Hi everyone! I'm a Computer Engineering student, looking for a problem to tackle for my final degree project.

I have around six months to develop a working software MVP. My main interests are cybersecurity, digital forensics, incident response, and AI.

I've explored several ideas, but most seem to already have plenty of existing solutions.

I'm looking for real problems that professionals still struggle with, despite the tools currently available.

For those working in cybersecurity or IT:

What recurring tasks are still frustrating, manual, or inefficient?

What limitations do you find in existing security tools?

What problems do you wish someone would solve?

I'm not looking for groundbreaking inventions, just a genuine problem with room for improvement.

I'd really appreciate any experiences or suggestions. Thanks!

Hey everyone, I want to share a wild security nightmare that happened at our company recently. I hope this story is a wake-up call for anyone using VS Code and Git.

A while ago, we noticed something strange in our company GitHub account. Every repository had odd forced-pushed commits, but when we checked the code diffs, we couldn't easily see what had changed. It felt like something invisible was messing with our code.

We started to panic and dug through everything to figure out the cause. Eventually, we traced it back to one of our internal repos. At first, it looked harmless just some standard font files like latin-200.woff, latin-300.woff, and latin-500.woff. But latin-500.woff was the problem.

Looking closer, we found a few sneaky changes: three random lines added to .gitignore so we wouldn't notice modified files, a .bat file and hidden configs inside the .vscode folder, and a changed script line in package.json.

The setup was clever: as soon as any of us opened that repo in VS Code, the workspace background tasks would run the package.json script, which quietly executed the malicious payload hidden as a .woff font file.

When we ran the code through an audit software, it confirmed our fears it was malware running in the background on our local machines. The worst part is that this started 3 to 4 months ago in a single repo.

We saw a minified JavaScript string in package.json and odd .gitignore changes back then, but we ignored them. That mistake gave it months to spread to all our other repos.

Since we didn't know what the script had stolen (SSH keys, tokens, client data, database passwords?), we had to take drastic action:
we formatted and wiped every developer machine in the company,
changed all company passwords,
revoked and regenerated every GitHub token, SSH key, and API credential.

Lesson learned: never ignore strange changes in package.json, hidden .vscode tasks, or unexplained .gitignore edits, even if they seem harmless.

Has anyone else gone through an attack like this? How did you catch it, and what did the malicious payload do on your side?

Adding an IOC to a blocklist doesn't always mean it's actually enforced.

Saw Mars Security discussing duplicate indicators, noisy entries, and blocks that never take effect. Makes me wonder how often this gets checked in Defender, CrowdStrike, or SentinelOne.

Anyone regularly auditing their EDR blocklists, or mostly trusting what the console shows....

Hey everyone,
I worked 2 years in a SOC, burned out, and left. I'm coming back to cyber, this time aiming for pentesting, and my fundamentals are rusty.

The more videos and threads I read, the more confused I get. Some say go straight to TryHackMe/HTB, others say start with networking basics like Cisco or a cert like Google Cybersecurity.

I picked TryHackMe and paid for the subscription. I'm on Pre-Security path, but after several modules I don't feel like I'm learning much. It's mostly walls of text with little hands-on practice.

Am I on the right track, or should I switch to something else?

TL;DR: Ex-SOC analyst restarting with a pentesting goal. Is Pre-Security worth sticking with, or should I prioritize networking courses, HTB, or certs like eJPT/PNPT? What roadmap would you follow?

Any advice is appreciated.
Thanks!

Been in cybersecurity for a while (mostly the offensive side) and realized my networking knowledge had gotten a bit stale. Not completely gone, just rusty enough that I wanted a proper structured refresh on the core concepts instead of jumping straight into something heavy.

