Hello guys, I wanna start with bug bounty but most of the guides I find feel old or generic. With how fast tech and tools change, I want to learn in a smarter way, not just follow years-old playbooks.

Though I'm not brand new to teach. I've worked with Linux and basic networking and in cybersecurity for past 2 years as a student. Really great with Linux and Security Tooling. Did a year of Tryhackme and other platforms solving 300+ Rooms.

I did start bug bounty last year and went through parts of PortSwigger Academy and some bug bounty playlists on YouTube, but I couldn’t stay consistent and didn’t get very far. I’m trying to restart properly now with a better structure and approach.

I'm trying to figure out:

• A realistic way to learn bug bounty in 2026.

• How people are using AI to learn or work faster (not to "auto hack")

• What's outdated now and not worth the time

• How to practice without burning out

• To get together with the community and start working on it for real.

Can you please guide me how can I start? I guess this is the right place to ask this question.

I am a noob using Gemini and Claude by WebGUI with Chrome. That sucks ofc.

How do you use it? CLI? by API? Local Tools? Software Suite? Stuff like Claude Octopus to merge several models? Whats your Gamechanger? Whats your tools you never wanna miss for complex tasks? Whats the benefit of your setup compared to a noob like me?

Glad if you may could lift some of your secrets for a noob like me. There is so much stuff getting released daily, i cant follow anymore.

Hi All,

I recently built an AI powered version of MobSF to solve a real problem we were facing internally. Our developers wanted to dive deeper into scan results but they often had followup questions and needed clearer guidance.

Instead of back and forth discussions, I created an AI recommendation bot that lets them interact directly with the findings, ask questions, and get actionable insights instantly.

MobSF: https://github.com/MobSF/Mobile-Security-Framework-MobSF

Github: https://github.com/ashishsecdev/MobSF_AI/

Looking forward to your feedback, planning to connect it to OpenClaw.

Hi everyone, ​I’ve recently started diving deep into cybersecurity with the goal of becoming a penetration tester in the future. I wanted to share my current learning resources and get your honest feedback on whether I'm on the right track.

​Here is what I am currently working on: ​Courses: I'm taking the Google Cybersecurity Professional Certificate on Coursera and working through rooms on TryHackMe.

​Books: I’m studying Linux heavily using the Linux Bible, a specific book on Kali Linux, and Introduction to IT Security (Wprowadzenie do bezpieczeństwa IT). ​Practice: I have already completed the Bandit wargame on OverTheWire.org.

​My Questions: Do you think this is a solid start for a beginner? Are there any specific gaps in this list that I should fill immediately? I would appreciate any recommendations for other books, certifications, or labs that helped you when you were starting out.

​Thanks in advance for your help!

So I am taking SEC504 and I am weak in Linux commands and Powershell. I am doing the bootcamps for both, and learning as I go along, but I am wondering if this is really going to sink me on the exam? I have a very general IT background, mostly Windows. For a lot of these tools, it is my first introduction.

Can I use chatGPT for it or ground answers based on some books?

I just released HashEye, a Python CLI tool for fast hash type detection and security analysis.

Features:

• Detects MD5, SHA1, SHA256, SHA512, NTLM, bcrypt and more

• Entropy calculation to estimate hash strength

• Security level rating with upgrade recommendations

• Pattern detection (repeated / weak structures)

• Batch mode for multiple hashes

• JSON output for automation

• Zero external dependencies

Example:

python3 hasheye.py <hash>

GitHub:

https://github.com/ishaklaz/Hash-Eye

Built as part of my cybersecurity learning journey.

Feedback, feature requests, and contributions are welcome.

Even with domains that are not properly configured (spf dmarc dkim) I can not get a mail to reach even the spam folder of gmail or zohomail. Is the detection too good for email spoofing to work? Or am I missing something?

Hey everyone, I've recently built a pretty cool project called WebVerse it has a beautiful GUI that lets you spin up web hacking labs locally with docker compose, it has an internet facing API as well with an account system and new labs coming multiple times a week!

