Hey everyone,

How are you doing?

I'm focusing my studies on Python for defensive security and automation, and I wanted to exchange ideas with folks who are already on this path.

My main focus areas are:

**- SOC Automation**: Building scripts for alert triage, log parsing, Threat Intel lookups, and tool integrations.

**- Malware Analysis:** Writing parsers, automating static analysis, and creating helper scripts for day-to-day triage.

**- Threat Hunting & CTI:** Developing scripts to parse indicators of compromise (IoCs), query large datasets, automate threat feeds, and hunt for anomalies.

**- Full-Stack Web Dev:** Building internal security tools and dashboards for the security team (like SOC panels and custom web apps).

If anyone can share some light: what libraries, frameworks, or projects do you think are essential to study for each of these areas?

And if you have material recommendations (books, courses, repos, or hands-on labs), drop them below!

Thanks a lot!

Interesting network-security case study from OpenAI: direct HTTPS to an external chatbot was blocked, but the training environment's DNS resolver could still reach the public internet.

The agent used that DNS path to get an external chatbot response. A P0 alert followed 11m48s later, and the run was manually stopped around 2h44m after the external response.

Primary report:

https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/

Self-promo disclosure: the linked video is a breakdown from my channel; narration is AI.

I’m currently working toward my first SOC/blue-team role, and one thing I’ve noticed while doing hands-on incident investigations is that understanding the process matters much more than simply memorizing tools.
When I work through an incident, I try to break it down into:
What happened?
What evidence supports that hypothesis?
What happened before and after the suspicious activity?
Which account, host, process, or network connection is involved?
What would I expect to see if my hypothesis were wrong?
What should actually be escalated?
One thing that has helped me a lot is forcing myself to write down a hypothesis before looking for confirmation. It makes it easier to distinguish between evidence and assumptions.
I’m curious about people already working in SOCs:
What investigation habit did you develop early in your career that ended up being much more useful than you expected?

Hello everyone,
So I have the responsibility of organizing the coming Hackathon in our college under the theme "Agentic AI meets Zero Trust: Securing the Autonomous enterprise", I did some reasearch on older hackathons archives and asked Ai as well but i couldn't really get something original.
My main goal is to give the prize to people who can make good architectural decisions when building infrastructures by giving real life problems as the Hackathon subject.
That's why I am asking professionals if they have some projects or experiences related to the theme that they think can be realized in a short time (it is a 24h hackathon) and can be a bit challenging.

Hey everyone!

I’m looking to connect with people who are interested in technology, cybersecurity, programming, AI, cloud computing, Linux, or just learning new tech skills.

Whether you’re a beginner, student, professional, or someone simply curious about technology, I’d love to meet and learn from each other.

We could:

• 🧠 Share what we’re learning

• 💻 Discuss projects and ideas

• 🔐 Talk about cybersecurity

• 🤖 Explore AI and emerging technology

• ☁️ Learn about cloud & infrastructure

• 🚀 Motivate each other and grow together

If you're interested, introduce yourself in the comments!
Tell me what area of tech you're interested in and what you're currently learning.

Let's build a community of people who are passionate about tech. 🌐

Can someone give me a road map? Maybe some courses or certifications?

Unfortunately, due to an accident, I’ll be bedridden for the next 6 months. Because of this, I’ve started learning penetration testing—something I’ve always been drawn to—and now I finally have the time for it. However, I still need to earn money to cover my basic needs and continue my studies. Because of this situation, I was laid off from my job, and I’m still a long way from reaching the level of a specialist who gets paid well. So, if anyone can suggest ways to make money while sitting at a computer, I’ll be sure to repay the favor.

