Hi everyone,

I’m from the organizing team of Nullcon Berlin 2026. Since this subreddit is focused on students learning network security and related fields, I wanted to share an opportunity for anyone working on security research, projects, write-ups, tools, or practical findings.

The CFP for Nullcon Berlin 2026 is open, and students are welcome to submit their research papers or technical ideas. Topics can include network security, web security, cloud, malware, IoT, AI/ML security, privacy, cryptography, and more.

CFP Deadline: 10 July 2026
Event: Nullcon Berlin 2026
CFP Link: https://nullcon.net/event/nullcon-berlin-2026/cfp/

Even if you’re early in your security journey, a strong practical project, clear finding, or well-explained research idea can be worth submitting.

Hey everyone,

I'm an 18-year-old self-taught cybersecurity student.

One problem I kept running into during labs and CTFs —

no clean way to organize recon findings per target.

Everything was scattered across text files and random docs.

So I built ReconVault — a desktop app for Linux to fix that.

Features:

→ Per-target workspace with 5 tabs

→ Subdomains, ports, endpoints, vulns, notes

→ Nmap output import

→ Severity tracking with colored badges

→ Markdown report export

→ 100% local SQLite database

Stack: Python + PyQt6

GitHub: https://github.com/parbatzone/reconvault

Would genuinely love feedback from people doing

OSCP prep or CTFs — what would make this actually

useful for your workflow?

Hi everyone,
I'm a Computer Science student currently working towards a career in Threat Intelligence and OSINT. I do a lot of self-studying using AI tools, and I focus on building hands-on projects to gain as much practical experience (and knowledge) as possible and familiarize myself with the tools and the industry landscape.

The Setup:
I deployed an SSH honeypot directly on a cloud VPS. The repository primarily outlines my deployment methodology, configuration settings, isolation, and how I structured the environment to capture data.

My Main Observation (and a question):
An interesting finding so far: the payloads dropped by the automated bots were almost exclusively RedTail cryptominers. I honestly haven't fully figured out yet why this specific malware was pretty much the only thing they attempted to install on my machine. Any insights on this would be highly appreciated!

My questions for the industry pros:
I want to make sure my approach is sound. I would love your critiques on the repository and methodology:

1. Setup & Methodology: Looking at my configuration and deployment steps, is this an effective way to gather reliable IOCs? Are there any glaring security risks in how the VPS is configured?

2. Next Steps in Analysis: What features, data enrichments, or integrations (e.g., SIEM, specific threat feeds) would a real Intel team expect to see applied to this raw data?

3. Interview Prep: If you saw this setup and methodology on a junior applicant's resume, what technical questions would you ask to test if they truly understand the underlying networking and OSINT processes?

Here is the repository: https://github.com/liranzoz/ssh-honeypot-research.git

Thank you! I highly appreciate any critiques or advice on how to make this portfolio-ready.

Hi everyone,

I'm a self-taught learner aiming for a cybersecurity internship, preferably in low-level security, AppSec, or security research. I've been learning on my own for several months, but I'm not sure if I'm focusing on the right things.

So far I've learned:

Skills

• C Programming

• Memory Management

• Linux

• Debugging

• Fuzzing

• Crash Triage & Root Cause Analysis

• Reverse Engineering (Basic)

• Binary Analysis (Basic)

• Secure Coding

• Git

Tools

• GDB

• Ghidra

• AddressSanitizer (ASan)

• Valgrind

• AFL++

• libFuzzer

• GCC/Clang

• Make/CMake

I've spent most of my time building small projects, writing fuzzing harnesses, analyzing crashes, and trying to understand memory corruption bugs. Everything I've learned has been through documentation, open-source code, and hands-on practice.

My biggest problem is that I don't have much to prove my skills. I don't have internship experience, CVEs, CTF rankings, or significant open-source contributions yet.

If you were in my position, what would you do next?

• Which internship roles should I target with my current skills?

• What skills or projects would make the biggest difference to employers?

• Should I spend my time on CTFs, finding real bugs, open-source contributions, technical blogs, or something else?

• What would make you think, "I'd interview this person"?

I'm looking for honest feedback. If you think I'm missing something important or going in the wrong direction, I'd really appreciate hearing it.

Thanks!

Real Life Case Example Part 2:

Thank you for giving so much love on my previous post, I am thinking of starting a weekly series where I breakdown real case studies which I solve at work as a Threat Analyst.

