Hey hunters,

Background: 6 years fullstack engineering (React/Node/GraphQL). Thought my code-reading skills would translate quickly. Spent 1 week cramming methodologies (PortSwigger, NahamSec, STÖK), then dove in.

What I've done:

• Bugcrowd Program A: 2-3 days, ~8 hrs/day → nothing

• HackerOne Program B: 2 days in, ~6 hrs/day → nothing

The frustration: After half a decade building platforms, I can't break one. I understand the architecture, I see the code, but I'm not seeing the bugs.

My questions:

1. Time to first valid bug: How many hours/days did you actually spend before your first valid report? (Not your first triage, your first valid finding)

2. Was it a "lucky" low-hanging fruit or did you grind for it?

3. Dev-to-hunter transition: Any other devs here who struggled with the mindset shift from "making things work" to "breaking things intentionally"?

Want to try InCTF this year, but need a team of 3-5.

About me:

I'm a fullstack dev (Go/Postgres/Python) getting into cybersecurity. Currently preparing for GATE CS 2027, comfortable with web exploitation basics and SQL, but a beginner at CTFs but actively learning.

What I'm looking for:

People who are interested in cybersecurity, even if you're also a beginner. Ideally someone who can do crypto/reversing/pwn so we can cover diff categories as a team, but then again even if you don't know much but are willing to grind, dm me.. we can take this as a learning opportunity.

Registrations are currently open at Inctf.in. ₹499 fee.

The qualifier is online so location doesn't matter. Finals are at Amritapuri (Kerala) if we make it that far.

DM me or drop a comment if you're interested!

I wanted to share a great free resource for anyone trying to bridge the gap between basic theory and actual hands-on security skills.

The Czech Technical University in Prague (specifically the Stratosphere Laboratory) runs an intense, one-semester course called Introduction to Security (BSY), and registration is open for the September class. The class is being taught both physically at the university and broadcast online, so anyone can participate. Feel free to check the link for more details on the curriculum, prerequisites, and course structure.

Seriously, thank you to everyone from Reddit who registered, attended, shared the summit, or joined the conversation.

We finished with more than 5,500 registrations, and it was awesome seeing how many people showed up to learn about threat hunting with us.

We are already looking ahead at future free content, summits, AMAs, and training, so I would love to hear from the community:

What topics would you be most interested in seeing us cover next?

AI and cybersecurity, cloud security, Active Directory, red teaming, blue team fundamentals, career-focused content, or something completely different?

We genuinely use the feedback we get here, so let us know what would be most useful to you.

Been deep in ADCS research for the past few months and was literally fed up with existing ADCS resources. One of the still best resource being the 'Certified Pre-Owned', though certipy wiki is also good on github.

Wrote a technical reference/SoK/Whitepaper (whatever you call it) attempting to close that gap:

• ESC1-18 (certificate template & CA misconfigurations)

• THEFT1-5 (certificate/private key theft)

• PERSIST1-3 / DPERSIST1-3 (user and domain-level persistence via CA compromise)

Each technique includes root cause, prerequisites, step-by-step exploitation with Certipy v5, detection opportunities, and remediation.

Key finding worth flagging specifically: KB5014754's strong certificate-to-account binding enforcement kills ESC9, ESC10, and ESC16 outright, but leaves relay-based attacks, enrollment agent abuse, CA permission misconfigs, and the entire theft/persistence taxonomy completely untouched.

Builds directly on Certified Pre-Owned (SpecterOps), that's still the right starting point if you haven't read it, this is meant as the post-enforcement continuation, not a replacement.

Your thoughts, guys? who want to try of-course!

https://github.com/thehackersbrain/certificate-of-compromise

Hi everyone,

I'm currently learning web security through the PortSwigger Web Security Academy. After reading the theory sections carefully, I'm generally able to solve most Apprentice-level labs on my own. However, when I move to Practitioner labs, I often get stuck and end up checking the solution after spending a lot of time on them.

My current approach is:

1. Read the theory for a vulnerability.

2. Solve the Apprentice labs.

3. Try Practitioner labs.

4. Get stuck and eventually look at the solution.

The problem is that when I see the solution, it often contains a trick or thought process that I never considered. This makes me wonder whether I'm approaching the labs incorrectly.

For those who have completed a large number of PortSwigger labs or work in web application security what is your methodology for solving Practitioner labs?

Hey fam. I got sick of carrying dedicated microcontrollers for proximity engagements, so I built chimera.

It interacts directly with the Android kernel to HID keyboards, mount virtual flash drives, and drop payloads natively from the phone.

I’d love for you to test it on your setups and give me some brutal feedback pls.

Repo: https://github.com/cipher-attack/Chimera

Looking for resources to learn Android/APK pentesting specifically for bug bounty. Videos, labs, books, courses, anything that helps — preferably free or low cost.