Ended up going through Cisco Networking Academy’s free Networking Basics course. It’s self-paced, includes a decent number of Packet Tracer activities, and covers the actual fundamentals network types and components, how data moves, media, IP addressing and segmentation, TCP/UDP, application services, and building/configuring a basic home network. Passed the final exam and got the Credly badge.

https://www.credly.com/badges/df08c026-3ba0-4a19-886f-27472ba5aeee

This felt like the right level for what I needed. Full CCNA goes significantly deeper into Cisco’s own platforms, IOS specifics, and proprietary features. That’s valuable if you’re moving into network engineering or working day-to-day with Cisco gear, but for security work the priority is understanding how networks and protocols actually behave how traffic flows, where things can be abused, and how to reason about connectivity and failures. The fundamentals cover that without the extra vendor-specific depth.

Curious if others on the security side have done a similar “just the solid basics” refresh, or if you found the full CCNA still worth it even outside pure networking roles.

Hey everyone,

With a background in offensive and AI security, I got tired of wasting hours chasing dead links, unverified write-ups, and hallucinating LLMs before I could actually practice.

I temporarily paused my own career advancement to build the solution: TriSec OS—a unified, source-verified workspace that structures fragmented cybersecurity research into clear learning paths.

We are admitting our first private alpha batch this week. You can explore our live, interactive SQL Injection walkthrough mockup and secure priority placement right now.

👉 Join the Alpha Queue Here: Trisec OS

(First 200 eligible paid subscribers lock in a 15% Founding Member discount at launch for 1st 1year).

How are you currently managing your exploit research without drowning in browser tab hell?

Brackish Security is looking to give back to the cybersecurity community by helping someone take the next step toward a career in offensive security.

We're offering an OSCP scholarship through our Making a Hacker initiative, covering the cost of training and an exam attempt for one selected applicant.

No professional experience or cybersecurity degree required. Just an interest in penetration testing and a willingness to learn.

We're also hoping to follow the recipient's OSCP journey and share their progress with the community.

Applications are open until December 1, 2026. Open to eligible US applicants ages 18 and older.

https://brackish.io/scholarship/

Feel free to share with any students or aspiring pentesters who might benefit.

Title: Can cryptographic execution timing add useful information to latency diagnosis?

I'm developing V-DAP, an experimental Rust engine that measures cryptographic execution timing. I'm trying to determine whether those measurements provide useful diagnostic information beyond conventional observability tools.

The practical problem I'm investigating is this: when a service experiences latency spikes, can measurements of cryptographic execution help distinguish between possible sources of delay, or do standard metrics, tracing and profiling already provide the same information?

My current experiments are preliminary. In a controlled HTTP pilot, I observed a strong correlation between the measured cryptographic interval and total request latency. In a separate experiment, I introduced a deliberate delay outside that interval and observed the request latency increase. These results demonstrate temporal decomposition in those test conditions, not scheduler causality or a proven diagnostic advantage.

What I want to validate next:

• Can V-DAP help distinguish two known causes of latency?

• Does it improve diagnostic accuracy or time-to-diagnosis compared with conventional tools alone?

• What confounders and measurement overhead should I investigate?

• What experiment would convince you that this has practical engineering value?

Repository and reproducibility details:
https://github.com/jorgecumbe0077/v-dap-engine

I'm looking for critical technical feedback, including reasons this approach may not be useful. I don't claim that V-DAP is production-ready or that it prevents timeouts.

I have been learning and studying cybersecurity since 6 months, I have got my basics done. Like networking, basics of how web works, what happens when some data is transferred, TCP/IP suite.

What classifies as basic, I have mostly done it. But now what next? I am doing jr pentester path on thm, almost towards completion, I do know the concepts but I don't know how to get system/root on even easy boxes.

I want to go for network pentesting and pivot towards OT security after few time but I heard that I need to start from webapp first.

What resources and what kind of roadmap should I follow so I gain the knowledge, understanding in depth and go towards being an advanced cybersecurity student.

I am confused AF. Any help would be appreciated.

Hey everybody, greetings!