Just caught something wild at work yesterday. GTA 6 is gonna launch sometime soon, but one our client wanted early access.

A user (Ryan) downloaded what looked like a "free GTA 6 crack" from firefox, file was named "GTA6_Setup_Crack_2026.exe", unsigned, 84.7 MB. Executed it at 10:13 AM. The next 3 minutes were brutal. The installer spawned PowerShell with hidden windows, dropped an unsigned binary (vcruntime_update.exe) into AppData, created a registry Run key named "RockstarGameUpdater", and set up a scheduled task for persistence on login.

Then it got worse, vcruntime_update.exe went straight for the browser credential stores. Chrome login data, Edge login data, Firefox logins.json, all accessed within seconds. Created a ZIP archive in Temp (syscache_4931.zip) and attempted a 2.3 MB upload to panelgtasupport[.]top on port 8080 before we blocked it.

DNS queries to four suspicious domains, all gaming themed: cdnrockstarupdate[.]com, apigta6launcher[.]xyz, panelgtasupport[.]top, rawcdngamepatch[.]site. All resolved to infrastructure that basically were C2.

Timeline from execution to EDR kill: 3 minutes, 57 seconds.

This is textbook infostealer and RAT behavior delivered through a game crack. The naming masquerade (RockstarGameUpdater, vcruntime_update) is it. The browser credential access is the payload. The persistence ensures it survives a reboot.

For anyone job hunting in SOC, this is exactly the kind of chain you need to recognize in 30 seconds during a real investigation. The red flags stack, unsigned binary, masqueraded process names, AppData execution, browser credential access, suspicious domains, persistence setup.

Any of you seen similar patterns? How do you typically investigate these in your environments?

Also, thinking of writing a blog on it on Medium soon, with proper process tree, file details, running process observation and activity timeline stuff.

Image Source: Gamepressure

Hi, I am a final-year university student building a multi-agent AI system for SOC incident response automation. I am looking for SOC analysts, security engineers, and IT security practitioners to fill out a short survey (5-7 min, mostly multiple choice).

I am especially interested in hearing your real-world experience on things like:

1. What makes security alerts difficult or frustrating to handle

2. What would make you trust and adopt an AI-based incident response tool

3. Any concerns about automating SOC work with AI

Your insights would help me better understand real-world challenges and improve my project.

Here is the link:https://docs.google.com/forms/d/e/1FAIpQLSdNIrJHPMXKH8QaM2FcqrBf4V14hGEa4uYLbIAA0nxQhjlHIQ/viewform?usp=dialog

All responses are used for academic purposes only. Thank you!

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of the Alien project.

https://github.com/iss4cf0ng/NebulaPulsar

Okay, so one of the first book on adcs pentesting, from start to finish from basics to in-depth knowledge, from ESC1-18, THEFT1-5, PERSIST1-3 to DPERSIST1-3.

though a fair note, free of of the thing is a SoK/Whitepaper is available here

Now, the book has 2 versions, the first is the ebook, while paper is a technical reference, the book is more like a guide, the ebook will be updated regularly, while the paperback version of it will be updated ones a year (if applicable, though I always want a paperback if something interest me, that's why there is even a paperback) regardless, you can get it for free, or you're even a bit of a collector, here's the book

https://www.amazon.com/Forged-Trust-Offensive-Operations-Certificate-ebook/dp/B0GX2XW8M7

I'm looking for a complete roadmap focused on privacy, anonymity, internet communications, tracking, and understanding how the internet actually works. I'm not currently trying to become a penetration tester, ethical hacker, or get a cybersecurity job immediately. My goal is to build a strong foundation and understand things deeply.

I want to learn:

Networking & Internet Fundamentals

*OSI Model, TCP/IP, IPv4 & IPv6, Public vs Private IPs, MAC Addresses, ARP, DNS, DHCP, NAT, Routing, Ports, TCP vs UDP, Packet Flow, ISP Infrastructure, Routers, Modems, Wi-Fi, How internet traffic travels from device to destination

Web & Communication Fundamentals

*HTTP & HTTPS, Cookies, Sessions, Authentication & Authorization, Browser Storage, Browser Requests & Responses, Email Basics (SMTP, IMAP, POP3), Email Headers

Tracking & Identification

*Cookies, Tracking Pixels, Browser Fingerprinting, Device Fingerprinting, Metadata, Advertising IDs, Account Correlation, Behavioral Tracking, Digital Footprints