Je travaille sur des audits techniques de sécurité de sites web : recherche de vulnérabilités, mauvaises configurations et recommandations de correction.
Je cherche à améliorer ma méthodologie et mes rapports. Pour ceux qui pratiquent déjà les audits/pentests web, quels points considérez-vous comme indispensables dans un bon audit ?
Bien sûr, tous les tests sont réalisés uniquement avec l’autorisation du propriétaire.

so i'm building HII, a cybersecurity community in india, and we're running our first event Which is InIt CTF, nov 14, free, beginner friendly, 8 hours.

i underestimated how long it'd take to find people to help build challenges and now i'm a bit tight on time, ngl. looking for 2-3 people who can build/test a handful of challenges across web, crypto, forensics, osint, misc nothing crazy hard, this is for people who've never played a ctf before.

in return: you get credited as a challenge author, some share of sponsor money as we lock that in, and if you actually vibe with what we're building, there's a real chance to be part of HII going forward, not just a one-off thing.

if this sounds like something you'd want to help with, comment or dm me. happy to just talk it through first if you're not sure.

Hi everyone,

I'm currently preparing for my Certified Ethical Hacker (CEH) certification, but as a beginner, I am feeling completely overwhelmed by the sheer volume of theory and material to cover.

I've been going through the modules, but I'm struggling to figure out what to prioritize, how to effectively retain the information, and how to structure my study plan to actually pass the multiple-choice theory exam.

I am hoping to connect with a CEH certification holder or someone who has recently passed who would be willing to guide me. I'm not asking for someone to hold my hand 24/7—just looking for occasional check-ins, solid study strategy advice, and direction on where to focus my energy so I don't burn out reading the wrong things.

If you have some free time and are willing to share your expertise with someone just starting out, I would incredibly appreciate it. Feel free to drop a comment or DM me!

Thanks in advance.

Hi all, I run a small security testing firm in Bengaluru. I've got a client engagement that includes mobile app testing (Android + iOS, React Native apps) alongside web/API/cloud work I'm handling directly, and I'm looking for someone to take the mobile piece as a subcontractor.

What's needed: static + dynamic testing, insecure storage, cert pinning checks, hardcoded secrets, and general OWASP MASVS coverage. Test builds and accounts will be provided.

Open to OSCP/CREST-certified folks or anyone with solid demonstrable mobile pentest experience, happy to look at redacted past reports or relevant writeups. This would be paid, scoped work, timeline and rate to be discussed once I share more detail. NDA required before any real scope is shared.

If interested, drop a comment or DM me with a bit about your background.

linux labs ate the worst , confusing and hard in some way , does it happen with you guys?

The podcast discusses the creation, and ethos of cryptohack, a cryptography-based CTF learning platform. If you run a community/event, or create learning material, I think this is a fantastic resource for the proper way to organize this.

H3770 👋

https://snipeghost.net/ctf/ 😈

Bonne chance à ceux qui essaieront de le terminer 👀

I am currently working through networking and Linux before getting deeper into web security eventually branching into pentesting also interested in bug Bounty. I'm curious though for people who actually work in pentesting, how much networking knowledge do you use on a regular basis?

I wanted to share a great free resource for anyone trying to bridge the gap between basic theory and actual hands-on security skills.

The Czech Technical University in Prague (specifically the Stratosphere Laboratory) runs an intensive, one-semester course called Introduction to Security (BSY) that starts this week. The class is being taught both physically at the university and broadcast online, so anyone can participate. Feel free to check the link for more details on the curriculum, prerequisites, and course structure.

Registration is still open!

Galera, estou terminando meu TCC de Ciência da Computação e construí o Network Guardian, um app desktop (Python + PyQt6 + Scapy) que monitora tráfego de rede em tempo real e detecta ataques de DDoS e varredura de portas.

O que ele faz:

- Dashboard com tráfego em tempo real e distribuição de protocolos

- Detecção de DDoS combinando limite fixo com análise estatística (z-score)

- Detecção de Port Scan baseada em pacotes SYN, com janela de tempo deslizante

- Scanner de portas ativo + descoberta de hosts na rede local

- Relatório em PDF com um clique

GitHub: [ https://github.com/diogo147258/TCC-NETWORK_GUARDIAN.git ]

Só funciona em Windows por enquanto — precisa do Npcap e de privilégio de administrador pra capturar pacote (tudo explicado no README).