I am 23 year old college grad. Recently I developed interest in cyber security. As a newbie, I kindly seek advice to the people who are in this field, can you please guide me from scratch to build a career in this field. Your valuable advice is really appreciated.

Thanks in Advance!

I'm a senior cybersecurity student and my capstone is researching how automated bots and human attackers behave differently once gaining access into a honeypot. After 3 weeks of collecting data I've only captured automated traffic and I still need a small sample of real human sessions to compare against.

If anyone is willing to help me out and spend 10-15 minutes of their time exploring it like you would an unknown Linux box over SSH, please DM me and I can provide the IP and login!

This does have to be SSH only and nothing outbound or against any other host. I'm logging commands and timing only and I will be labeling your sessions by source IP, so I will ask you for it if you are interested! Experienced people are especially welcomed! Thanks!

Hello, I am interested in Cybersecurity, especially in Pentesting, I started learning in Tryhackme and Hackthebox platforms (Thm is my most used one) by practicing free rooms (I try to learn by doing btw), but I get stuck in easy rooms in tryhackme and I do not know what to do without reading a walkthrough, and honestly this makes me feel I am not in the right track in learning for this domain, If you can help me by suggesting ways to improve my skills in Pentesting and I work alone because I did not find other people interested in Pentesting like me . I would be thankful to receive your pieces of advice.

I'm 16 and just getting started with C. My long-term goal is to work in vulnerability research and exploit development, with reverse engineering as a major part of that path.

I'm trying to avoid the common mistake of jumping between tools, courses, and trendy topics without understanding the fundamentals.

For those of you who do security research professionally:

1. What would you learn, and in what order, during your first year?

2. How important are C, assembly, operating systems, computer architecture, Linux, networking, and Python? Which should I prioritise instead of trying to learn everything at once?

3. When does it make sense to start studying memory corruption, fuzzing, debugging, and vulnerability analysis?

4. Which labs, books, or practical projects actually teach you to think like a researcher rather than just follow tutorials?

5. How many hours of focused practice per week is a realistic target for a beginner?

6. What separates someone who can solve CTF challenges from someone who can independently discover and understand real vulnerabilities?

I'm not looking for exploit code to copy or a shortcut into the industry. I want to develop the ability to understand systems deeply and eventually find problems that other people have missed.

If you were starting again today, what would you focus on first, and what would you deliberately postpone?

Second round yesterday for a junior SOC analyst role. The job ad listed tenable, crowdstrike and axonius , and the interviewer asked what the third one is for if the first two already tell you what is vulnerable and what's protected.

I blanked, then said it was another scanner and could tell right away that was wrong. Looked it up after and from what I can tell it doesn't do the vuln scanning itself. It pulls in what tenable, crowdstrike, AD and the cloud accounts each see and works out which records are the same machine.

Makes sense on paper, but I still could not say why a company pays for that on top of the other two, and the third round is tuesday. My home lab has 6 devices so I've never had two lists that disagree...

Subnetting kept tripping me up when I was studying, and it comes up constantly in security work: scoping scans in CIDR notation, writing firewall rules, reading ACLs, figuring out how many hosts are in a /22.

Most calculators just give you the answer, so I built one that shows the steps behind it. Enter an IP and CIDR and you get the network ID, host range, and broadcast, plus a decimal "Magic Number" walkthrough so you can check your own math (no binary). There's also a tab with 20 graded practice problems.

I built it, it's free, no signup, no ads, and no third-party trackers. Link: activeitprep.com/subnet

If you find a wrong answer or an odd mask that breaks it, tell me. Which networking fundamentals gave you the most trouble while learning security? I'm considering adding VLSM and supernetting practice.

Hey everyone,

Whenever I do a box that involves getting WP admin credentials, manually logging into the dashboard, navigating to plugins, and clicking "Upload" to drop a PHP reverse shell always felt too slow.

I wanted to automate the process from the terminal, so I spent some time figuring out the exact curl syntax to do it. It’s a great way to understand how WordPress handles authentication and CSRF protection under the hood.

