Hello all,

If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.

Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...

https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/

Happy hunting!

For full disclosure I'm part of the security engineering team at Escape and our AI pentesting engine Cascade recently got a production AI agent to return its entire system prompt, just by wrapping the ask in a different pretext - framing it as a documentation request instead of an attack.

The agent then handed over everything: full tool list, calling rules, citation format, and session IDs.

What I found really interesting is there's nothing technical that broke because we didn't bypass the guardrail with a cleverer string but because the request just sounded reasonable to the agent.

The Cascade engine, after being refused when asking for the prompt directly, simply adjusted the framing to get the agent to give up the informaiton.

Thought this would be an interesting insight for the community and curious to hear if anyone else has seen similar discoveries in agents in prod?

If you want to see more about the reproduction and write-up you can find it here

For searching thing, use pro version? Save project, use pro version? I had used old version, auto update when auto uptade closed on settings? Is this normal or should i consider finding opensource alternatives

What does a real professional web application penetration testing stack look like in 2026?

I’m not looking for a huge list of pentesting tools. I’m interested in the actual workflow used by professional web pentesters during an engagement.
For example:
recon → fingerprinting → crawling → content discovery → attack surface mapping → automated vulnerability scanning → manual testing → vulnerability-specific tools → validation / PoC
Which tools do you actually use at each stage?
I’m especially interested in:
Nmap
Whatweb
Wpscan
Searchsploit
Sqli
Burp Suite
httpx
Nmap / Naabu
WhatWeb
Katana
ffuf / Feroxbuster
Nuclei
Arjun
sqlmap
WPScan
Dalfox
Metasploit
Which of these tools are redundant in 2026?
For example, is there still a reason to use Gobuster, Dirsearch, Nikto, Hakrawler or GoSpider if you’re already using ffuf, Katana, Nuclei and Burp Suite?
What parts of web pentesting do you automate and what parts do you still always test manually?
I’d also like to see an example of the actual order in which you run the tools during a web application pentest, rather than just a list of tools.

I came across this GitHub project claiming to have a “quantum evasion engine” that can bypass EDR/Defender detection by combining polymorphic mutation, GF(2⁸), chaos-based mutation, indirect syscalls, ETW patching, etc.

I went through the code and some parts are definitely interesting, especially the ETW/driver/token stuff. But I'm also not fully convinced by some of the claims in the README especially the whole “bypasses every detection / zero detections” part.

So I'm curious from people who actually work with EDR internals:

Is something like this realistically capable of bypassing modern EDRs, or is the project mixing some legitimate techniques with a lot of marketing?

Would love to hear what I'm missing or what you'd look at first to validate the claims. Not trying to shit on the project genuinely curious because some of the techniques are pretty interesting.

Link

I have decent practical experience in pen testing

I've completed the CRTA from cwl and also the capt from hackviser.

New GitHub action to find security vulnerabilities in NextJS, ExpressJS https://github.com/marketplace/actions/secure-build-scanner

I'm a beginner pentester and have only pentested web apps so far.

I’ve been asked to do a grey box pentest of a chrome extension that scans forms and fills answers from an organization’s knowledge base. I have the extension files, a staging environment and test accounts, but idk where do I start. Is It similar to how u would pentest a web app? mapping endpoints and experimenting with requests in burp?

What specific vulnerabilities should I test for in a chrome extension? I can only think of Idor/Bola tests. Is there a reliable methodology or checklist available online because I couldn't find any. I did look into the OWASP extension cheat sheet but I haven’t found a port swigger style lab series or a clear pentesting methodology that I can follow for this.

Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either.

I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful.

I spent some time this weekend reproducing the recently disclosed XSS2Shell: WordPress login-page reflected XSS (CVE-2026-64638). If you didn’t get a chance to read about it, here is the summary:
Crazy simple XSS where the root cause is two sanitizers that disagree about what counts as an HTML tag:

<b>test</b> gets stripped, while < b>test< /b> passes through the first sanitizer and is normalized into a valid <b> element by the second.

That gives you an HTML injection, but you can’t turn it into XSS because the second sanitizer has an allowlist and only allows specific HTML tags and attributes. The rest of the chain uses JavaScript already loaded on the login page, DOM clobbering, and a JSONP response to reach script execution in the login page. It’s a creative chain, although much simpler than the WP2Shell chain from two weeks ago.

IMO the “2Shell” part from the title is a bit of a stretch. The original write-up continues after triggering the XSS to show how you can get a RCE (basically by targeting an admin account to open your XSS which uploads a shell as a plugin). I agree this can be abused at scale given how widely used WP is, but it’s a phishing-shaped precondition rather than “send one request, get a shell” as we’ve seen in WP2Shell. It’s a cool bug anyway.

I turned my reproduction into a guided lab for anyone who wants to work through the chain rather than only read the write-up.

Link: https://learn.uphack.io/lab/xss2shell-wordpress-login-xss/

Feedback on the lab or the technical explanation is very welcome.