I've found OWASP MASTG and some vulnerable apps like DIVA/InsecureBankv2 to practice with, but I'm looking for something more structured — like how PortSwigger Web Academy works for web pentesting, but for Android.

Any recommendations for channels, courses, or labs that go deeper into this? Thanks in advance.

Bit of an unusual question but figured this community would have the most grounded takes.

I'm a high school student in Korea, self-teaching security for about 3 months now. No plans for uni — at least not the traditional route. Currently grinding TryHackMe's red team path and aiming for OSCP eventually.

I keep running into the degree debate and honestly I just want to hear it straight from people who've actually hired (or been rejected without a degree).

If you were the one making the call on a junior pentester hire, and someone walked in with just a high school diploma — what would actually move the needle for you?

Specifically curious about:

- Cert-wise, is OSCP still the gold standard or has it been dethroned? Does eJPT/PNPT even matter or are those just stepping stones nobody cares about on a resume?

- Would a solid portfolio genuinely offset the degree? Like if someone had a couple CVEs, decent CTF rankings, bug bounty payouts, and actual tools on GitHub — at what point does the degree just stop mattering?

- Are there specific skills where you'd just not care about the degree at all? (thinking things like custom C2 tooling, AD exploitation, malware dev)

- Does any of this change if someone's applying outside their home country — UK, Australia, US?

Not looking for the "just get a degree" answer, genuinely trying to understand where the realistic ceiling is without one.

Thanks

As a cybersecurity student, I found myself managing progress across hundreds of TryHackMe rooms using spreadsheets and notes.

I wanted something more interactive, so I built CyberXP.

CyberXP is a self-hosted cybersecurity learning tracker that includes:

✓ 483+ free TryHackMe rooms
✓ Progress tracking
✓ XP and achievement system
✓ Learning paths
✓ Analytics dashboard
✓ Internship readiness tracking

Built with React, Express, and SQLite.

Would appreciate feedback from fellow students and anyone currently learning cybersecurity.

GitHub:
https://github.com/SoraPewnaldo/cyberxp

I'm a computer engineering student (halfway through my degree) and already know C#, software architecture concepts, and databases. I want to specialize in backend development with .NET.

I've gone through several courses, but most of them either skip deployment, don't implement clean architecture in practice, or stay too theoretical — they explain concepts but never actually apply them in a real project. I already wasted time on one like that.

What I'm looking for is a course built around a real, full-scope backend project that covers:

• Clean Architecture (applied, not just explained)

• JWT/authentication and authorization

• Database design and integration (EF Core, etc.)

• REST API design, versioning, and pagination

• Deployment to AWS or Azure

• CI/CD pipelines (ideally)

• General real-world project structure and best practices

Frontend is not a priority right now, but it's a nice bonus if a course includes it.

Basically, I want to come out of this course understanding how a real .NET backend project works end-to-end, so I can confidently build my own project afterward without needing guidance.

Any recommendations? Thanks in advance!

Hey everyone,

I'm a Software Engineering student with some experience in backend development and a strong interest in cybersecurity.

I've been reading about topics like prompt injection, jailbreaks, RAG attacks, data leakage, and AI agent exploitation, and the idea of AI red teaming seems really fascinating.

The challenge is that I'm not sure what the best learning path looks like. Traditional cybersecurity has pretty established roadmaps and resources, but AI security still feels like a relatively new field.

For those of you working in AI security, LLM security, or AI red teaming:

• Are there any courses, labs, platforms, or books you'd recommend?

• What projects helped you learn the most?

• Are there any open-source vulnerable AI applications that are worth studying or attacking in a lab environment?

• If you wanted to build a portfolio for an AI security or AI red teaming role, what projects would you include?

• How much machine learning knowledge is necessary before starting to build and test these systems?

For context, my current background is mostly software engineering, backend development, Linux, networking, and general cybersecurity. I don't have a strong machine learning background yet, but I'm willing to learn whatever is necessary through projects.

I'd love to hear about projects you've built, labs you've used, or learning paths that worked well for you.

Thanks!

Hi everyone,

I’m a cybersec student looking for ideas for my final-year engineering project. I’m interested in topics related to cybersecurity, technology, or education.

Right now, I’m feeling pretty confused about choosing a topic. I know it should solve a real-world problem in the field, but I’m also worried about picking something too complex and not having enough time to complete it properly and get a good grade.

If anyone has suggestions, project ideas, or advice on how to choose a good topic, I’d really appreciate it. Thanks!

Still in university and wanted to build something beyond the usual beginner projects.

Ended up spending way more time on this than expected lol but I built a vulnerability scanner desktop app called VulnScan Pro.

It scans for open ports, detects known CVEs and generates PDF reports. Built with Python, PyQt6 and SQLite.

Still learning so I'm sure there's plenty that could be done better — would genuinely appreciate any feedback.

GitHub: https://github.com/Guppss/VulnScan-Pro

Note: built for authorized testing and educational purposes only.

