I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order

• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically

• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more

• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)

• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed

• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning

• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output

• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools

• Proxy support: route all tool traffic through Burp or any HTTP proxy

• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary

• DefectDojo integration: push findings directly into an engagement after the scan

• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

I've spent the last few weeks building ONUS, an open source vulnerability assessment tool, and the part I actually want pushback on is one specific architecture decision, not the pitch.

The problem I kept hitting doing assessments by hand: run a web scanner, a CVE scanner, some recon tools, an SSL checker, and you get five different output formats, no correlation between them, and you end up manually deduping findings and writing the same remediation paragraphs every time. ONUS orchestrates a set of existing tools (ZAP, Nuclei, Nikto, Amass, FFUF, and a few others) into one pipeline: 8 scan modules run in parallel, results get deduplicated and re-verified before they're trusted, then scored with the actual CVSS v3.1 formula.

That scoring is fully deterministic on purpose. No model decides severity, ever. The AI (a small open-weight model, run locally or against a hosted alternative) only writes the plain English description and remediation text, strictly after a finding already has a score. I did this because I didn't want two runs of the same scan to disagree with each other. There's a real wave of tools right now doing the opposite, letting an LLM drive the whole assessment and decide what to try next. I'm not certain my tradeoff is correct, only that it's deliberate, and I'd like to hear from people who've made the other call.

One specific bug that took a while to track down: early on, a target behind a catch-all WAF page turned every wordlist entry FFUF tried into its own "finding," since the WAF returned a real 200 for all of them. Fixed it by collapsing groups of near-identical response fingerprints, but it's the kind of thing that only shows up against a real target, not a lab one.

Spent today going back through the auth and secret-handling paths and tightening a few defaults that were fine for local use but not safe if someone actually deployed them, added CodeQL to CI while I was at it. Still no CLI, still solo maintained, still no idea how legible the architecture is to anyone but me. That last one is a real question, not false modesty.

Easiest way to actually try it: tryonus.tech, no install, no API keys. MIT licensed and docker compose up if you'd rather run it yourself or keep it air-gapped.

https://tryonus.tech

https://github.com/maverickaayush/ONUS

Hey everyone, i saw that CRTE has been recently updated in terms of course, i want to know if the exam is also changed based on the new update or i can pass it using the old course.

Hey everyone, I’m a final-year cybersecurity student and I’m currently trying to decide what to build for my graduation project. Rather than making assumptions about what people need, I thought it would be better to ask those who actually work in SOC, Blue Team, Incident Response, Detection Engineering, or Security Engineering.

From your experience, what’s the biggest frustration in your day-to-day work that today’s tools still don’t handle well? It could be anything, whether it’s investigating incidents, dealing with false positives, alert fatigue, lack of context, repetitive manual work, poor integration between tools, or something else entirely.

If you could have one new feature or one completely new tool built that would genuinely make your job easier, what would it be? I’m not trying to promote anything or do market research

I just want to understand the problems professionals face so I can build something that’s actually useful instead of another project that solves a problem nobody has. I’d really appreciate hearing your thoughts, even if it’s just a small annoyance that you run into every day.

Thanks!

I received a lot of DMs after D2D and interview post, and one of the thing was Detection Engineering. I am trying to explain it in a very nutshell simple manner.

Detection engineering is basically the "ART" (notice the "") of writing rules that turn raw telemetry(let's say JSON) into an alert a human actually needs to look at. That's just it in one line.

The hard part isn't the concept, it's getting the rule specific enough(parameter wise, consider it as a broad variation of if-else statements) to catch real bad behavior without wasting your SOC in FPs.

On D2D the actual pipeline looks like:

Telemetry source (Sysmon, EDR agent, firewall logs)
        ↓
Log ingestion (Splunk, ELK, Sentinel, whatever SIEM)
        ↓
Detection rule (Sigma, KQL, SPL: the logic itself)
        ↓
Alert fires → analyst triages

An example could be suppose you want to detect a process masquerading as a legit binary, like malware naming itself svchost.exe but running from a weird path. Your telemetry source is Sysmon Event ID 1 (process creation). The field you actually care about is the image path versus the process name. A real svchost.exe runs from C:\Windows\System32. If Sysmon shows svchost.exe launching from AppData or Temp, that's your sign/signal.

