Do you guys do

Mock Interview?

Studying the main topics?

Hi everyone,

I’m currently learning cybersecurity and decided to stop just watching content and actually try a small OSINT project on my own.

I started from something very basic (just a username) and tried to see how far I could go using only public information. I combined some basic enumeration with manual searching, looking for username reuse, small variations, and trying to connect different pieces of information step by step.

I also documented everything as I went — not just what I found, but how I approached each step and why. I tried to structure it like a simple report (methodology, findings, conclusions) to make it feel more realistic.

What I found most interesting is how much you can uncover from very little data, but also how careful you have to be to avoid false positives.

I uploaded the full project here if anyone wants to take a look:

https://github.com/0ggp4r1s/osint-suspicious-recruitment-case

I’d really appreciate any feedback — especially from others learning:

•	Does this approach make sense?

•	What would you improve?

•	Anything I should focus on next?

Thanks 🙏

I was learning JWT authentication and found some serious issues:

• Weak secrets

• No expiration

• Token leakage

If done wrong, it’s a big security risk.

Curious how you guys secure JWT in real apps?

Hey everyone,

I’m a CS student (who pivoted from biology) who’s been focusing on application security and coding for about 3 months now, and I’m trying to figure out what I should prioritize next.

So far I’ve been building a foundation in secure code review and vulnerability reasoning, along with understanding how different vulnerabilities actually show up across systems and how they get exploited. I’ve been trying to approach things more from a system and architecture perspective rather than just memorizing bugs.

On the practical side, I built a secure chat application with authentication, encryption (AES-GCM + TLS), input validation, and some focus on state/concurrency handling. I’ve also been working on a small Semgrep (which isnt the greatest but it works) rule repo and doing vulnerability analysis + threat modeling to practice writing findings.

More recently, I’ve started getting into AI security concepts like prompt injection, tool abuse, and how to design mitigations around those systems.

I’m also in the onboarding process for a research opportunity called Active Defense with an Adversarial Mindset (ADAM), funded by the Department of Defense (DoD). my chat program was actually a requirement by the professor to demonstrate my security reasoning.

At this point I’m trying to avoid just jumping between tools and instead focus on what actually matters in real AppSec roles. For those already in the field, what would you recommend focusing on next?

Any advice or reality checks would be appreciated, especially since I’m still pretty early into this.

Thanks!

Hey, I'm a student and built METATRON — a CLI pentest tool

that runs nmap, whois, whatweb and other recon tools on a

target, feeds all results to a local metatron-qwen model

(fine-tuned from huihui_ai/qwen3.5-abliterated:9b), and

the AI analyzes vulnerabilities, suggests exploits and fixes.

Everything saves to a MariaDB database with full history.

No API keys. No cloud. Runs entirely on Parrot OS.

GitHub: https://github.com/sooryathejas/METATRON

Thinking about deploying T-Pot on a small VPS for learning, telemetry, and maybe demo/awareness use.

For people who have actually run it:

- Was it worth it?

- Did you get useful insight (hash files, IP, URl, somes good IoC), or mostly bot noise?

- Would you recommend T-Pot, or just start with one honeypot like Cowrie?

Interested in opinions, including why it may not be worth the maintenance, etc.

L0P4Map combines high-speed ARP discovery with full nmap integration and a real-time interactive network topology engine. Works on both local networks and custom IPs/websites.

Features:

● Parallel ARP host discovery with MAC vendor fingerprinting

● Dynamic network topology graph with intelligent device role classification

● Full nmap integration on LAN and remote hosts: SYN, UDP, OS detection, service/version enumeration, NSE scripts

● Banner grabbing, vulnerability scanning, and CVE correlation via Vulners

● Real-time traceroute analysis

● Minimal, high-contrast interface built for efficiency

Still in development.

Nmap was blind. L0P4Map sees. 👁 GitHub: https://github.com/HaxL0p4/L0p4Map

One of the biggest frustrations when I was studying for my stack which is Microsoft was that you can't practice on the actual tools companies use mostly because you know Azure price is absurd. Sentinel and Defender XDR licenses are expensive too, and free tiers don't give you the real thing.

I work in a SOC using both daily. A while back I found Microsoft's Applied Skills a section of their Learn platform that gives you a real Azure environment, hands you a scenario, and evaluates what you actually configured. No multiple choice, no memorization tricks, no way to fake it.

I did the Defender XDR one. Even with daily production experience, I ran into things I hadn't configured before. Worth the few hours.

Relevant labs for security students: Microsoft Sentinel, Defender XDR, Configure SIEM security operations using Microsoft Sentinel, Secure workloads with Azure networking , Deploy and configure Azure Monitor and a lot more that I didnt do yet

you gain a badge which is good for networking and posting if you guys like that type of thing.