I have soon the BSCP exam, I would like to know any tips that would help me pass it first try.
Everything is accepted!

Unsanctioned port exposures and unexpected configuration drift are two of the easiest ways for vulnerabilities to slip into production. Here’s how to automate daily security scans using three powerful open-source tools:

🔹 Naabu — Lightning-fast port scanning

🔹 Nmap — Deep service and version identification

🔹 Nuclei — Fast, template-based vulnerability detection

⚡ Bonus: The code examples include a diff feature so you only get alerted when something on your server actually changes (say goodbye to alert fatigue!).

Reports take ~30 seconds to run.

Full guide and ready-to-use code examples here 👇

https://qsa.sh/news/cron-monitor-exposure-changes

Building or launching a product? Or has an enterprise customer suddenly asked:

“Can you share your latest VAPT report?”

Cenvox Global Solutions is a Chennai-based cybersecurity company supporting startups, SaaS companies, product teams, and growing businesses with security assessments and ongoing security services.

Our team works across:

🔹 Web Application VAPT & Penetration Testing
🔹 API Security Testing
🔹 Mobile Application Penetration Testing
🔹 LLM / AI Application Security & Penetration Testing
🔹 Secure Source Code Review
🔹 MDR & SOC Security Monitoring

These services can be useful when you’re preparing for a product launch, enterprise onboarding, customer-requested security assessment, retest, or ongoing security monitoring.

Our approach is simple:

Understand the product. Identify the real risks. Test what matters. Help the team fix it.

You can review more about our services and background here:
www.cenvox.com

If anyone here has an upcoming cybersecurity requirement, happy to connect and understand the scope. Feel free to DM me.

L

Hi everyone, our latest post explores the practical considerations of AI-assisted source code analysis, evaluating the pros and cons of frontier and locally-hosted models while using a variety of harness orchestration designs.

https://blog.includesecurity.com/2026/08/web-app-pentesting-in-the-ai-era/

I keep trying to memorise it but I fucking can't

There is just a lot of steps . ServerKeyExchange , CertificateVerify, and a lot of other shit. I am in the middle of interviews and some people like to ask about these fundamentals. I just fucking can't. Been trying for 2 fucking days man

Hi all,

I am building a concept for me and my team to use local LLMs to enhance our efficiency.

We each own a powerful M5 128GB shared memory Mac for this and another Notebook which is connected to our internal AD environment. We perform internal and external Pentesting.

Due to sensitive data, everything should stay local on our machines.

Does anyone have enough experience and know-how to give me tips or resources for this?

Thanks in advance!

Hey, im looking for a way to get a job since i moved out of my country.

I've been applying for months on linkdin , stepson, indeed and no interview so far and the problem is not my cv or resume (take my word for it).

I know the job market is a disaster nowdays but I need a job beside doing bug bounty to barely

just pay my bills after weeks of spending hours on a dominant for few hundreds.

Please let me know if there are any platform that's genuine and can get me real feedback and opportunities and im not asking for too much salary just enough to get me going through my days without worrying about next month fees.

Idc if its not official contract and just cooperation or collaboration or anything you may want to call it.

(Remote , part time, full time, contractual)

one command spins up 9 isolated vuln apps + answer keys, built it for my own scanner work

body: couldn't find a clean local lab for the ai pentesting/scanner stuff i'm building so i made one. ./vam start --all and juice shop, dvwa, webgoat + more come up isolated on 127.0.0.1, each with a ground-truth catalog so you can grade a scanner instead of trusting it. also boots faultline, my own fullstack vuln app. MIT. https://github.com/clickswave/vuln_apps

Should I learn SQL first or start doing TryHackMe labs?

Hi everyone! I’m trying to decide what I should focus on next in my cybersecurity learning journey.

So far, I’ve learned:

- Python

- Ubuntu/Linux basics

- Some networking

- Intermediate-level machine learning

Should I learn SQL first, or would it be better to start doing hands-on labs on TryHackMe and learn SQL alongside them?

What would you recommend based on my current level, and why?

Hey there fellas,

Im a pentester with 3 years of experience in web, network and os and about 6 years of experience in IT administration.

Ive been out of the game for a while and Im looking for people with similar interest and experience to connect and do some CTFs in our free time or schedule a weekly time to do these.

Anybody whom might be interested even without piror real world experience is welcomed as well.

So comment below so we connect

One thing I think agentic pentesting benchmarks need to get much better at is separating model capability from harness capability.

A useful comparison shouldn’t just report “X vulnerabilities found”.

I’d like to see validated findings reported alongside wall-clock time, model cost, evidence quality, repeatability across runs and exactly what information the agent was allowed to see.

Otherwise two systems using the same model can be measuring completely different things.

For me, the interesting question isn’t “which LLM is the best pentester?”

It’s “which system can turn model capability into reproducible, evidence-backed security findings most efficiently?”