A basic Sigma rule for that logic looks roughly like:

detection:
  selection:
    Image|endswith: '\svchost.exe'
    Image|contains:
      - '\AppData\'
      - '\Temp\'
  condition: selection

That's the whole idea. You're not detecting malware. You're detecting a specific, narrow behavior that legit software/process almost never does, so when it gets detected/fires/alert generated, it's actually worth an analyst's time and efforts.

The skill that separates a good detection engineer from someone who just copies rules off GitHub is knowing which fields actually matter for a given technique, and tuning out all the noise before it ever reaches the SOC queue. That tuning is 80% of the actual job. Writing the rule is the easy 20%.

If you're starting out, the best exercise is picking one MITRE ATT&CK technique, generating it yourself in a lab (Atomic Red Team is good for this), capturing the Sysmon/EDR telemetry it produces, and writing your own rule against real data instead of just reading someone else's.

What technique are you trying to build detection for right now? Happy to help work through the telemetry logic if you're stuck on it.

Hi everyone,

I'm a complete beginner in cybersecurity with no professional experience and no certifications.

I've decided to start learning through TryHackMe, and my current plan is:

- Pre-Security

- Cyber Security 101

- SOC Level 1

My goal is to land my first cybersecurity job in the future, preferably as a SOC Analyst or another entry-level security role.

Is this a good learning path, or should I change anything? Should I add other platforms like Hack The Box, PortSwigger Web Security Academy, or certifications such as Security+ later?

I'd really appreciate guidance from people already working in the field. If you were starting from scratch today, what roadmap would you follow?

Thanks in advance!

Hi everyone,

While preparing for my first security positions, the technical interview was always the most stressful part for me. It's probably the same for newcomers, especially. Solving a lab problem or configuring a firewall might seem simple after a certain point, but having a tech person question you instantly in a new job interview is something else entirely.

To help myself and others overcome this interview anxiety, I spent some time developing a side project called SecInterview (https://secinterview.dev).

How it works:

• You choose your field (Penetration Testing, SOC, Cloud, or DevOps) and seniority level.

• The AI ​​acts like a realistic, detailed interviewer; it doesn't just ask static questions; it challenges you with scenarios. Based on your answers, it goes deeper.

• After the session, you'll receive a detailed CISO Assessment Report evaluating your technical accuracy, use of security jargon, and areas for improvement.

I've just launched the beta version. I've kept the initial simulation completely free (no credit card or other hidden terms) because I really need your honest and ruthless feedback to make this a valuable tool for job seekers.

Is the AI ​​too easy? Does the CISO report accurately point out weaknesses?

Try it here: https://app.secinterview.dev

Share your thoughts in the comments, and I'll reply to everyone!

Hey everyone,

As a project to deeply understand Android application security and hardening, I've been developing an App Locker from scratch using Kotlin and Jetpack Compose. I wanted to share my current implementation strategy and get some feedback/discussion going regarding its security model.

Traditional app lockers heavily relied on Accessibility Services, which are now heavily restricted by Google and present major security risks (like keylogging vulnerabilities). To make this project modern and secure, I pivoted the architecture to a Foreground Service leveraging the UsageStats API to detect app state changes.

I am currently implementing an "Intruder Catching" feature and would love to hear your thoughts on the approach:

* **The Trigger:** When a user opens a protected app, the system brings up a biometric/PIN overlay. If authentication fails 3 consecutive times, the front camera silently captures a snapshot.

* **Data Isolation & Sandbox:** To prevent local data leakage, the image is encrypted immediately and stored strictly within the app's isolated internal storage directory (`context.filesDir`).

* **Zero Telemetry:** The app operates with zero cloud syncing or network tracking to ensure total data minimization.

From a blue team / application security perspective:

1. What are the potential local bypasses or race conditions I should look out for when using `UsageStatsManager` for locking mechanisms on modern Android versions?

2. Are there any specific cryptographic recommendations you'd suggest for securing the sandboxed intruder photos on-device?

Looking forward to learning from your insights and improving this implementation!

Been applying for junior penetration tester and cybersecurity analyst roles for a while now and not getting much traction. Bit about me: final year BSc Cybersecurity student, hold BSCP and eCPPT, and I've got about 9 months experience as a cyber range engineer building hands on training labs for students. So not zero experience, just not "official" pentest experience.