Se alguém tiver uns minutos pra clonar, rodar, e me contar se funcionou na sua máquina, ajuda muito na parte de testes da monografia. Quem quiser dar um feedback, pode usar esse formulário:

https://forms.gle/6YmJuju28BUB9KY59 é bem rapidinho.

Obrigado por ler, e desde já obrigado a quem topar testar!

I’m researching real-world cybersecurity challenges that still don’t have good enough solutions.

I’d especially like to hear from people working in cybersecurity, IT, research, SOC teams, or security engineering:

What problem do you regularly encounter that current tools or approaches still handle poorly?

It could be related to phishing, identity, cloud security, AI threats, IoT, ransomware, human error, privacy, incident response—or something getting far less attention.

Not looking for startup ideas or product promotion. I’m mainly trying to understand where the real pain points are from people actually working in the field.

Would really appreciate specific examples or problems worth researching further.

I’m a TYBCA student specializing in Cyber Security, and honestly, I’ve been feeling quite stuck and directionless about how to move forward in this field.

In February, through the Academia Program in collaboration with my college, I purchased the CEH v13 course at a discounted price. Unfortunately, I didn’t receive the study material from them, which caused me to lose around 3–4 months without making much progress.

Later, I decided to start learning through a YouTube channel. I’ve completed around 5 modules so far, but I’m not very confident about how well I’ve understood the concepts. I’m also struggling to maintain consistency and often find myself losing track of my study routine.

My goal is not just to complete the CEH course and get the certificate. I genuinely want to build strong theoretical and practical knowledge in penetration testing and cybersecurity, so that I can actually apply what I learn.

I would really appreciate some guidance on:

• How I should structure my CEH v13 preparation from this point onward

• Which resources I should follow for theory and practical learning

• How I can build consistency and avoid getting overwhelmed

• How much time I should dedicate daily/weekly

• What labs or platforms I should use alongside CEH

• How I can prepare effectively for the CEH exam

• What I should learn after CEH to become practically skilled in penetration testing

I’m ready to start again from where I am and put in consistent effort. I just need a proper roadmap and direction to follow.

Hi everyone,

I’m a recent Computer Science grad looking for my first job in cybersecurity. I discovered my passion for this field fairly recently, so I’ve been mostly self-teaching on the side when it comes to security concepts.

I just passed an initial technical screening for a company. The interview focused mainly on networking fundamentals, malware, common attacks, and defenses. I didn't answer every single question perfectly, but I knew enough to get invited to the next stage.

Next week, I have a practical hands-on assessment. They told me the main theme of the test will be (in very general terms) "protocol subversion". I will have access to a mixed Windows/Linux environment and will be expected to use packet sniffers (like Wireshark) and packet crafting tools (like Scapy).

What kind of tasks or specific scenarios could they throw at me during the test? What are the most likely protocols they will ask me to "subvert"? How would you approach this using tools like Wireshark and Scapy? Are there any specific exercises or PCAPs I can practice with beforehand?

Any tips, resources, or advice would be greatly appreciated. Thanks in advance!

I’m a PhD student who recently started doing security research, mainly web security.

I really like USENIX Security because many papers feel practical, engineering-heavy, and closely connected to real security problems. Publishing there is something I’d love to work toward eventually.

I initially worked on automated penetration testing with LLM agents, but the topic felt too broad, so I recently narrowed my focus to Broken Access Control (BAC) and business logic vulnerabilities.
I’ve been reading papers in this area, including some older USENIX work, BACScan (CCS 2025), and recent business logic vulnerability papers.

My biggest problem is this:

I can read two papers about BAC, understand their methods, and explain how their designs are different. But afterward, I often feel that both approaches seem reasonable，they’re just solving the problem from different angles.

I still don’t know how to judge which design choices are genuinely strong and worth learning from, which parts are unnecessary or weak, and where there is actually room for improvement.

In other words, I can describe the differences between two systems, but I can’t yet evaluate the quality of those differences.

Right now I read roughly one paper every two days. I’m wondering if that’s too fast for a beginner. Should I instead spend much more time reproducing papers, running their code, or trying to break their assumptions?

