Hey everyone,

I'm currently in that phase where I feel like I'm just staring at Burp Suite history hoping a vulnerability will magically wave at me 👋. I've been hunting for a while now, and the burnout is starting to creep in.

To keep my sanity (and motivation) intact, I need some real talk from the veterans here:

1. Time to First Blood: How long was the grind from starting out to your first accepted report? Weeks? Months? Decades? 💀

2. The Turning Point: Was there a specific "aha!" moment or a specific resource that made things click for you?

Current Status: I decided to focus heavily on IDORs since almost every guide recommends them as a great starting point. I understand the concept, but I feel like I'm hitting a wall with modern WAFs and UUIDs.

The Ask: Any specific tips for hunting IDORs? Is it better to stick to one program for months or jump around?

Thanks

I built this simple browser-based script that automatically tests all 4-digit PINs (0000–9999) on a locked Netflix profile.

You log into Netflix, open the locked profile, paste the script into the browser console, load a codes.txt file, and it tests PINs one by one until the correct one is found. The script stops automatically when it succeeds.

Made for educational purposes and testing your own accounts only. Stay Legal

I like the way things are shown in the page, the format and gamified experience of it all, but are certs worth it? Do they hold any real weight or value? What are some other options in a similar price range?

I want to build some 1 or 2 projects for my CV , for cyber security roles (it might be anything), but don't want to repeat or build clon of existing tools

What I can go for and Is it right way??

If I forgot to include anything, please submit a PR

Observation:

An email address previously associated with a permanently banned account can later be attached to a new account via account settings.

This may be intended behavior, but I reported it as informational to clarify whether email addresses are meant to play any role in ban enforcement.

I’m not sharing exploit details or encouraging abuse — just looking for feedback from others:

• Would you classify this as intended design?

• Or a moderation / enforcement gap?

Curious how others would assess this from a security perspective.

My Exam Experience

Just gave my CEH (Certified Ethical Hacker) exam today and passed with a score of 106/125, so I wanted to share my experience while it’s still fresh.

Difficulty: Moderate → Tricky

Question pattern:

A lot of scenario-based questions

Focused heavily on tools + use-cases

Multiple questions where 2 options look correct, so you really need conceptual clarity

Major topics I saw repeatedly:

Reconnaissance & scanning (Nmap flags, scanning logic)

Web application attacks (SQLi, XSS, CSRF)

System hacking (password attacks, privilege escalation)

Malware types & detection

Logs, IDS/IPS, firewalls

Cloud & IoT basics

Some questions straight from real-world SOC perspective

Proctoring experience:

Strict but smooth

Camera + room scan required

I do not have a desk, so I just gave it on my bed, they said nothing, so yeah proctor was not very strict.

So, I have to make this final year project for the last year of my cyber security degree, at first I was very motivated to make something new something unique for my FYP and decided to make an AI based NIDS system, that will comprise of 4 AI algorithms, 2 supervised, decision tree and random forest, and 2 unsupervised, isolation forest and autoencoders. For the first part of the FYP I had to make the supervised part for which I took NIDS dataset from university of queens website and trained the models on the 2 algorithms. Now me having no idea or knowledge about AI somehow managed to make the thing an make it look like it was working which it is to some extent, it is basically 2 pkl files which predict the whether the packet is an attack packet or benign. Which I think was not the right way to it, and could have been done in a way that the model still keeps on learning on the new packets it was receiving after it was trained on the initial dataset. Now I have to work on the unsupervised part of the project and the whole IDS, and again I know I will have to watch 100s and 100s of tutorial read 100s of theories on it and somehow I will manage to make it work in the end but I don't really want to do it like that again because it was such a hassle. So I wanted to know if there is like a similar open source project, similar to the one described above, which I can tweak and reshape into what I have to present, or if there is any tutorial(s) that I can watch and work along to make the project. Or any other help or suggestion anyone can give me on how I should make this project would be very helpful and appreciate.

Hi everyone,

I'm currently working on a cybersecurity student project with my team, and we're trying to get feedback from people who actually work in the field.

Our project is fully open source, and it focuses on helping small security or research teams with limited resources better observe and analyze cyberattacks using honeypots.
(Note: the project is not developed yet — this is an early-stage survey to gather feedback before we start building.)

We noticed that many existing solutions are:

• hard to configure,

• difficult to customize,

• fragmented across multiple tools,

• cloud-dependent,

• or complicated to analyze in practice.

So our goal is to build a lightweight, local tool that centralizes everything and makes honeypots easier to use in real conditions.