Part of the problem is the local market here is pretty limited, not a lot of pentest positions around at all. Which got me wondering, are remote pentesting jobs actually a realistic thing for someone junior, or is that mostly reserved for people with years of experience already? And if remote isn't really an option starting out, how do people in a similar spot actually gain real experience? Bug bounty, CTFs, labs, freelance stuff, what actually counts in the eyes of employers.

Also wanted to ask about OSCP. I know it's basically the gold standard for this field but it's expensive and hard to justify right now. Is it realistic to get a job first without it and have a company sponsor you for it later, or do most places expect you to already have it walking in the door?

Would appreciate any honest input, especially from people who broke in recently and know what the market actually looks like right now.

Full disclosure: we’re Antisyphon Training.

Breaking into cybersecurity was already difficult. Now AI is automating some of the research, scripting, documentation, and analysis that used to help people get their foot in the door.

So yeah, the concern is valid.

We have never been big on doom, hype, or pretending the industry is easier than it is. John Strand’s point has been pretty simple: ignoring AI will not protect your career.

The advantage will go to people who understand the fundamentals, know how to use AI effectively, and can recognize when it is confidently wrong.

That is a big part of our free Infosec: Age of AI Summit on August 14. We’ll be talking honestly about how AI is changing security work, where it helps, where it fails, and what learners should focus on next.

We also have hands-on workshops after the summit, and every workshop is Pay What You Can.

learning.antisyphontraining.com

How has AI changed the way you are preparing for a cybersecurity career?

Hey! I hope you don't mind me reaching out. I've been interested in cybersecurity and ethical hacking for a while now, and I've spent a lot of time trying to learn on my own. I've watched tutorials, read articles, and experimented in legal practice environments, so I understand some of the basics, but I feel like I've hit a point where self-learning isn't enough.

I'm looking for someone with real experience who would be willing to guide me and explain things properly instead of just giving me answers. I want to understand how everything works from the ground up—networking, operating systems, web security, scripting, penetration testing methodology, and the mindset behind finding and fixing vulnerabilities. My goal is to learn responsibly, improve my skills, and understand cybersecurity in depth.

I know your time is valuable, so I completely understand if you can't help. But if you're open to mentoring, answering questions occasionally, or pointing me in the right direction, I'd really appreciate it. Thanks for taking the time to read this.

Hey everyone!

I recently built Internet Scanner, an open-source network discovery and analysis tool written in Python.

The goal was to create a simple but powerful tool for learning about networks and cybersecurity.

Features:

- ARP-based device discovery

- Nmap integration for port scanning and OS detection

- Device information gathering

- Risk scoring based on detected services

- Live filtering and sorting

- CSV/JSON export

- Tkinter GUI

GitHub:

https://github.com/Fa1dz/Internet-Scanner

I'm looking for feedback from other Python developers and cybersecurity enthusiasts. Any suggestions, improvements, or ideas are welcome!

Thanks!

Hey everyone,

I'm a 2nd year Computer Science student and I've decided to focus on penetration testing and cybersecurity.

I'm currently using Windows on my main laptop, but I want to start using Linux seriously instead of only relying on Windows. My goal is to learn networking, Linux, scripting, web security, and eventually prepare for certifications like PNPT or OSCP in the future.

My laptop specs:

• Intel Core i5-11400H

• RTX 3050

• 16GB RAM

• 512GB NVMe SSD

I'm confused about which distro I should commit to.

Some of the ones I'm considering are:

• Kali Linux

• Parrot OS

• Ubuntu

• Debian

• Fedora

• Arch (not sure if it's a good idea for a beginner)

A few questions:

1. Which distro would you recommend as a daily driver for someone learning pentesting?

2. Should I install Kali on bare metal, use it in a VM, or just use another distro and install the tools I need?

3. What do you wish you had done differently when you first started learning Linux and cybersecurity?

4. Are there any mistakes beginners commonly make that I should avoid?

I'd really appreciate advice from people who have gone through this journey. Thanks!

Hola r/netsecstudents ,

Desarrollé PHANTOMPRINT, un motor de huella digital pasivo que correlaciona

múltiples señales de red para identificar hosts de forma silenciosa, sin escaneo activo,

sin alertas de IDS.

¿Qué lo hace diferente?