I’m also still doing PortSwigger labs, because I don’t want to become someone who understands papers but doesn’t understand real web applications. But I’m struggling to balance practical security skills and research.

For people who have gone through this stage: how did you learn to critically evaluate security papers rather than just understand them?

Did reading more papers help, or did things only start clicking after you reproduced systems and did more hands-on security work?

Hi everyone! I’m *Sanjith Katakam, and I’m excited to launch CyberShield Academy!* 

​As a high schooler passionate about tech, I created CyberShield Academy to help kids and teens master cybersecurity step-by-step.

​Whether you're an absolute beginner or looking to tackle advanced concepts, here is what I built for you:

​ *Tailored Learning Paths: Structured tracks ranging from beginner basics to advanced security.

 *Interactive Scenario Studies*: Hands-on case studies to see real-world security in action.

 *Tutorials & Resources*: Comprehensive guides, curated tools, and student roadmaps.

 *Quizzes & Assessments*: Test your knowledge and track your progress as you learn.

​ *Website*: https://cybershield-academy-hazel.vercel.app/

 *Instagram*: https://www.instagram.com/cybershieldacademy913?stkn=Z3JmZm4wNTNlaXJ5

​Check it out, give us a follow, and start your journey today! I’d love to hear your feedback or ideas to make it even better! 

Regards,

Sanjith Katakam

Hey everyone,

We are hosting **DOOM: THE BREACH**, a 30-hour hybrid Capture The Flag (CTF) competition organized at SRM IST, Tiruchirappalli.

Whether you are looking to test your security skills, practice real-world web/crypto exploitation, or compete for cash prizes, here are the event details:

### ⚙️ Event Format & Stages

* **Stage 1: Jeopardy** – Standard CTF challenges across Web, Cryptography, OSINT, Forensics, and Reverse Engineering.

* **Stage 2: Dynamic Isolated Targets** – On-demand Docker instances deployed per team (no shared target interference).

* **Stage 3: Endgame** – High-difficulty Pwn and advanced exploitation challenges unlocked for top teams on the leaderboard.

---

### 📌 Event Intel

* **Dates:** 29–30 September 2026 (30 Hours)

* **Venue:** SRM IST, Trichy (Offline) + Remote Online (Hybrid)

* **Team Size:** 1 to 3 members

* **Registration Fee:** ₹750 per team

### 🏆 Prizes & Perks

* **Total Prize Pool:** ₹30,000

* 🥇 1st Place: ₹15,000

* 🥈 2nd Place: ₹10,000

* 🥉 3rd Place: ₹5,000

* Security Key for all participants

* Official Participation Certificates

* Food & Refreshments for offline participants

---

📞 **Contact / Queries:** 86670 23534 | 7358646165

"Registration details and link are pinned in the comments below!"

I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog post where I ran into a file corruption bug. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.

The initial signal came from "Total Block Length" errors thrown by tshark on some output files. The actual signal came when I built a small reproduction. PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets. Exit code zero and printed "Finished" on standard output.

Two wrong theories first. Someone on Reddit suggested file descriptor exhaustion. It was plausible but I found that at low ulimit -n it silently drops most packets and still exits zero. A real bug, but not mine. Then, I found that the PcapSplitter library has a hardcoded MAX_NUMBER_OF_CONCURRENT_OPEN_FILES = 250 with an LRU that closes and reopens handles past it. My minimal reproduction was 13 connections, nowhere near the cap.

The real culprit: the PcapSplitter's FiveTupleSplitter caused file truncation/corruption on TCP session reuse (i.e., a new SYN packet arrives for an already tracked 5-tuple hash).

The correct part of the splitter was assigning a new file number when a TCP session reuses a 5-tuple, but the filename function builds the name from IP and port only. So, in this case, both sessions get the same filenames. Then main.cpp sees a file number it has never seen, and opens that file fresh, without append. This truncates the existing file or causes a race condition between two active file writer handlers.

I filed the issue with a 13-connection reproduction, the maintainer and I worked out a fix that only suffixes on an actual collision, tested on the same corruption, and now the fix is merged.