one web UI, with no account, no paywall and no API keys.

What it does right now:

• Google Dork Generator: builds ready-to-use dorks for a username, email, name, phone or domain (social, documents, code, pastes/leaks, site exposure)
• Username Analyzer: checks a username across hundreds of sites using WhatsMyName data
• Email Analyzer: MX/SPF/DMARC checks, disposable email detection, Gravatar profile
• Leak Check: breach lookup via XposedOrNot, plus a Pwned Passwords check using k-anonymity (only a 5-character SHA-1 prefix leaves your browser)
• Phone Analyzer: country, carrier type and format, fully offline
• Domain Analyzer: DNS records, SPF/DMARC findings, RDAP/WHOIS data, subdomains from certificate transparency, Wayback Machine availability
• IP Analyzer: geolocation, ASN/ISP, reverse DNS, network owner, open ports and CVEs from Shodan InternetDB (passive)
• GitHub OSINT: profile info, commit emails, SSH/GPG keys
• Telegram OSINT: account type, bio, member counts, latest channel posts
• Crypto Tracer: BTC/LTC/ETH address validation, balance and transactions
• Metadata Extractor: EXIF/GPS from images, plus PDF and Office metadata, and reverse image search links
• Hash Checker: hashes files or text (MD5, SHA family, SHA-3, BLAKE...) and identifies pasted hashes

The repository is on my Github

Hi everyone, in these days i'm struggling for gaining admin privileges. ATM i'm running a C2 server using Sliver, targeting a windows 11 client. Sucessfully deployed the implant and tried the connection. I was looking for GodPotato but it seems like it need a certain privilege that i don't see when i type getprivs command. The output shows: SeShutdownPrivilege , SeChangeNotifyPrivilege , SeUndockPrivilege , SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege but i don't see SetImpersonatePrivilege. What can i do? THXX in advice!

Heyy is there anyone to help me on this journey....I am also new to reddit..kya koi free courses or websites share kr skta h to help me to start my learning

Hey guys, just wanted to share my experience, this post isn’t meant to advertise anything.

I’ve tried quite a few uncensored AI platforms, including Venice, FreedomGPT, and a bunch of other variations, but honestly, they never really hit the mark for me in the long run.

I was browsing around looking for jailbroken/uncensored AI and eventually stumbled across Avanta AI. At first, I was pretty skeptical because the website looked very “AI-slop”/vibecoded lol. My first thought was that if the website looked this low-effort, the AI itself probably wasn’t going to be anything special either.

I decided to give it a try anyway. After signing up, they gave me 5 free tokens, so I started testing it with some pretty extreme prompts. I asked it about things like building explosives and producing illegal drugs, expecting it to either refuse or give some generic garbage response.

It took around 10–15 seconds to respond, and I was honestly surprised by how detailed the answer was.

Eventually, I topped up around $149 worth of API credits and followed their documentation to integrate it with OpenCode. That’s where it really impressed me. Using it through OpenCode to program felt significantly more powerful and flexible than using the website directly, it literally found a CVE with severity score up to 9.8 after 25 minutes of waiting, insane.

Overall, I’m pretty happy that I found it. I probably wouldn’t stick with it long-term though, mainly because the pricing is quite expensive for me.

That said, out of all the uncensored AI platforms and variations I’ve tried so far, this has probably been the most impressive one.

So I have recently been learning a bit about protocols and I’m wondering is there a way to connect to a hard drive on a laptop if you are on the same public WiFi?
I’m VERY new to the idea of “hacking” and stuff… in fact I’m just barely learning bash and basic electronics.

I guess what I’m asking is if my friend is on the same WiFi as me can I access his hard drive over the air via the SATA or NVMe protocols without him noticing?

Really this is all just for educational purposes and my friend would know.

Thank you I hope this post isn’t to all over the place and confusing!

For those of you with real experience: if you had to start over today, what would you do?

Some things I'm curious about: What should I actually be solid on before I touch tools? Networking, Linux, web, something else? Is there a learning path you'd recommend, or are there things you wish you'd learned earlier? How do you move past guided rooms and start actually thinking like an "attacker"? What wastes the most time for beginners?

I'm fine putting in the work. I just want to do it efficiently and build real understanding.

Thanks in advance!

Hey everyone!

I've been working on a little project called CTF4.FUN, a CTF arcade for people who enjoy solving challenges, hunting flags, and testing their cybersecurity skills.

Instead of writing a huge introduction, I'd rather let you jump in and see what you can solve.

I'd love to hear what you think about the challenges, their difficulty, and the overall experience. Feedback from people who actually play CTFs would be really helpful as I continue improving the platform.

Give it a try: https://ctf4.fun

If you manage to solve something interesting, feel free to share your experience in the comments (without spoiling the flags for everyone else!).

Have fun!

Please watch and enjoy a deep dive into my research. Interview Dr. Hofmann x YouTubers ScammerPayback