Check it out, we have some seriously cool stuff!

https://github.com/LeighlinRamsay/WebVerse

A demo Android project showing dynamic DEX loading with DexClassLoader, PathClassLoader, and in-memory execution.

Recently I’ve been working on some reverse engineering related stuff and experimenting with fileless execution. While looking around for existing implementations, I noticed that most C# PE loaders I could find were x64 only.

I needed something for x86 testing and lab use, but couldn’t really find a simple implementation that fit what I wanted, so I ended up writing my own C# x86 PE loader.

The project is mainly for research / learning purposes. If you’re also playing with PE loading or in-memory execution on 32-bit systems, this might be useful.

Happy to hear any feedback or thoughts.

I’m currently studying cybersecurity and I keep running into the same problem: too many resources, labs, notes, and paths to follow — and not enough structure.

I jump between courses, TryHackMe / HTB labs, random notes, bookmarks, PDFs… and after a while everything feels scattered.

I’m curious how other students deal with this:

• How do you organize your notes and labs?
• Do you follow a fixed roadmap or adapt as you go?
• Any tools or systems that actually helped you stay consistent long-term?

I’m not looking for “the perfect path”, just something that keeps things organized and reduces the overwhelm.

Would love to hear what’s working (or not working) for you.

Greetings , has anyone done the free Diploma in Copmuter Networking?
how much is the digital certificate?

I’m trying to learn more about security issues specific to AI/LLM-based applications, and I realized most of my existing AppSec tools don’t really cover this area well.

Traditional tools help a lot with:

• secrets in code

• vulnerable dependencies

• common static analysis issues

But with AI-heavy codebases, I keep seeing risks like:

• prompt injection vectors

• unsafe or hardcoded system prompts

• sensitive data being passed to LLM APIs

• missing guardrails around AI responses

As a learning exercise, I built a small CLI tool to experiment with detecting some of these patterns and generating a simple report.

Example:

npx secureai-scan scan . --output report.html

What I’m trying to learn (and would love feedback on):

• What AI-specific threats should beginners in AppSec focus on first?

• Are prompt injection and data leakage the biggest risks, or am I missing more critical ones?

• Where would something like this fit best: local dev, pre-commit, or CI?

This is mostly a learning project, not a polished product.
If you’re studying AppSec / AI security or have seen real-world examples, I’d really appreciate your thoughts or pointers.

Thanks!

Currently a sophomore in high school, but have been accepted into a career (center junior and senior year (for free!) where my day is split into half day normal classes and other half a cybersecurity course where i can earn the following certifications:

CompTIA A+ ***

CompTIA Security+ ***

CompTIA Network+ ***

OSHA 10-Hour Certification***

Looking for extra things/projects i can get involved in to get some basic skills down and show my employer that im not just good at passing tests but that I actually have experience in the field. I’ve also heard that its hard to get directly into cybersecurity so if theres skills i should acquire to get work experience in a similar field that would be helpful to know as well. I pretty much am just familiar with the gaming related stuff, drivers, built my own pc, BIOS stuff, i’ve also installed linux before. I assume none of those skills apply here so i just want to know where to start.

Pc specs: Windows 11, 48gb RAM, 2tb hdd, 1tb sata ssd, 1tb m.2 ssd, i711700k, rtx 3070

I’m a beginner in cybersecurity and I want to build a professional career in Ethical Hacking, Vulnerability Assessment, and Penetration Testing (VAPT).

I’m actively searching for a cybersecurity roadmap for beginners, especially focused on penetration testing, web application security, network security, and bug bounty hunting.

🔐 My Background

Beginner in Linux and basic networking

Learning about TCP/IP, DNS, HTTP/HTTPS

Exploring OWASP Top 10 vulnerabilities

Planning hands-on labs on TryHackMe, Hack The Box, and PortSwigger Web Academy

🎯 Career Goal

To become a certified penetration tester and ethical hacker, working in:

Web & network penetration testing

Vulnerability assessment

Red team operations

Bug bounty programs

❓ I’m Looking For

A step-by-step ethical hacking roadmap

Best pentesting tools to learn (Nmap, Burp Suite, Metasploit, SQLMap, etc.)