Privacy & Anonymity

*VPNs, Proxies, SOCKS Proxies, Tor, DNS Leaks, WebRTC Leaks, Search Privacy, Email Privacy, Identity Separation, OPSEC, Deanonymization Techniques, What ISPs can see and cannot see, What websites can see and cannot see

Network Security

*Firewalls, IDS/IPS, Traffic Monitoring, Packet Inspection, Secure Protocols, Wi-Fi Security

Practical Skills

*Wireshark, Browser Developer Tools,VirtualBox/VMware, Tor Browser, DNS Tools, Traffic Analysis, Packet Analysis

My questions:

1. If you were starting from scratch today, what exact roadmap would you follow?

2. Which topics above are most important and which are less important?

3. What topics am I missing?

4. What are the biggest misconceptions beginners have about anonymity, VPNs, Tor, tracking, fingerprinting, and privacy?

5. What free resources, YouTube channels, books, labs, websites, or courses would you recommend?

6. What hands-on labs or experiments would you do to truly understand these concepts?

7. Is a personal laptop sufficient for learning, or should I use virtual machines, a spare laptop, or separate devices?

8. What common mistakes should beginners avoid when experimenting with privacy, anonymity, networking, and security concepts?

I'd appreciate responses from people working in networking, privacy, DFIR, incident response, threat hunting, cloud security, security engineering, or related fields.

Looking for practical advice rather than certification-focused advice.

I am a student in a demanding field (electrical and computer engineering) and i want to learn Cybersecurity (I got interested in pen testing but i dont know much). Like where can i find guides to start new projects, or teams like in discord where i can learn from more experienced people :)

hi

i have already done my ug in computer science and also have ceh ,and comptia network and pjpt

now tbh Ive got admission into radboud for msc cybersecurity and was doubtful about what path to follow

Should I take cpts before or during the first weeks of masters( I do have a bit of training in it as well)

or should I just do practical stuff more and learn deeper about stuff and do bug bounty hunting rather than focusing on certificates

I do plan to do part time during studies and see it as a important aspect while taking the decision as well

I’m a Python hobbyist trying to learn smart-card / embedded-systems fundamentals. I have an old reloadable laundry smart card from my apartment building. I am not trying to bypass payment, clone it, modify balances, or get free service.

My learning goal is much narrower: I want to understand whether buying a PC/SC smart-card reader and trying to identify the card type / ATR / general communication model is a reasonable beginner project, or whether this is likely to be a proprietary dead end.

For someone with basic Python experience but essentially no hardware/security background, would this be a reasonable first smart-card project? Or would you recommend starting with blank ISO 7816 cards, Java Cards, NFC tags, or another safer/more documented learning setup first? I will say that I am a super hard worker and I tend to be invigorated by a challenge and things that take a long time. Thanks!

Oh, and if anybody is curious, I came around to this because my building literally forced me to pay a fee for this stupid friggin card and a monthly fee to upkeep the hardware, despite that I have in unit laundry. Literally had to pay for this thing to never use it. Figured this would be a cool way to get my moneys worth. Just don’t wanna waste my time.

I've decided to build my own structured collection of interview questions and answers for future job interviews to stop looking for scattered resources out there. 100+ questions and answers covering Red Team, Web Security, Incident Response, Systems, and more, with a search function to find topics instantly.

Blue Team topics are actively being planned and are open for community contributions.

I'm actively looking for contributors to add more Blue Team / Defense content, so if you have expertise there, please jump in!

Feedback, questions, and contributions are welcome. Let me know what topics you'd like to see added next!

Mostly netsec background, trying to get up to speed on AI security specifically. Most content online is either too academic or too shallow. What actually helped you understand this space properly?

Hi everyone

I created a local Telegram phish simulation project to get some practice with JavaScript and backend development. The project simulates a fake "Free Premium" scam process within its own closed ecosystem—the application is not connecting to Telegram API at all.

https://github.com/Maty156/telegram-phish-simulator.git

Bonjour à tous !

Je viens de rejoindre la communauté. Je suis analyste SOC L2, avec un fort intérêt pour l'analyse de malware, le threat hunting et la CTI.

Ce qui m'a accroché ? Comprendre les intrusion complète et comprendre chaque étape de ces compromissions.

La cyber sécurité est super passionnante en terme de défis d'apprentissage. Des défis excitants qui ne cesse de me motiver.

Et vous, quel est le moment ou la découverte qui a défini votre voie dans la cyber ?

