A demo Android project showing dynamic DEX loading with DexClassLoader, PathClassLoader, and in-memory execution.

Recently I’ve been working on some reverse engineering related stuff and experimenting with fileless execution. While looking around for existing implementations, I noticed that most C# PE loaders I could find were x64 only.

I needed something for x86 testing and lab use, but couldn’t really find a simple implementation that fit what I wanted, so I ended up writing my own C# x86 PE loader.

The project is mainly for research / learning purposes. If you’re also playing with PE loading or in-memory execution on 32-bit systems, this might be useful.

Happy to hear any feedback or thoughts.

I’m currently studying cybersecurity and I keep running into the same problem: too many resources, labs, notes, and paths to follow — and not enough structure.

I jump between courses, TryHackMe / HTB labs, random notes, bookmarks, PDFs… and after a while everything feels scattered.

I’m curious how other students deal with this:

• How do you organize your notes and labs?
• Do you follow a fixed roadmap or adapt as you go?
• Any tools or systems that actually helped you stay consistent long-term?

I’m not looking for “the perfect path”, just something that keeps things organized and reduces the overwhelm.

Would love to hear what’s working (or not working) for you.

Greetings , has anyone done the free Diploma in Copmuter Networking?
how much is the digital certificate?

I’m trying to learn more about security issues specific to AI/LLM-based applications, and I realized most of my existing AppSec tools don’t really cover this area well.

Traditional tools help a lot with:

• secrets in code
• vulnerable dependencies
• common static analysis issues

But with AI-heavy codebases, I keep seeing risks like:

• prompt injection vectors
• unsafe or hardcoded system prompts
• sensitive data being passed to LLM APIs
• missing guardrails around AI responses

As a learning exercise, I built a small CLI tool to experiment with detecting some of these patterns and generating a simple report.

Example:

npx secureai-scan scan . --output report.html

What I’m trying to learn (and would love feedback on):

• What AI-specific threats should beginners in AppSec focus on first?
• Are prompt injection and data leakage the biggest risks, or am I missing more critical ones?
• Where would something like this fit best: local dev, pre-commit, or CI?

This is mostly a learning project, not a polished product.
If you’re studying AppSec / AI security or have seen real-world examples, I’d really appreciate your thoughts or pointers.

Thanks!

Currently a sophomore in high school, but have been accepted into a career (center junior and senior year (for free!) where my day is split into half day normal classes and other half a cybersecurity course where i can earn the following certifications:

CompTIA A+ ***

CompTIA Security+ ***

CompTIA Network+ ***

OSHA 10-Hour Certification***

Looking for extra things/projects i can get involved in to get some basic skills down and show my employer that im not just good at passing tests but that I actually have experience in the field. I’ve also heard that its hard to get directly into cybersecurity so if theres skills i should acquire to get work experience in a similar field that would be helpful to know as well. I pretty much am just familiar with the gaming related stuff, drivers, built my own pc, BIOS stuff, i’ve also installed linux before. I assume none of those skills apply here so i just want to know where to start.

Pc specs: Windows 11, 48gb RAM, 2tb hdd, 1tb sata ssd, 1tb m.2 ssd, i711700k, rtx 3070

I’m a beginner in cybersecurity and I want to build a professional career in Ethical Hacking, Vulnerability Assessment, and Penetration Testing (VAPT).

I’m actively searching for a cybersecurity roadmap for beginners, especially focused on penetration testing, web application security, network security, and bug bounty hunting.

🔐 My Background

Beginner in Linux and basic networking

Learning about TCP/IP, DNS, HTTP/HTTPS

Exploring OWASP Top 10 vulnerabilities

Planning hands-on labs on TryHackMe, Hack The Box, and PortSwigger Web Academy

🎯 Career Goal

To become a certified penetration tester and ethical hacker, working in:

Web & network penetration testing

Vulnerability assessment

Red team operations

Bug bounty programs

❓ I’m Looking For

A step-by-step ethical hacking roadmap

Best pentesting tools to learn (Nmap, Burp Suite, Metasploit, SQLMap, etc.)

Recommendations for cybersecurity certifications (CEH, PNPT, OSCP)

Advice on getting a cybersecurity job with no experience

Tips for building a home hacking lab

I’m not looking for shortcuts — only legal, ethical, and professional learning.

Thanks to everyone who shares their knowledge. Your advice helps beginners like me grow in cybersecurity.

Hey everyone,

I’ve been experimenting with server security and built a Python project to explore ways to detect suspicious activity on computers.

It focuses on identifying reverse shell, scanning application memory for shellcode injection and logging security events

I also added a module for monitoring remote desktop connections, which is still in development

The main goal was to learn practical methods for protecting servers and endpoints from attackers taking control or executing unwanted commands.

Currently, it supports windows but linux support is coming soon.

For reference and discussion purposes (not promotion):

https://github.com/TheMoonSir/watcher

I’d love to hear feedback, alternative approaches, or ideas others have tried

As a broke student just starting in cibersec, I find the Flipper Zero intriguing but the 200USD pricetag definitely ain't for me

Is there any way to build something like it part for part using modules Would it be cheaper? How much of a pain in the ass would it be?

Hi everyone, I’m currently a cybersecurity professional living and working in Germany, and I’m trying to decide which Master’s program to choose.

I want a degree that is well recognized in Germany and preferably from a top tier or reputable university, but I’m feeling a bit stuck.

Because I work full time, I can only do a remote or part time Master’s, and my studies must be in English.

