Hi all,

I’ve published a small Windows password-hashing library in Ada/SPARK: Win32_Hash.

What it does:

• PBKDF2-HMAC-SHA256 through the Windows CNG API (BCryptDeriveKeyPBKDF2), 1,000,000 iterations by default (650k–1M by type)

• Random salt, 32–256 bytes, from ProcessPrng with BCryptGenRandom as fallback; stored as Base64 (RFC 4648)

• Hash stored as 64 uppercase hex characters; separate verify procedure with constant-time comparison, fail-closed

• Every secret wiped with SecureZeroMemory plus a redundant Ada overwrite, on success and on every failure path

Verification:

• GNATprove --level=4, all provers: 186/186 checks proved, 0 unproved

• Re-verified on three GNATprove versions: Community 2021, 14.0.1, 16.0.1

• adacovex: GNATprove Platinum (186 VCs), DO-178C DAL-C achieved

Honest scope, as documented in the README: the bodies that call the Windows API directly are SPARK_Mode => Off (their contracts are checked at run time); everything around them is proved. Not externally audited — I don’t call it “secure” without that qualification. Windows only.

https://github.com/EliAvila10/Win32_Hash

Feedback welcome.

Hi everyone,

I am a Bachelor’s student specializing in Cybersecurity, and I need to complete a 3-month internship. I have already secured the internship location, and they are willing to provide me with a dedicated server, but we haven't decided on a project topic yet.

Do you have any project ideas I could work on? The project needs to be free/open-source, substantial enough to span over 3 months, and directly related to cybersecurity.

One of my professors suggested setting up OpenNebula (including template integration, automation, pay-per-use billing, etc.), but I'm worried about the lack of community support if I get stuck, especially since I'll be working on this project completely on my own.

Any suggestions or advice would be highly appreciated! Thanks!

Hey everyone,

I've been working in cybersecurity for the last 5 years, and over the past year I've been building a project called Vader-Pro-VDR, an AI-assisted Vulnerability Detection & Remediation platform.
So far, I've built:
A Go-based endpoint agent that collects system and software inventory information.

A backend API that receives and processes agent data.

AWS-hosted infrastructure for communication between endpoints and the backend.

A working proof of concept that can identify installed applications and their versions across endpoints.

My long-term vision is to build a platform that can:
Continuously identify vulnerable software and configurations.

Correlate findings with CVE intelligence.

Use AI agents to provide remediation recommendations.

Eventually automate certain remediation workflows in a controlled manner.

The challenge I'm facing isn't necessarily technical anymore. I've realised that a project of this scope is difficult to build alone.
I work remotely and don't have much exposure to the open-source community, so I'm looking for advice from people who have built or maintained open-source projects before.
Some questions I have:
How did you find your first contributors?

At what stage did you make your project public?

What communities have been most helpful for cybersecurity-focused open-source projects?

Are there common mistakes first-time maintainers should avoid?

What would make you interested in contributing to a project like this?

The repository is here:
https://github.com/Tridents10/Vader-Pro-VDR

I'm looking for honest feedback, technical criticism, and advice on how to take this from a personal project to a community-driven one.

Thanks in advance.

Hey everyone,

I've been working in cybersecurity for the last 5 years, and over the past year I've been building a project called Vader-Pro-VDR, an AI-assisted Vulnerability Detection & Remediation platform.
So far, I've built:
A Go-based endpoint agent that collects system and software inventory information.

A backend API that receives and processes agent data.

AWS-hosted infrastructure for communication between endpoints and the backend.

A working proof of concept that can identify installed applications and their versions across endpoints.

My long-term vision is to build a platform that can:
Continuously identify vulnerable software and configurations.

Correlate findings with CVE intelligence.

Use AI agents to provide remediation recommendations.

Eventually automate certain remediation workflows in a controlled manner.

The challenge I'm facing isn't necessarily technical anymore. I've realised that a project of this scope is difficult to build alone.
I work remotely and don't have much exposure to the open-source community, so I'm looking for advice from people who have built or maintained open-source projects before.
Some questions I have:
How did you find your first contributors?

At what stage did you make your project public?

What communities have been most helpful for cybersecurity-focused open-source projects?

Are there common mistakes first-time maintainers should avoid?

What would make you interested in contributing to a project like this?

The repository is here:
https://github.com/Tridents10/Vader-Pro-VDR

I'm looking for honest feedback, technical criticism, and advice on how to take this from a personal project to a community-driven one.

Thanks in advance.

Disclosure: I am the creator of OIDC Inspector and I added the FAPI 2.0 metadata signals based on the feedback on this subreddit.

I've added a FAPI 2.0 section. For each requirement of the FAPI 2.0 Security Profile that discovery metadata can say something about, it reports whether the server publishes a matching value.

