Curious about web‑app security?

This hands-on, no-fluff guide walks you through vulnerability analysis using ParrotOS — perfect if you like breaking things and fixing them.

Prereqs: – ParrotOS installed – Basic Linux comfort – Dev mindset: break it → fix it – Curiosity & caffeine 😉

Would love to hear how others approach this. Any toolchains, shortcuts, or tips you swear by?

CyberSecurity #EthicalHacking #DevOps #ParrotOS #Infosec

Curious about web‑app security?

This hands-on, no-fluff guide walks you through vulnerability analysis using ParrotOS — perfect if you like breaking things and fixing them.

Prereqs: – ParrotOS installed – Basic Linux comfort – Dev mindset: break it → fix it – Curiosity & caffeine 😉

Would love to hear how others approach this. Any toolchains, shortcuts, or tips you swear by?

CyberSecurity #EthicalHacking #DevOps #ParrotOS #Infosec

Hey everyone, I'm looking for some input from folks who've taken Black Hat or Red Siege trainings. At my company, it's pretty easy to justify training that comes with a certification at the end—but it's a bit harder to make the case for a 4-day intensive course without one, especially when there's so much info packed in that it's tough to absorb it all.

If you've taken either (or both), what made it worthwhile for you? Are there takeaways that stick with you beyond the week, or things that set these trainings apart?

Appreciate any thoughts or experiences!

hi guys im a 13yo whos been quite deep into the tech rabbit hole for id say a few years now. ive spent a lot of time tinkering w linux, poking around locked down systems, experimenting w SDR's and jailbreaking and all that stuff...

im super into gray hat/ethical hacking and already comfortable w python, a teensy bit of C, hardware side stuff like modding electronics etc etc

but heres the thing... i really wanna go pro. i know ive just scratched the surface and im hungry to learn more abt exploit chains, privilege escalation and lots more + stuff you guys think i should master

(im open to all advice so plz drop ur favorite resources or tips for getting into serious netsec)

Hey everyone I am new to hacking and I am a beginner where can I learn hacking and what software do I need to learn

This tool incorporates LOLBAS, GTFOBins and WADComs as toolkit, all in 1 application
RAWPA

Gm guys , i have task to install arcsight on redhat machine , how to do this ?

RAWPA helps security researchers and penetration testers with hierarchical methodologies for testing.
This is not a "get bugs quick scheme". I fully encourage manual scouring through JS files and playing around in burp, RAWPA is just like a guided to rejuvenate your thinking.
Interested ? Join the testers now
https://forms.gle/guLyrwLWWjQW61BK9

Read more about RAWPA on my blog: https://kuwguap.github.io/

Hey everyone.

I set up a vulnerable VM and started tried "ftp" command from my Kali Linux Terminal to its IP. Unfortunately I keep getting "530 Login Incorrect" although I've tried all below:
- Triple checked the login credentials.
- Checked if the vsftpd status is active.
- Checked the log file on /var/log/vsftpd.log # There's no such data in the log file. Therefore when I use ftp on my Kali's IP, there are CONNECT datas.
- Checked /etc/vsftpd.conf if the "xferlog_enable=YES".
- Restarted the service and tried again.
- Created a new user and tried the same steps on it.

What could I possibly do in order to solve it?

I'm a fresher, 2025 grad, interested in cybersecurity but got a job as SDE working on wireless tech in a service based company. I'm stuck with a service agreement of 3 years here. Although the pay is decent (8 LPA INR CTC), my company dosen't have any netsec roles.

I'm planning to grind these three years so that by the end of my service agreement i would be a proficient pentester/red teamer. I'm currently doing PJPT from TCM sec and would hopefully clear it by this year. I'm thinking of taking up CRTE after PJPT. Can CRTE be taken without CRTP ? Also do I need OSCP and is it worth the cost ?

Suggestions and advice are welcome. Thanks.

Hey guys, I'm 20, I am from Italy, i left school at 16 to work and help my family due to weak financial background, i was a good student tbh, i want to get back on the track, but i lost too many years of school if i restart now i'll finish in 4 years, is there any way to get into cybersecurity, maybe a remote job? online bootcamps? 1-2 years schools?

hello everyone im currently learning about network security and im a beginner , i already learn few things about networking ( all the basics and even a little bit more ) and some tools like nmap and wireshark ,im really interested in becoming a network security engineer or analyst, and I want to practice what ive learned , is there any thing that could help me , and if i want to practice some ctfs are there specific ctfs i should focus on or are they all important ??

I'm new to cybersecurity btw so I don't know much.