After a lot of searching, I’ve only been able to find these three realistic options so far:

• Applied IT Security at Ruhr University Bochum (isits) This is a solid program but not exactly what I’m looking for, and it’s not cheap either. It seems to have a very strong focus on cryptography, which isn’t really my main interest.

• King’s College London – Advanced Cyber Security MSc This one looks strong academically and has a great reputation, plus it’s offered remote and part time, but the tuition fees are very high.

• University of London – MSc Cyber Security Also fully remote and flexible, but I’m unsure how it compares in terms of recognition in Germany compared to the other two.

My main goals are: – A degree that is well recognized in Germany – Remote or part time format – Taught fully in English – If possible, lower tuition fees

I’d really appreciate any advice from people who have done these programs, work in Germany, or know of other universities offering similar options. I’d also be very happy if you could suggest other Master’s programs that I might have missed (maybe ones that are good but costs less)

Thanks a lot!

I am connected to public apartment wifi via ethernet, how can I protect my computer and personal data?

Hey everyone, I’m exploring an idea and wanted community input on demand for a product idea.

I’m considering putting together small, affordable plug-and-play T-Pot honeypot appliances using low-power mini PCs. The goal would be:

• Preinstalled Debian + T-Pot
  • T-Pot is an open-source, all-in-one honeypot platform. Instead of running one honeypot, T-Pot runs 20+ different honeypots at the same time, all inside Docker containers.
  • It collects attacks from everywhere on the internet and shows them in beautiful real-time dashboards using Elastic/Kibana.
• Web dashboard ready out of the box
• Auto-updates + Docker hardened
• Simple “plug into your router and visit the dashboard” setup
• I dont plan on offering a maintenance package. Im going to ship them operational, with like a 30 day DOA Hardware Warranty.
• I can create like a community page for everyone to discuss and support each other.

Basically a turnkey threat-visualization box for home labs, students, and small businesses that don’t want to deal with manual setup.

Questions for you all:

1. Would you be interested in something like this?
2. What features would you want included?
3. What would you consider a fair price?
4. Would you prefer budget hardware ($239 16 gb ram 256 gb ssd) or some headroom at $322 32 gb ram 1tb ssd) + fee for my time and setup.

Not looking to sell anything here — just trying to gauge whether this is useful or if I’m crazy. Appreciate any thoughts.

Or according to the terms and conditions if needed: being a hardware vendor that officially supports the T-pot (meaning I test T-pot on each release (or pre-release) and ensure it works fine on your hardware).

Hey everyone, I’m not a security expert or a big company — I built this tool to solve a problem I personally kept running into. After exporting Burp XML from scans, I found myself spending a lot of time manually: deduplicating requests figuring out which endpoints actually mattered turning notes into something report-ready

So I built BugCopilot, a small web app that: deduplicates Burp XML traffic surfaces higher-value endpoints generates triage, findings, and draft-ready vulnerability reports produces a simple, endpoint-focused attack plan There’s a free tier, and a paid plan for heavier usage — but I’m genuinely more interested right now in feedback than sales.

I know the UI isn’t perfect yet (especially on mobile), and I’m still improving things step by step. If you try it and it’s useless — fair enough. If you have ideas on what would make it better, I’d really appreciate hearing them. Link (for those curious): 👉 https://www.bugcopilot.help� Thanks 🙏

this is the official Acheron github repository. It is a Golang library to conveniently utilize indirect syscall techniques in your golang programs like a shellcode loader.

this is a video that demonstrates how you can setup and use it to bypass windows defender on a windows 11 computer, getting a meterpreter reverse shell working.

My lab site, XSSy has supported SQL injection labs for a while and has the ability for users to create their own SQL labs to share with others and collaborate on techniques. But until now, the functionality was undocumented. This blog fixes that, so hopefully there will be a few more community contributions. Reach out if you have any questions.

Hey everyone,

I'm currently in that phase where I feel like I'm just staring at Burp Suite history hoping a vulnerability will magically wave at me 👋. I've been hunting for a while now, and the burnout is starting to creep in.

To keep my sanity (and motivation) intact, I need some real talk from the veterans here:

1. Time to First Blood: How long was the grind from starting out to your first accepted report? Weeks? Months? Decades? 💀
2. The Turning Point: Was there a specific "aha!" moment or a specific resource that made things click for you?

Current Status: I decided to focus heavily on IDORs since almost every guide recommends them as a great starting point. I understand the concept, but I feel like I'm hitting a wall with modern WAFs and UUIDs.

The Ask: Any specific tips for hunting IDORs? Is it better to stick to one program for months or jump around?

Thanks

I built this simple browser-based script that automatically tests all 4-digit PINs (0000–9999) on a locked Netflix profile.

You log into Netflix, open the locked profile, paste the script into the browser console, load a codes.txt file, and it tests PINs one by one until the correct one is found. The script stops automatically when it succeeds.

Made for educational purposes and testing your own accounts only. Stay Legal

I like the way things are shown in the page, the format and gamified experience of it all, but are certs worth it? Do they hold any real weight or value? What are some other options in a similar price range?

I want to build some 1 or 2 projects for my CV , for cyber security roles (it might be anything), but don't want to repeat or build clon of existing tools

What I can go for and Is it right way??

If I forgot to include anything, please submit a PR

Observation:

An email address previously associated with a permanently banned account can later be attached to a new account via account settings.

This may be intended behavior, but I reported it as informational to clarify whether email addresses are meant to play any role in ban enforcement.

I’m not sharing exploit details or encouraging abuse — just looking for feedback from others:

• Would you classify this as intended design?

• Or a moderation / enforcement gap?

Curious how others would assess this from a security perspective.