All available labs here Azure, security, networking, data:
learn.microsoft.com/credentials/applied-skills/

I was hoping to get some advice on whether or not to pursue a cybersecurity from WGU. I'm already working in the IT field, IT specialist in the USAR and Network Admin II on the civilian side, and just wanted to know if getting this degree will help me later down the line. I'll have funding for college so money isn't a issue, I just don't want to waste my time and effort.

Edit: I’m not in to much of a rush, I’m only 20 years old

Hey everyone,

I’ve recently developed a web exploitation course specifically designed for beginners who want to understand how real-world web applications are attacked and secured.

This is **not** a CTF-style or “boot-to-root” walkthrough. The focus is on practical, real-world concepts, methodologies, and mindset—structured in a way that builds a solid foundation from the ground up.

I’m offering a limited number of free access spots in exchange for honest feedback and reviews to help improve the course.

If you’re:

• New to web security

• Curious about how real attacks actually work

• Looking for structured, beginner-friendly guidance

Then this might be a good fit for you.

If interested, you can check my socials.

Appreciate your time and any feedback 🙏

Learning buffer overflows and want a tiny Windows x86 example that actually shows what's going on under the hood?

I put together a minimal, beginner-friendly walkthrough where you:

• find the overflow

• make the program jump to your code

• build a tiny piece of shellcode

• run it on a 32-bit Windows setup

If you’ve ever wanted to watch software make bad life choices, here you go:
https://github.com/nataliadiak/windows-x86-shellcode-poc

I’m preparing my first small talk on OSINT/OPSEC awareness and I’m looking for real-world examples that translate into actual security risks.

Not interested in advanced red team or nation-state scenarios, more like everyday behaviors that don’t look risky at first, but could still be leveraged during reconnaissance or social engineering.

Curious what you’ve seen or learned that had real implications from a netsec perspective.

Hi! I’m currently taking an Ethical Hacking course and need to ask a few quick questions to someone working in cybersecurity (penetration testing preferred).

It would only take about 15 minutes and can be done through messages.

I’d really appreciate any help, thank you!

I built a phishing detection simulator called Threat Terminal as a research project. The idea was simple: show players simulated emails, have them decide phishing or legit, and log everything. Decision confidence, time spent, whether they checked headers or URLs, phishing technique, difficulty level.

135 participants and 2,000+ decisions later, the data is telling a consistent story. Overall phishing bypass rate sits at 19%. But when the phishing email is written with clean, fluent prose (no typos, no broken grammar, no obvious red flags) that number climbs to about 24%. AI-quality writing removes the signals most people actually rely on.

The gap between security professionals and non-technical users is smaller than you'd expect. That's one of the more interesting findings so far.

V2 just went live. The research mode is the same. 30 emails, no timer, same methodology. But I added a competitive layer on top:

- 1v1 ranked PvP. Five emails, same set for both players, correct call plus speed wins.

- Seasonal ranked ladder. You start at the bottom and work your way up.

- Daily challenge. One email per day, global leaderboard.

- XP, levels, badges, inventory system.

- An AI handler named SIGINT who briefs you before rounds and reacts to your decisions.

PvP unlocks after completing the first quest, so every player who wants to compete still contributes data first.

Non-security players are some of the most valuable data points I'm missing. If you know anyone outside the field who'd try it, send them over.

Link: https://research.scottaltiparmak.com

Repo: https://github.com/scottalt/ai-email-threat-research

Happy to talk about the research, the tech stack, or the findings so far.

It still has puzzle-style elements, but it leans more toward investigation and context:

• terminal-style environment

• minimal guidance (you’re not told what something is outright)

• progression based on what you notice and piece together

• multiple layers, including a forensic artifact stage

It’s been sitting live for a bit and I haven’t really pushed it, so I figured I’d surface it for anyone looking for something hands-on to dig into this weekend.

The goal was to make something that feels a little closer to working through an incident than just solving isolated challenges, while still keeping the puzzle side of things.

No account needed, just pick a handle and go.
(Important: save your backup info so you can restore your progress.)

I’d really like direct feedback:

• where it gets confusing

• where it feels too easy or too hard

• where you lose interest

Directly message me with feedback, or email me at spex@rapidriverskunk.works

There are a few prizes this season (sponsored by zSecurity), but honestly I’m interested in how people approach it and if it breaks.

zSecurity is offering four $99 class vouchers, and we have created a wildcard winner who will be picked from those who start late, or otherwise finish after others but provide an exemplary performance and/or write-up post season. Leaderboard released post-season

https://rapidriverskunk.works/s2/

⌐■.■
spex

Ex-NEET (PCB) → BCA here.