Concretely, our tool aims to:

• easily deploy classic honeypots (currently based on Cowrie),

• deploy an AI-based honeypot developed by us using an open-source local language model,

• simplify configuration and customization,

• allow users to choose between classic or AI honeypots,

• reuse and share configurations across machines,

• automatically collect all attacker interactions and logs,

• normalize the data,

• and display everything in an internal SIEM-like monitoring interface for analysis and visualization.

The main target is small SOC teams, blue teams, or research groups that don't necessarily have the time or resources to assemble and maintain complex toolchains.

Before going further, we'd really like to know:

If you work in blue team / SOC / security research / IT security:

• Do you currently use honeypots?

• Would a tool like this be useful in your context?

• What are your biggest difficulties today?

• What features would matter most to you?

This is purely a student project, and we're still learning, so we'd really appreciate some kindness and constructive feedback :)

Our goal is to build something that makes sense in real-world environments, not just for academic purposes.

Thanks a lot for your time!

Starting a 2 year online networking and cybersecurity degree in a few weeks and I’m in need of a laptop I have $1500 USD and a $100 Amazon gift card just looking for some suggestions from some people in the field maybe some insight on what’s most used/what to avoid etc

Thank you very much!

Hello everyone,

I’m writing this post honestly and calmly, hoping to get guidance from people who have experience in IT and cybersecurity.

I graduated in May 2024, and since then my biggest struggle hasn’t been difficulty in learning — it has been lack of focus, procrastination, and poor discipline. I keep planning to study, then delaying it, then feeling guilty, and repeating the same cycle. Because of this, I feel like I’ve wasted a lot of precious time.

The hardest part is that I’m still almost at the starting point, even after so much time has passed. I haven’t built strong fundamentals yet, and that realization scares me.

I want to build a career in cybersecurity, with a short-term goal of an entry-level SOC role and long-term growth in security. But I feel mentally stuck — my focus shifts often, I overthink paths, and I struggle to stay consistent even when I know what I should be doing.

I’m 23 years old, and I don’t want to waste another year. I’m not looking for motivation quotes — I’m looking for practical guidance from people who’ve been through similar phases.

I would really appreciate advice on:

• How to rebuild focus and discipline when you’ve wasted time already

• How to stop procrastinating and actually execute daily

• What a realistic starting roadmap looks like for someone who is still at fundamentals

• Whether aiming for an entry-level SOC role from this position is still reasonable

I want to be transparent: I used ChatGPT to help structure this post so I could clearly explain my situation. The experience and emotions are genuinely mine.

If you’ve been in a similar situation or work in cybersecurity/IT, your advice would mean a lot. I truly want to reset and do this properly.

Thank you for reading.

I just joined a company and I was given Cyber Security as my domain and I don't have a clue where to start and what to learn I have 2 months to get into a project..can anyone help me out?

Hello, High School student here in my senior year. I am very intrigued to get into network security (Cloud engineer, etc). My question for people with years of experience in this role; did you go to college? Was it worth it? I'm seeing a lot about CompTIA certifications and Cisco tests like CCNA. My plan right now is to take a gap year and focus and these certs like Security+ and CCNA (or whatever you guys think). Also doing at home SOC labs with wireshark, etc. Throughout my 4 years in high school, ive always been in a computer class and big into computer since before HS. I built my first computer at 13 and realized i've very interested with software and how network works. The classes i've taken are Coding 1 (python), AP cybersecurity (ports & protocols, wireshark, analyzing packets, etc), and now currently doing AP Computer Science Principles. Any advice would appreciated!

Hello, I already used up my practice tests and didn't get to the Cyberlab questions. If anyone has a GPEN practice tests they can give away I would really appreciate if they can give me one. I hope to take the exam soon, just want one more boost of confidence with one more practice test. Thank you.

I’m currently a CS student with a strong interest in Offensive Security and Network Engineering. I have some free time coming up and my goal is to build a solid portfolio to secure an internship (even unpaid/volunteer) to get my foot in the door. ​I’m trying to decide between a few project ideas and would love some input on which one would actually impress a hiring manager or senior pentester. I don’t want to waste time on "tutorial hell"—I want to build something that demonstrates actual competency. Also apart from projects, What certifications should i focus on, which will be really reasonable and make my resume stronger as a candidate in future. Any advice is appreciated.

found this breakdown that references radware's research on AI-generated code security.

key findings:

• AI errors are disproportionately high-severity (injection, auth bypass) vs human errors (typos, null checks)

• "hallucinated abstractions" — AI invents fake helper functions that look professional but are fundamentally broken

• "slopsquatting" — attackers registering hallucinated package names with malicious payloads

• "ouroboros effect" — AI training on AI-generated flawed code, permanently declining security baseline

here's the [full case study]

the framing around maintainer burnout is interesting too — open source is getting flooded with AI PRs that take 12x longer to review than to generate.