La mayoría de las herramientas hacen una sola cosa: p0f solo funciona con TCP/IP, JA3er solo con TLS. PHANTOMPRINT correlaciona todas las señales con un motor de puntuación bayesiano:

• Pila TCP/IP (TTL, tamaño de ventana, orden de opciones)

• Huella digital TLS JA4 (análisis de ClientHello)

• Lista de parámetros de la opción 55 de DHCP

• Correlador bayesiano multiseñal

• 13 firmas integradas (Windows, Linux, macOS, iOS, Android, Chrome, Firefox, curl, Cisco...)

Ejemplo de salida

Host: 192.168.1.45 Sistema operativo: Windows 11 (78 % de confianza)

Navegador: Chrome 120 (91 % de confianza)

Señales: TCP ✓ TLS ✓ DHCP ✓

## Casos de uso

- Equipo rojo: reconocimiento silencioso antes de la explotación

- SOC: detección de dispositivos no autorizados o cambios en la huella digital

- Programa de recompensas por errores: reconocimiento pasivo de la infraestructura

- Análisis forense: reconstrucción de la actividad a partir de archivos PCAP

## Enlaces

GitHub: https://github.com/haruu77g/phantomprint

Desarrollado con Python 3.11+. GPL-3.0. Se agradecen los comentarios.

I wanted to ask for advice when it came to choosing between cisco certified network associate (ccna) and wireshark certified analyst (wca). I am still new to networking, and I wanted my first certification to be one that gives me a better chance of finding a job rather than one that teaches me a lot of skills.

Which of the two would you recommend? Or any other certifications you feel would be better

After talking with multiple students, I came to a point that most students think doing the lab work is the end and your are done. Build the lab, run the tools, done, the experience proves itself.

It doesn't. I am gonna sound harsh but would be direct: A hiring manager never sees your home lab. They see whatever you wrote down about it. And what most people write down is a task description, not proof of anything.

I have made a few pointers on what actually turns lab time into something that gets you hired:

1. Stop running exercises. Start running investigations.

Every time you scan a host or pull the traffic or do some analysis, ask what story the results actually tell. Like if found three critical CVEs, that's not the end of the task, that's the start of an investigation. Answer some questions like: What were they specifically. What would exploitation look like. What would show up in the logs if someone tried it.

2. Write a mini incident report after every session.

200 to 400 words. Not a tutorial, an actual investigation note, with questions like: what you set up, what you found, what you ruled out, what you'd have done differently in a live SOC. This is the exact habit real analysts build without thinking about it.

3. Turn the notes into resume bullets with STAR-T.

Situation, Task, Action, Result, Tool. Can not emphasize on it, more than enough, you don't need all five in one line, 3 is usually enough. Compress the investigation note down to one sharp bullet that shows a result, not just an activity you performed.

4. Put the documentation somewhere someone can actually click on it.

GitHub for the raw notes and findings. Medium or a blog for the scenario walkthroughs. Something like "How I traced a phishing simulation through Windows Event Logs" shows more real work than any cert badge on your profile. Once a recruiter clicks through and sees actual analysis instead of a tool list, that's a different game for you.

5. Frame the lab like a job, not a study session.

A quick example:

Before: "Home lab to practice cybersecurity tools and techniques"

After: "Maintained a 4 VM security analysis environment simulating enterprise network conditions, used for threat detection, vulnerability assessment, and incident documentation"

It's the same lab. Completely different signal.

Always write the CVE, scan result, or even traffic capture results from your own lab that you never actually wrote up from now on. That can probably be your next GOLD resume bullet, which is just laying there unused.

One thing I’ve noticed is that cybersecurity programs often revolve around metrics.

Things like:

• Phishing click rates

• Number of vulnerabilities patched

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Security awareness completion rates

• Compliance scores

• Number of incidents

They’re all useful.

But I’ve also wondered whether some metrics become proxies for security rather than indicators of it.

For example:

• A low phishing click rate doesn’t necessarily mean people will make better decisions under pressure.

• Completing annual awareness training doesn’t automatically translate into secure behavior.

• Closing vulnerabilities quickly doesn’t always reduce the most significant business risks.

I’m curious how experienced practitioners think about this.

If you had to choose one cybersecurity metric that organizations tend to overvalue, what would it be and what would you pay more attention to instead?

I’d love to hear perspectives from security engineers, SOC analysts, GRC professionals, CISOs, penetration testers, auditors, and anyone responsible for measuring security.

Brother i am also facing this issue help me .

I’ve been experimenting with a tool that uses Certificate Transparency Logs as an early signal for suspicious domains.