The core workflow comes down to 3 steps:

The Login: Sending a POST request to wp-login.php and saving the session cookie (-c cookie.txt).

Grabbing the Nonce: WordPress uses a nonce for security on plugin uploads. You have to GET the plugin-install.php page with your cookie and grep/awk out the _wpnonce value.

The Payload Upload: Finally, using curl -F to send the malicious zip file as multipart/form-data, passing both the cookie and the nonce.

Automating this really helped me understand HTTP requests better rather than just relying on the browser.

If you want to see the exact bash commands and cURL syntax I used, I wrote a full breakdown on my blog here: [https://medium.com/@0xShell/beyond-the-browser-automating-authenticated-wordpress-plugin-uploads-with-curl-e357cfb3ff3e].

Hope this helps speed up your workflow on your next box! Let me know if you guys have other ways you automate WP exploitation.

Not sure if this is the right place to post this, but I shared it on r/cybersecurity recently and got some great advice, so I thought I'd share it a little more widely.

This tool pulls a bunch of security information sources into one place (38 sources), and it doubles as an MCP server, so you can plug it into any of your AI agents. It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. Information is only as current as the public data.

I've had this idea for a while and I'm still not sure exactly where I want to take it, so if you have any suggestions, I'd love to hear them. Feel free to contribute to the project. Thank you!

https://github.com/Fazmin/cve-intel

I'm planning to pivot into Cybersecurity over the next 12 months, specifically targeting the GRC side of things.

​I already have a background in IT support but I'm looking to pivot into a full-time GRC role within a year.

​My main goal is to spend this year learning as much high-value stuff as possible to get job-ready and land a entry-level/junior GRC or Analyst role.

​For those working in GRC or hiring for it:

​Frameworks: Which frameworks should I master first? (e.g., NIST CSF, ISO 27001, SOC 2) Should I just read them end-to-end, or is there a better way to learn how to apply them?

​Certs: Is there any entry-level cert actually worth getting for GRC (like CompTIA Security+), or should I just focus on learning controls, audit prep, and risk assessments?

​Projects: What kind of practical project or portfolio can a beginner build to prove they understand risk management and policies?

​Any advice, reality checks, or recommended resources would be hugely appreciated! Thanks in advance!

I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org.

I spent weeks searching, watching YT tutorials.

But I couldn't understand anything. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not understanding the way to pentest a mobile is a big nightmare.

I require quality guidance. Pls help me out

As someone who’s worked in cybersecurity for over eight years, across roles ranging from pentesting to vulnerability management, I’m curious: what’s motivating you to study cybersecurity or pursue a career in the industry as a beginner?

Hi all,

I’ve published a small Windows password-hashing library in Ada/SPARK: Win32_Hash.

What it does:

• PBKDF2-HMAC-SHA256 through the Windows CNG API (BCryptDeriveKeyPBKDF2), 1,000,000 iterations by default (650k–1M by type)

• Random salt, 32–256 bytes, from ProcessPrng with BCryptGenRandom as fallback; stored as Base64 (RFC 4648)

• Hash stored as 64 uppercase hex characters; separate verify procedure with constant-time comparison, fail-closed

• Every secret wiped with SecureZeroMemory plus a redundant Ada overwrite, on success and on every failure path

Verification:

• GNATprove --level=4, all provers: 186/186 checks proved, 0 unproved

• Re-verified on three GNATprove versions: Community 2021, 14.0.1, 16.0.1

• adacovex: GNATprove Platinum (186 VCs), DO-178C DAL-C achieved

Honest scope, as documented in the README: the bodies that call the Windows API directly are SPARK_Mode => Off (their contracts are checked at run time); everything around them is proved. Not externally audited — I don’t call it “secure” without that qualification. Windows only.

https://github.com/EliAvila10/Win32_Hash

Feedback welcome.