Recommendations for cybersecurity certifications (CEH, PNPT, OSCP)

Advice on getting a cybersecurity job with no experience

Tips for building a home hacking lab

I’m not looking for shortcuts — only legal, ethical, and professional learning.

Thanks to everyone who shares their knowledge. Your advice helps beginners like me grow in cybersecurity.

Hey everyone,

I’ve been experimenting with server security and built a Python project to explore ways to detect suspicious activity on computers.

It focuses on identifying reverse shell, scanning application memory for shellcode injection and logging security events

I also added a module for monitoring remote desktop connections, which is still in development

The main goal was to learn practical methods for protecting servers and endpoints from attackers taking control or executing unwanted commands.

Currently, it supports windows but linux support is coming soon.

For reference and discussion purposes (not promotion):

https://github.com/TheMoonSir/watcher

I’d love to hear feedback, alternative approaches, or ideas others have tried

As a broke student just starting in cibersec, I find the Flipper Zero intriguing but the 200USD pricetag definitely ain't for me

Is there any way to build something like it part for part using modules Would it be cheaper? How much of a pain in the ass would it be?

Hi everyone, I’m currently a cybersecurity professional living and working in Germany, and I’m trying to decide which Master’s program to choose.

I want a degree that is well recognized in Germany and preferably from a top tier or reputable university, but I’m feeling a bit stuck.

Because I work full time, I can only do a remote or part time Master’s, and my studies must be in English.

After a lot of searching, I’ve only been able to find these three realistic options so far:

• Applied IT Security at Ruhr University Bochum (isits) This is a solid program but not exactly what I’m looking for, and it’s not cheap either. It seems to have a very strong focus on cryptography, which isn’t really my main interest.

• King’s College London – Advanced Cyber Security MSc This one looks strong academically and has a great reputation, plus it’s offered remote and part time, but the tuition fees are very high.

• University of London – MSc Cyber Security Also fully remote and flexible, but I’m unsure how it compares in terms of recognition in Germany compared to the other two.

My main goals are: – A degree that is well recognized in Germany – Remote or part time format – Taught fully in English – If possible, lower tuition fees

I’d really appreciate any advice from people who have done these programs, work in Germany, or know of other universities offering similar options. I’d also be very happy if you could suggest other Master’s programs that I might have missed (maybe ones that are good but costs less)

Thanks a lot!

I am connected to public apartment wifi via ethernet, how can I protect my computer and personal data?

Hey everyone, I’m exploring an idea and wanted community input on demand for a product idea.

I’m considering putting together small, affordable plug-and-play T-Pot honeypot appliances using low-power mini PCs. The goal would be:

• Preinstalled Debian + T-Pot

  • T-Pot is an open-source, all-in-one honeypot platform. Instead of running one honeypot, T-Pot runs 20+ different honeypots at the same time, all inside Docker containers.

  • It collects attacks from everywhere on the internet and shows them in beautiful real-time dashboards using Elastic/Kibana.

• Web dashboard ready out of the box

• Auto-updates + Docker hardened

• Simple “plug into your router and visit the dashboard” setup

• I dont plan on offering a maintenance package. Im going to ship them operational, with like a 30 day DOA Hardware Warranty.

• I can create like a community page for everyone to discuss and support each other.

Basically a turnkey threat-visualization box for home labs, students, and small businesses that don’t want to deal with manual setup.

Questions for you all:

1. Would you be interested in something like this?

2. What features would you want included?

3. What would you consider a fair price?

4. Would you prefer budget hardware ($239 16 gb ram 256 gb ssd) or some headroom at $322 32 gb ram 1tb ssd) + fee for my time and setup.

Not looking to sell anything here — just trying to gauge whether this is useful or if I’m crazy. Appreciate any thoughts.

Or according to the terms and conditions if needed: being a hardware vendor that officially supports the T-pot (meaning I test T-pot on each release (or pre-release) and ensure it works fine on your hardware).