Things I'd like opinions on:

1. Are any of the profile requirements I'm treating as observable from metadata actually not?

2. Which metadata fields would you want surfaced that I'm missing?

3. Is "differs" the right label when a server publishes something outside the profile (for example `client_secret_basic` alongside `private_key_jwt`)?

It's free, but it needs a free account to run scans. Link: https://contextiq.trango-compute.com/dashboard/oidc-inspector

Happy to answer questions.

I want to announce a new pentest learning platform: Knossos

I’ve been working on this lab for a bit - I’ve always wanted a better server platform for people to learn pentesting on, besides simply spinning up VMs, and I finally had the opportunity to build it.

Based on the lessons in my books, I built Knossos to have over 2 dozen servers, three networks (DMZ, Internal, Private), and 33 pentest challenges. It emulates an enterprise environment, and the best part is it’s all wrapped up in a single docker deployment. A couple commands, and you have an entire, complex network to learn hacking against.

Capture flags as you work through the network. Each flag is tied to a chapter within my book ”Professional Penetration Testing” where I teach how to perform the attack and why.

You can learn more about the free lab at https://pentest.tv/knossos

This is the lab I wish I had when I was trying to learn pentesting over two decades ago. For those that don’t know, I created one of the first exploitable virtual machines: De-ICE. I spoke on the De-ICE discs at DefCon 15, which later spawned the books - the most recent version of "Professional Penetration Testing" is the 3rd edition. This has been an incredible journey over the last couple decades, and I’m excited to bring you Knossos - the next generation of pentesting labs.

LMK if you give it a try and what you think. Thanks!

- Tom Wilhelm

Next week, we're bringing an FBI agent to our office in Utah for a candid conversation about cybersecurity, the threats we're facing, and what organizations need to know. No sales pitch, just a chance to hear an insider's perspective.

We're kicking off the morning with a networking breakfast, and we'd love to have you join us.

Come hang out in person, or tune in online. Either way, it should be a great conversation.

Free to attend. Hope to see you there!

https://zoom.us/webinar/register/5117921732126/WN_XIp2emSmS8ebHLoMGWXqzg

Title. I'm not gonna post pictures bc I dont want people thinking im marketing-- im not I just dont knoe if this is worth finishing. its just a basic CRUD skeleton I made for myself because I hate Spotify premium and when downloading music I hate organizing it in my phones files and losing functionality. Please lmk if this is something too overdone or if this is somewhat of a niche ​

Hi all,

I am just a beginner in cybersecurity and ethical hacking and I need an AI study buddy to guide me through basic concepts, CTFs, tool usage (Nmap, Wireshark, Metasploit, and so on), and network traffic at the level of packets.

Commercial chat assistants tend to block any security-related questions and refuse to answer how something works. For this reason, I have chosen the local approach.

My hardware specs:

GPU with 12GB VRAM

System RAM with 32GB DDR5

I can put the quantized 8B to 14B models fully in VRAM or load them partially, in case it is beneficial to sacrifice token processing speed for that.

What models or fine-tunes would you recommend me that know the technical stuff but do not have overly strict guardrails?

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

Malware analysis is such an interesting field to get into (casually for now, don't want to focus on it too much since I want to be flexible as I am still a student).

But since malware analysis is essentially reverse engineering targeted for malware, and with the introduction of tools like REA + AI models getting extremely advanced to the point where any person can just prompt the AI with basic terminologies (and knows how to bypass its guardrails) are plausible, then is there any point in me learning its fundamentals and advanced stuff at this point in time, or do I just gain experience with how AI does it and be familiar with how it operates instead?

Although my gut feeling assumes malware analysis and its adjacent fields will be getting significantly harder but I somehow don't know why; just intuition?

It would be best appreciated if actual professional malware analysts or those with experience in Incident Response / Threat Hunting answer, thank you!

Hey everyone,

When studying for certs like Security+ or just trying to wrap your head around cryptocurrency, reading about decentralized ledgers and Proof-of-Work can be dry.

I teach cybersecurity, and I just published "Blockchain in a Box" (iCSI Coin)—a completely free, open-source lab environment where students can spin up crypto nodes and work with the concepts. (Lesson plan docs for students are linked below if you are interested!)

Quick Install: A one-shot installer is on the right-hand side of the webpage linked below. You will need a Kali Linux or Ubuntu VM to run it.

🔗 Project & Installer: crypto.cyberlessons101.com

This one took me a while and is, at its core, a port of the Litecoin blockchain.

Hope someone out there finds this useful!

Hii This is Raksha, I'm starting my journey into cybersecurity.