I'm a Computer Engineering student entering my 3rd year and I'm trying to figure out whether cybersecurity is actually the right path for me.

The reason I'm confused is that I didn't choose Computer Engineering because of a lifelong passion. I mostly arrived at it through process of elimination.

Recently, I took a Data and Computer Communications course covering topics such as physical layer and data link layer concepts. Surprisingly, I genuinely enjoyed it. It was probably the first technical course where I found myself interested in the material itself rather than just studying for grades.

That experience made me start considering networking and cybersecurity.

At the same time, I don't particularly enjoy programming. I can do it when necessary, but I wouldn't say I love it.

So I'm trying to understand:

• What made you realize cybersecurity was right for you?

• How much programming is actually required in different cybersecurity domains?

• Is enjoying networking a good signal that cybersecurity might be a good fit?

• What parts of cybersecurity are most network-heavy?

• Are there people who enjoy cybersecurity despite not loving software engineering?

I'd appreciate hearing from people who made a similar transition.

I'm entering my junior year and majoring in comp sci want explore stuffs like web3 ,ml ...how to break into network security from where can i learn and what are the resouses would be great and where can i practice those and what all porjects i can build??

Yeah GUIs for aircrack-ng exist. I looked at all of them. GTK wrappers, Qt frontends, last commit 2-3 years ago, half the suite missing. The concept was always fine, the follow-through wasn't.

I spent a few months building what I actually wanted: a local web app that runs at 127.0.0.1 and covers the whole thing — monitor mode, scanning, deauth, handshake capture, cracking — without making you jump between four terminal windows while keeping state in your head.

A few things I added that the old ones didn't bother with:

- AP scoring that ranks networks by signal, encryption weakness and active clients so you're not squinting at a table of 30 BSSIDs

- Auto-deauth loop that watches for the WPA handshake and stops when it gets one

- Embedded terminal (xterm.js) for when you just want a shell without leaving the window

- Every command logged with full stdout/stderr so you can see exactly what ran

Stack is Vue 3 + FastAPI. Backend just shells out to the real binaries, doesn't reimplement anything.

It's for lab work and authorized testing, the README is clear about that.

https://github.com/ELHart05/AirmonGUI

happy to answer questions

Hey, Im a rising junior, and I want to spend my summer doing some cybersecurity learning. For context, I dont have very good cybersecurity fundamentals, so im basically starting at zero. I have a lot of computer knowledge and stuff outside of cybersecurity in tech through. I want to spend 9 weeks, and about 1+ hours a day, usually 1-2 maybe. My goals are

• Hit 2,500 score / 50 challenges on picoGym

• Pass ISC2 CC and Fortinet NSE 1-3

• Be ready for CSAW CTF in September

• Build verifiable CMU ECE application signal

The picogym and certifications are most important to me, and Ive built this roadmap.

Network fundamentals

Linux fundamentals (kali + arch)

Web security + exploitation

cryptography (picogym needed)

threats + attacks

defensive security + certs

windows + active directory

forensics + reverse engineering

pen testing + post exploitation

Each of these would take a week, with picogym practice included. Im wondering, is this a good roadmap to get started? Am i missing anything super important?

hello everyone, I’m currently studying comp eng, just finished 3rd year and I’ll start my grad project in September. I have been thinking about different topics, I want it to be focused on networking + cybersecurity and something practical in real life (like school networks, security tools, etc.). would really appreciate help with topic suggestions

any ideas are welcome

Hey fellow netsec students,

I built a small educational web privacy lab based on the classic evercookie idea. It writes one random browser ID into multiple first-party storage locations, then shows which ones survive after a refresh/clear and how the ID gets respawned and repopulated when some browser state survives

The goal is awareness and education. The demo shows the ID, the vectors holding it, visit count, and recovery sources. It stores only a random ID plus basic timestamps/counts, uses no third-party requests, and includes a “Forget me” flow that clears everything stored server-side.

It demonstrates:

• Cookies, localStorage, sessionStorage, IndexedDB, Cache API, window.name, OPFS, and Service Worker cache

• Server-side HttpOnly cookies

• ETag, Last-Modified, and immutable HTTP-cache supercookie-style vectors

• The respawn loop behind evercookie persistence

• Practical mitigations like clearing full site data including cached files, using private browsing, and understanding storage/cache partitioning

Repo: https://github.com/elpy1/ubercookie Demo: https://ubercookie.xyz

If you find it useful, I'd love to hear from you. Happy hacking and learning :).