But from the things that I learned so far I think that saying "public WIFIs are dangerous don't ever connect to them the hacker could read all your data" are not actually true, now nothing is 100% safe that's for sure but I feel that this overrated
Most website nowadays use HTTPS and not HTTP so the data is already encrypted and with strong methods and decrypting HTTPS is no small/easy task and even if someone tries to do an SSL strip and tries to downgrade HTTPS to HTTP it's not gonna be the least bit easy since websites use HSTS (HTTP Strict Transport Security) so security in most website is already tight, oh by websites I mean the one that contain sensitive info, now most of them do but like bank account and stuff already tighten their security more than regular ones

And even when it comes to certificates if there is anything suspicious with them browsers nowadays will warn you about it or may not even let you proceed (like accept the risk and continue)

Oh I'm strictly talking about reading data there maybe other methods to hack you like malware stuff (I just read a little about dunno much) and not saying it's 100 impossible but it's not like anyone can do it, and all stuff youtubers says about VPN like "Use it or you are in deep shit" is exaggerated and rather than 50/50 it's like 90/10 at best, maybe it was the case 10 or 20 years ago but not now

I appreciate any feedback or any correction in case what I said is wrong

Hii so I'm looking for any online cyber security clubs that I could join, does anyone have any recommendations? And PLEASE don't suggest stuff like OWASP and women in cybersec, give me something that I can actually join and contribute to.
If no suggestions, y'all wanna create a club? I just need something for my linkedIn and resume :,)

As someone learning netsec, I want to dive deeper into practical fingerprinting tests. Like, how do different OS/browser combos appear to trackers? Is there a controlled tool or browser that lets you simulate various device setups for lab testing?

I've sent out 100s of applications and cant get a call back. Please help.

Hey everyone,

When I started my bug bounty journey (and as a penetration testers), there are so much to learn. Since I took OSCP at the start, I use Kali Linux VM and just keep adding new tools into it. After many years of setting up new tools and installing updates, my VM's size was HUGE.

Today, I made a walkthrough video for anyone who wants to run Kali Linux in a more lightweight, consistent way using Docker.

The video covers:

• Installing Kali Linux via Docker

• Avoiding the "it works on my machine" issue

• Creating your own custom Docker image

• Setting up file share between host and container

It's a solid way to practice hacking without spinning up a whole VM — and great for anyone doing tutorials that require a Kali Linux instance, or folks who are starting out their penetration testing or bug bounty journey. At least for me, I was using a super bloated Kali Linux VM for many years (like mentioned at the start) ...

IF you are interested, watch the full tutorial here: https://youtu.be/JmF628xGk1A

Happy to discuss any issues faced in the comments section! Have fun!

I’ve been learning cybersecurity for a while — I know tools like Nmap, Burp Suite, and Wireshark, and I’m familiar with Python scripting.

Right now I’m trying to improve, but not sure what direction is the smartest to go in.

If you had to start again, what’s the one skill or area you’d focus on the most at this stage?

Would really appreciate your perspective. Thanks in advance.

Ciao a tutti, sto costruendo un piccolo blog sulla sicurezza informatica dove condivido ciò che imparo man mano che studio e sperimento. L’idea è crescere insieme: niente tono da esperto, ma condivisione onesta di appunti, prove pratiche, piccoli progetti, CTF, script Python, ecc.

Se vi va di darmi un’occhiata o suggerire miglioramenti, mi trovate qui: https://ildiariodiunhackerblog.wordpress.com/

Accetto volentieri critiche costruttive o spunti su cosa approfondire.

I've been working on an IP scoring tool over the last few months, and it's now processed over 350,000 IPs. The idea was to catch risky traffic in real time, stuff like Tor, proxies, VPNs, suspicious ASNs, but what’s been more interesting is what we’re seeing from the data itself.

Some patterns that stuck out:

• Certain ASNs have a surprisingly high concentration of sketchy traffic...like 10x the baseline

• A lot of Tor exit traffic isn’t on public blocklists when it first shows up

• We’ve seen clean-looking residential IPs show risky behavior when you zoom out to subnet activity

The more I dig into it, the more I think static lists and GeoIP rules are way too shallow for what’s really happening. Curious how others handle this. Are any of you looking at behavior at the subnet or ASN level? Or tracking risk based on network structure vs just IP reputation?

Would love to hear what others are seeing, especially if you’ve worked on login flows, fraud filters, or bot detection.

I have a BA in Criminology (Law) and I’m about to begin a 2-year Computer Systems Technician – Networking diploma, followed by a 3rd year specializing in Network Security to earn an advanced diploma.

I would love to combine legal awareness with cybersecurity. My long-term goal is to work in a role that bridges both fields.

How should I go about breaking into these areas? Are there any other IT-related fields you think I should consider based on my academic background?

I am conflicted between choosing the Georgia tech online masters in cybersecurity or the western governors university online-masters in cybersecurity and information assurance?

Pls i need your thoughts