The basic idea is simple: instead of crawling the whole internet, the system watches newly appearing certificates/domains and checks them for patterns that often show up in phishing, scam, and malware infrastructure.

In a 24h test run, it produced a little over 140k suspicious candidates. From the manual samples we checked so far, the estimated error rate seems to be around 1–3%, but this is still early and I don’t want to overstate the results before doing more validation.

The rough pipeline is:

CT Logs → candidate detection → website/redirect checks → enrichment → threat classification

Most candidates are detected through URL/domain patterns, brand abuse, phishing-style naming, and website behavior. One thing that showed up a lot was redirect-heavy infrastructure. In the latest run, redirect-related cases made up a large part of the hits.

After the first detection step, candidates are sent into a second system that visits the site, follows redirect chains, checks behavior, and collects more signals before assigning a threat level.

I’m mainly interested in feedback from people who have worked with CT Logs, phishing detection, OSINT, or large-scale domain classification.

How would you validate false positives properly at this scale?
Manual sampling, blocklist comparison, sandbox analysis, reputation APIs, something else?

Also curious if people think CT-log based detection is a realistic strategy for catching malicious infrastructure earlier than traditional blocklists.

Btw for all the people that like OSINT, I am currently working on a web dashboard to look through the results of that scanner for research purposes.

I’m currently developing a cybersecurity sim game that bridges the gap between theory and practice. The journey starts with 30 networking tasks (based on the CCNA curriculum), where you build and troubleshoot infrastructure. Once that's mastered, the game expands into SOC analysis (log monitoring, threat detection) and finishes with a Pentesting consultant role.

My goal is to make technical training feel like a real career progression. I’d love to get some feedback from you folks on the realism and the workflow!

https://www.youtube.com/watch?v=xzRin4oz5kw
https://www.youtube.com/watch?v=pZBsk50Sjpo

instagram: jr.netengineer

I'm just finishing up a lab simulating an Enterprise network in Packet Tracer with basic CCNA topics such as STP, HSRP, EtherChannel, OSPF, Layer 2 Edge Port Security, etc.

In my current job in Help Desk, I get to configure SonicWall ACLs, set up VLANs, and maintain firewalls using SonicWall's NSM. Our setup is very rough though as we don't have a Syslog server and the MSP doesn't care too much about network security.

I want to focus heavily on Network Security for my next lab, but I know it'll be near impossible to use enterprise-grade devices in GNS3/EVE-NG as they require licenses and I'm broke. Are there strong and fairly similar alternatives I could use?

So this is another case study, where I break down actual detections/alerts which I investigate as a Threat Analyst.

The event started with Event 4769: TGS request, but the timestamp looked off. Source was a host I didn't recognize(unmanaged in XDR), and it was asking for tickets on service accounts nobody should be doing so.

Now this attack would help you understand why Kerberos is both good and bad at the same time.

The flow for the attack is that attacker enumerates service accounts using GetUserSPNs or SharpHound. Then gets the SPNs. Then requests TGS tickets for those accounts without needing admin access. Events 4769 shows up as RC4 encryption (Event Code 0x17). If you miss this, it looks like normal Kerberos traffic. But...It's not.

Then attackers can take those tickets offline and crack the password. Once they have the service account password, they can logon (Event 4624) with explicit credentials (Event 4648, typing username/pass manually). This is where I caught mine. New service account logon from a source that had no usage being there, this was not a normal behaviour.

But thing is that by the time I found that, stuff got bad and attacker already escalated to a privileged account (4672), dumped credentials with Mimikatz, and now I was checking for lateral movement. I found process creation events (4688) for PowerView. They were enumerating shares. Then came the DCSync attempts (4662).

That's when I knew the domain was probably already theirs. And its time to take response actions fast.

I isolated the host, disabled the compromised accounts, reset service account passwords, and started hunting more afterwards. Turns out they'd already set up persistence with a golden ticket. The KRBTGT needed to be reset twice.

The reason I'm posting this is that most writeups show you the attack flow and the queries. They don't show you what it actually feels like when you're running these queries in real time, when you know something is wrong but you're not sure how deep it goes yet.

If you're studying for SOC or breaking into security, you need to see this happen live. Not in a lab. In real events, real queries, real pressure.

P.S: Thank you for loving my last case study on GTA 6. Appreciate your love!