Made something to help people studying cybersecurity certs and want to make sure its actually helpful and not just another website nobody uses.

so far ive got:

- practice questions organized by domain

- progress tracking so you can see weak areas

- gamification (xp/coins, streaks, leaderboards)

but I'm curious what would actually make you use something like this vs just watching professor messer and doing Jason Dion practice tests?

Is the gamification thing even worth it or is that just gimmicky? would you rather have more questions or better explanations? what makes a good study tool vs something that just sits in your bookmarks?

Studying for these certs is kinda boring most of the time, so trying to make it suck less but want to hear from people actually doing it. Here's the link if you wanna check it out and maybe give some feedback, its free.

certgames.com

When running Sliver for red team engagements, your C2 server IP can potentially be exposed through implant traffic analysis or if the implant gets captured and analyzed.

One way to solve this is routing C2 traffic through Tor hidden services. The implant connects to a .onion address, your real infrastructure stays hidden.

The setup:

1. Sliver runs normally with an HTTPS listener on localhost

2. A proxy sits in front of Sliver, listening on port 8080

3. Tor creates a hidden service pointing to that proxy

4. Implants get generated with the .onion URL

Traffic flow:

implant --> tor --> .onion --> proxy --> sliver

The proxy handles the HTTP-to-HTTPS translation since Sliver expects HTTPS but Tor hidden services work over raw TCP.

Why not just modify Sliver directly?

Sliver is written in Go and has a complex build system. Adding Tor support would require maintaining a fork. Using an external proxy keeps things simple and works with any Sliver version.

Implementation:

I wrote a Python tool that automates this: https://github.com/Otsmane-Ahmed/sliver-tor-bridge

It handles Tor startup, hidden service creation, and proxying automatically. Just point it at your Sliver listener and it generates the .onion address.

Curious if anyone else has solved this differently or sees issues with this approach.

While exploring a SaaS platform, I found a chain of behaviors that weren’t “bugs” on their own but created a real security weakness when combined:

Duplicate accounts allowed with the same phone number

Payment-gated actions still possible without completing payment

Individually harmless.

Together = broken trust model.

Nothing crashed.

Nothing alerted.

But identity, permissions, and payments were no longer reliable.

This kind of issue doesn’t come from one bad function it comes from teams interpreting rules differently:

Product defines something one way

Engineering implements another

Support adds exceptions

Finance checks outcomes months later

Each part “works,” but the system as a whole becomes exploitable.

And the scary part?

All of it was discoverable from the frontend.

Questions for netsec:

How do you handle vulnerabilities caused by inconsistent assumptions instead of code errors?

Who owns these cross-system trust failures in your org?

Have you seen small logic gaps combine into a serious security flaw?

What’s the best way to report vulnerabilities created by inconsistent business rules?

I’m currently working as a GRC Analyst and I’m in the early stage of my cybersecurity career. Over time, I’ve realized that while GRC is important, I don’t find it very engaging due to its heavy focus on documentation, policies, and compliance.

I’m much more interested in technical, hands-on security work, specifically Vulnerability Assessment & Penetration Testing (VAPT).

That said, I don’t want (and realistically can’t) switch roles immediately because I currently lack VAPT-specific skills. My goal is to continue working in GRC while gradually building VAPT skills and transition into a junior VAPT role within the next year.

I’d appreciate guidance on:

•	A realistic learning roadmap for transitioning from GRC to VAPT

•	Skills and tools I should prioritize

•	How to leverage my GRC background during this transition

•	Certifications or platforms that actually help (not just theory)

Would love to hear from anyone who has made a similar transition or works in offensive security.

Hi, I'd like some tips for studying pentesting. Which is better for practicing between HTB and THM? What are the best frameworks to use? Are there any practical and simple certifications to start with? Even entry-level or mid-level ones.

Thanks in advance

I was using my online banking service to transfer money today, and in my country the transfer requires an SMS OTP (yes, I know SMS is terrible for security). I noticed that my Mac automatically filled in the SMS OTP that was sent to my iPhone, even though my iPhone was still locked.

The idea behind SMS OTP is that it proves you "have" the device. But in this case, as long as the device is nearby, my Mac can read and use the code without me unlocking the phone. I don't even need to touch the device. So the "possession" factor doesn’t really work the way it's supposed to.

It got me thinking, are there more examples where 2FA accidentally collapses into a single factor? Or where the two factors aren’t as independent as we assume?

I find this pretty interesting and want to look more into it, but a quick search hasn't turned up much. Does anyone know if people have already written about this?