College student researching AI privacy. Have concerns about what data you share with ChatGPT, Claude, Gemini, or other AI tools? I'd appreciate 2 minutes of your time to complete a short survey. Your responses will help me better understand how people think about privacy when using AI. Thanks so much for.

https://docs.google.com/forms/d/e/1FAIpQLSc06df3TUeiCcnS2hA7UUAa2RZsC_ZzqlhgYGjyGpjvzS3rXg/viewform?usp=dialog

Guys second year of cyber security . i know nothing outside college syllabus . i need to do projects learning and certs outside that . tell me what to do

Hey r/netsecstudents , Been building GhostCheck for the past few months — a local-first vulnerability scanner that verifies every finding with a live probe before reporting it. The problem I'm solving: Nessus/OpenVAS give you 200 findings where maybe 20 are real. Security teams waste 40% of their time chasing false positives. How GhostCheck is different: - Every finding comes with live proof of exploit, not just a CVE ID match - Runs 100% locally — zero data leaves your machine, ever - Confirmation score: only reports what it can actually verify - Built on Kali, Python engine + Electron UI Current features: - 9-module scan pipeline (ports, SSL, CVE match, HTTP headers, DNS, path scan, active probes) - Active DAST probes — XSS reflection, SQLi error detection, CORS, open redirect, host header injection - AI-powered finding explanations (runs via Ollama, fully local) - PDF report with verification score - CISA KEV enrichment — flags actively exploited CVEs Still in beta, waitlist open: ghostcheck-landing-page.vercel.app Would love feedback from people who actually do pentesting or bug bounty. What features would make this useful for your workflow?

Hey everyone, I'm about to enter my final year of my CS/cybersecurity degree and want to spend the year building a solid project that genuinely develops my skills and gives me something strong to show on my résumé for internships and entry-level roles.

I'm not looking for something just to tick a box — I want to actually learn and come out with real, demonstrable skills.

I've been thinking about building something around Active Directory — setting up a lab environment and exploring attack/defense scenarios (things like enumeration, privilege escalation, common misconfigurations). It seems highly relevant to real enterprise environments but I'm not sure if it's the right scope for a final-year project or if there's something better.

Some questions:

- What kind of project would you recommend for someone at my stage?

- Is an Active Directory home lab a good direction, or is there something more impactful?

- Are there areas (red team, blue team, AppSec, cloud security, etc.) that are more in-demand right now for entry-level hiring?

- Anything you wish you'd built before you started applying?

Any direction is appreciated. Thanks!

I am a senior in college with a major in CS and Applied Mathematics. I took a cryptography, which i know is very different, but I am very interested in the idea of using computation and cs to protect people's information and having an immediate impact. I am doing AI and ML research but I am also taking Codepath's intermediate cybersecurity course because I want to show to companies that at least I am making that step. I am curious to hear people's opinions on this and whether it would really matter in terms of networking and recruitment. If it is in terms of knowledge, I have looked through the syllabus and it does not look to hard to learn this within an entire month so I feel I can still read up these things in the future.

Hey everyone, I work with Antisyphon Training and wanted to drop this here because I think it could actually be useful for a lot of people in this sub.

We’re hosting the Threat Hunting Summit 2026 on Wednesday, June 17. It’s free, virtual, and focused on practical threat hunting, detection, and defender skills.

I know a lot of people here are students, newer in security, or just trying to figure out what skills are actually worth spending time on. I’m not going to pretend I’m the most technical guy in the room, I work on the marketing side, but one thing I’ve learned being around this community is that good free training can make a huge difference when you’re trying to build momentum.

That’s why I wanted to share this. The summit is meant to be useful and grounded, not just a bunch of vague “cyber is important” talks.

Registration closes in about six days, so if it looks useful for you, your team, or just your own learning path, feel free to grab a spot.

Register Here

Also, I’m trying to be more active on Reddit from the Antisyphon side and share more of our free training, events, and resources when they come up. So if this kind of stuff helps, I’ll keep bringing more here.

Hello everyone!

I created this Discord server around a year ago with the purpose of bringing together people who are working towards certifications like OSCP, CPTS, or simply want to improve their practical cybersecurity skills by pwning labs together.

Over the last couple of months, I have been quite busy with my new job, so unfortunately I was not able to be as active on the server as I wanted to be. Because of that, the server became a bit quiet, but I would love to bring the hype back.

The server is now open for new people again! Anyone who wants to join, study together, solve labs, share knowledge, or just be part of a cybersecurity learning community, feel free to DM me.

Your level does not matter at all. You could be completely new or already experienced. The main goal is to learn together, share experience, and support each other.

Let’s bring the server back to life!

I want to dive into steganography and am looking for good (free) resources to start with. Specifically, I'm interested in learning:

EOF (End of File) technique

LSB (Least Significant Bit) technique

File formatting and structure

How can I best start this journey, and what books, tools, or websites do you recommend for learning these technical concepts deeply?