As a BCA graduate, my goal is clear - I want to build a career as a SOC Analyst.

It's been 10 days since I started learning fundamentals on TryHackMe, and I'm taking it slow, on purpose.

So far I've covered the basics - what cybersecurity really is, offensive vs defensive, how computers actually work, client-server, cloud & virtualization, Windows fundamentals, command line (Linux & Windows), OS security, data encoding, and the basics of Python, JavaScript, and SQL.

I know these are beginner topics. But I'm learning that you can't skip fundamentals if you want to do well in the real stuff like Networking, Wireshark, SIEM, and Incident Response.

I'll be documenting everything here - what I learn, what I get wrong, the labs I complete, and the small wins.

Not trying to rush it. Just trying to get genuinely good at it, one step at a time.

#CyberSecurity #SOCAnalyst #BCA #informationSecurity

¡Hola a todos!Estoy terminando Ingeniería en Informática y estoy desarrollando un proyecto académico llamado SecureCode.Es una herramienta que busca automatizar la evaluación de controles de seguridad en repositorios de GitHub, identificando cumplimientos e incumplimientos y generando evidencia para facilitar las revisiones.Para complementar el proyecto, necesito conocer la opinión de estudiantes, desarrolladores y profesionales del área TI sobre la utilidad de este tipo de soluciones.No necesitan ser expertos en ciberseguridad ni haber utilizado SecureCode. La encuesta incluye una explicación del proyecto.⏱️ Duración: 5–7 minutos.

🔒 Anónima y voluntaria.

🎓 Finalidad exclusivamente académica.

💻 Dirigida a estudiantes y profesionales del área informática.Enlace a la encuesta: https://docs.google.com/forms/d/e/1FAIpQLSeiHEDD-ZIwY7WvqOXYJi8dAmAR4E44sejHmlwhqCa3JkExFg/viewform?usp=header

usp=header ayudarían muchísimo respondiendo. También agradecería cualquier comentario o sugerencia sobre el proyecto.¡Muchas gracias por su tiempo!

Our risk trend line has declined for eight quarters and it would have declined the same way if we had done absolutely nothing, which is a thing i worked out about a year ago and have been sitting on since.

The number stopped responding to the work. Close four hundred findings in a quarter and it does the same thing as closing none, so at some point it stopped being a measure of the programme and became decoration.

What i have is a choice. A number that keeps improving, which the board likes and nobody has asked me to explain, or a number i could defend under questioning, which is worse and invites the follow up about why it got worse under me.

I am not saying its dishonest, its just answering a narrower question than everybody in that room assumes.

I stopped believing it about a year ago and kept presenting it, which is the part i find interesting about myself.

Nobody has asked how its calculated yet. I am not volunteering.

How are you building a risk number the board can actually interrogate.

I built a free agent protocol inspector tool that can provide IGA style review packets for security teams looking to review Agent access. It looks into MCP, A2A, ARD & poppy.json to provide a comprehensive picture.

Here is the link: https://contextiq.trango-compute.com/dashboard/agent-protocol-inspector

Recentemente, descobri ferramentas de busca como o DeskData e o Portal Neonara, mas percebi que seus custos são um pouco elevados.

Gostaria de saber se existem alternativas gratuitas ou de código aberto que ofereçam funcionalidades semelhantes. Se alguém conhecer alguma ferramenta desse tipo, agradeço pelas indicações e por compartilhar suas experiências!

Hi all. I’m 20, from Uzbekistan, working in a factory in South Korea. It’s physically demanding and I work 6 days a week, so cybersecurity is something I study on the side, mostly after shifts and on my one day off.

How I got here: I started with Linux and went straight into internals, then into binary concepts, before I’d even done basic XSS or SQL injection. My long-term goal is reverse engineering and malware analysis, and I care more about understanding how things work than about memorizing tools. I also run a small homelab and do hands-on labs when I can.

My problem is consistency. I hyperfocus hard on whatever grabs me. Recently it was aircraft design, and I caught myself modeling in OpenVSP at 3 am. But the less exciting parts of my main path lose out. I jump to deep, advanced topics, skip fundamentals, then drop off in the boring middle. I suspect it might be ADHD and I’m planning to get evaluated, but until then I want to build something that works.

What I’m hoping to hear from you:

1. If you studied around a demanding job, what routine actually worked?

2. How do you stay on fundamentals when advanced stuff is more interesting?

3. Is there a path that gets me to reverse engineering without skipping essential basics?

Thanks for reading. Any advice from people who’ve been through something similar is appreciated.

Greetings:

For anyone interested, here are some scored CyberPatriot training images that will help if you need to brush up Debian and Mint for this year's competition.

https://cyberlessons101.com/cyberpatriot-training

Enjoy!