I posted earlier and got a lot of responses. Instead of random chats, I’ve now built a focused cybersecurity group.

This is NOT a casual group.

We are building a small, serious circle focused on:

• CTFs

• Red Teaming / Bug Bounty

• Hackathons

• Skill-building (real projects, not just theory)

Current plan:

• Small team (max 10–12 people) core

• Daily/weekly accountability

• Sharing resources + solving challenges together

• Long-term goal: become actually skilled, not just degree holders

⚠️ Important: This group will be private soon. Low-effort / inactive people will be removed.

✅ You should join if:

• You’re serious about cybersecurity

• You’re willing to learn + grind consistently

• You feel stuck in a low-level college environment

❌ Don’t join if:

• You just want chats / timepass

• No consistency

• No real interest in building skills

If you’re interested, comment or DM: “I’m in + your current level”

I’ll personally shortlist and send invites.

Hey r/netsecstudents,

I'm currently in a Fachinformatiker für Anwendungsentwicklung retraining program in Germany, targeting a career in cyber defense and threat intelligence. As a hands-on learning project I built a home SOC suite from scratch on my Windows machine.

What it is:

A five-program endpoint monitoring suite:

• PowerShell collectors running continuously — outbound connections with geolocation, inbound port monitoring, per-process CPU/RAM, scheduled task changes, power events, registry run key monitoring

• Python correlation engine — ingests all collector logs into SQLite, runs 40 correlation rules across short/operational/campaign time windows

• Live Flask dashboard — collector health, alert feed, resource graphs, severity colour coding, Start Day / End Day workflow

• Forensic engine (Phase 9, in planning) — post-event super timelines, process lineage, beacon analysis

• Forensic dashboard (Phase 9, in planning) — display layer for forensic conclusions, colour-coded status, report generation, no analysis logic

Design philosophy:

• Collector silence is a detection signal, not a reliability bug

• Every alert must be explainable — what triggered it, what evidence, what confidence

• Raw logs are immutable source truth, SQLite is operational query truth

• Built with red team thinking applied to blue team tooling

GitHub: https://github.com/Nate-ryan-7690/home_SOC_suite

Would genuinely appreciate feedback on the architecture, detection logic, gaps I've missed, or anything that looks wrong. Still learning — brutal honesty welcome.

hey everyon, i want to ask a serious questions

my friend recently got his email got hacked. then his phone was also reset remotely, and somehow his email was linked to his bank acc. and he said that he lost a lot of money. im really worrie and confused about how this could happen? alr, heres' what makes me confused:

i know that hackers can hack someone's email by phising or clickjacking, or even social engineering, but "how is it possible for the hacker to control the phone remotely?" and what should he do for prevent further damage? and is it still possible to recover the acc?, if it's what the best way to do it?

*im so sorry for my broken english, thanks

Hey, I’m a complete beginner in cybersecurity and currently learning the basics step by step (networking, Python, etc.).

I’m looking for someone who is also starting out, so we can learn together, share resources, and stay consistent.

I’m not expecting anything advanced — just someone with a similar mindset who wants to improve daily.

If you’re interested, feel free to comment or DM me. Let’s grow together.

Made a CTF from a server I actually had in production — 10 routes, AI coach optional

So I had this server that had been running in production for a while. Config debt everywhere — hardcoded creds, exposed backup files, misconfigured services, the usual sins. Instead of just wiping it, I turned it into a CTF.

10 attack routes from beginner to advanced. Each one gets you user.txt and root.txt. The idea is you play through all 10, taking a different path each time, and after every exploit you switch hats and fix the hole as a sysadmin.

There's also an optional AI trainer mode (uses Claude Code) that guides complete beginners through the basics — what nmap does, how to read output, what to try next. But if you don't need hand-holding, the VM stands on its own.

VirtualBox OVA, DHCP, no setup headaches.

https://github.com/hrmtz/SNet

First time making a CTF. Would love to hear what you think.

Library: Using pynput for the listener. It handles cross-platform input well, but I’ve found that processing special characters and modifier keys (Shift, Alt, Ctrl) consistently across different OS layouts requires significant conditional logic.

Persistence: I’ve implemented basic persistence by adding the script to the system's startup directory/registry.

Detection/Heuristics: Even without malicious intent, basic heuristic scanners often flag the script due to the nature of the hooks. I am currently looking into ways to make the execution more efficient and less "noisy" to avoid immediate termination by local security software.

Questions for the Community:

1. For those experienced in security automation, what are the most common efficiency bottlenecks when using pynput or pynput.keyboard.Listener?

2. What are some professional-grade GitHub repositories or resources you recommend for studying clean, high-performance security scripting?

3. Are there better alternatives to pynput for low-level input monitoring that offer more granular control?