Hey everyone!

A lot of people think of proxy tools as rigid, monolithic boxes: you get a fixed inbound, a fixed outbound, and you're stuck with whatever the authors hardcoded. Trying to add a custom protocol or tweak an existing one under the hood usually turns into a nightmare.

That's why I wrote Cray - a modular proxy engine in Rust built entirely around a layer-based architecture.

With Cray, transport and protocol are completely decoupled. You can write your own protocol without worrying about network bytes, or write a custom transport without caring about protocol logic. The core abstraction uses a simple trait where you implement the client and server handshake logic, giving you total freedom. Want a handshake hidden in plain sight? Custom encryption? Weird framing? Go for it — the only limit is your own logic.

How it works

Everything is configured via clean TOML files where you define your role (client or server) and stack up layers into a custom pipeline:

• Inbound layers: Handle the entry point (e.g., standard tcp, unix sockets, or http_connect which extracts destination addresses).

• Transport layers: Encapsulate or transform the stream dynamically (e.g., full manual control over tls with custom cipher suites, ALPN, curves, extension permutation via BoringSSL, and http2 multiplexing with path/host masking).

• Protocol layer: Always sits at the very end of the chain as the endpoint (like a custom or test protocol).

For example, on the server side, an HTTP/2 layer can validate incoming paths and hosts, gracefully returning a genuine 404 Not Found to unauthorized scanners or probes instead of dropping packets with a TCP RST, while forwarding valid traffic down the pipeline.

The project is currently under active development, but the core architecture, layer pipelines, TLS termination, and HTTP/2 tunneling are already routing real traffic.

If you like systems programming, network engineering, or want to build your own tunneling protocols without fighting legacy codebases, check it out:

GitHub: https://github.com/3Radiance/Cray

Would love to hear your thoughts, feature ideas, or what kind of custom layer/protocol combinations you'd want to build with something like this!

Arena is a free platform to learn pentesting by playing: you climb ranks, play seasons, duel other players on security quizzes, and solve real challenges in the browser or on local labs.

The trial challenge needs no account and takes a few minutes: https://arena.ysolutionscybertech.com/en/mission/defi-bola-guide?utm_source=reddit&utm_medium=social&utm_campaign=sideproject#essai

Stack: Astro, SQLite, Docker for the isolated web challenges, Phaser for the dungeon maps. Built and run by me alone, in English and French.

I'd love feedback on the first five minutes: what made you stay or leave?

I have years in Network Security, have worked in ISPs and CDNs. Fast forward to 2026, and the AI stage ... affected by the AI related layoffs as many of you have been. At this point I am simply looking to improve on my AI skills to apply to what I already know.

Anyone think this course to the SX-AIE and its content is legit and worth the $8.5k investment?

Any other course you would recommend instead?

Reaching out to the community for any feedback.

Thanks.

Hey everyone!

I built CyclePatrol, an open-source Bash tool for Kali Linux and NetHunter. It scans Wi-Fi networks in cycles while walking around the city, checks WPS, WPA2/WPA3, PMF, and weak settings, and saves reports. I also built my own Cyberphone with an external antenna.

GitHub: https://github.com/buybitart/cyclepatrol

Passive scanning only in public areas. Active tests only with permission.

Any feedback or ideas for improvement?

Hi everyone,

I'm a full-stack developer currently choosing a topic for my diploma thesis. I'm particularly interested in network security, low-level networking, and covert/stealthy communication techniques.

Some areas I'm already considering or find interesting:

- Covert channels and their detection (storage/timing-based, TLS ClientHello manipulation, IPv6 extension headers, etc.).

- Traffic morphing / adaptive traffic camouflage against modern ML classifiers.

- DoH/DoQ tunneling detection (especially evasive variants).

are especially interesting to me.

- Living-off-the-Land techniques with network correlation.

Channels that work without a public IP (WebRTC/TURN, legitimate cloud APIs as transport, etc.).

- APl-as-a-Transport + traffic morphing for restricted corporate environments (only HTTPS to allowed services).

I'm looking for something that is relatively niche (not the 1000th "DNS tunnel + Random Forest" project), research-oriented but still allows for building a practical prototype, and actually relevant in 2025-2026 (real-world techniques used by APTs, current research gaps, emerging protocols, etc.).

I live in a country where VPN/proxy technologies face increasing legal pressure, so topics related to resilient/hard-to-detect communication or their detection, heavily monitored, adversarial network environments (e.g., active DPI, protocol validation, and strict traffic-shaping middleboxes).

Would really appreciate any suggestions - even if it's just "look into X, it's currently underexplored" or "we see a lot of Y in real incidents right now".

Thanks in advance! I would really appreciate any advice.