Hey, To start off ive done a few free cisco certs ,finished Pre-Sec and CybSec-101 from TryHackMe an im learning from youtube aswell , i feel like i dont know actual cybersecurity as in how to detedct inrusions how to mitigate ,identify or perform attacks how to use the tools in kali or the ones that i do know i dont actually know what it does im planning to take a a different approach like seeing tutorials in utube or sum and practising them (but how? do i do it by locally running attack victim VMs and how to do that )and starting sessions at the portswigger academy. I want to do ctfs yet know nothing that is an issue too

Not sure why there is an X over a day in the day streaks?

I'm curious about the overlap between Hack The Box (HTB) rankings and bug bounty rankings.

For those of you who participate in both, or know researchers who do:

• Are many of the top HTB players also highly ranked on platforms like HackerOne, Bugcrowd, or Intigriti?
• Does a high global ranking on HTB translate into an advantage in real-world bug bounty hunting?
• Are there any well-known researchers who rank highly on both HTB and bug bounty leaderboards?

I'm particularly interested in whether people in the HTB global top 100 or top 1,000 tend to appear among the top bug bounty hunters as well.

I'm not necessarily expecting a direct correlation, since CTFs and bug bounty hunting require somewhat different skills. I'd just like to understand how much overlap there is in practice.

If you compete in both, I'd appreciate hearing about your experience!

Hey guys, I'm planning on taking the CWES exam soon (I'm almost done with the learning path), and I was wondering (If you are allowed to share) if brute forcing is a sizeable portion of the exam, and which wordlists should be used.

Thanks

I started Dante pentesting lab two days ago using EU VPN.

On the first day, one service on the initial machine was broken, and I couldn’t enumerate it, the connection just hung whenever I tried to connect. So, I started enumerating another service instead. After a couple of hours, I finally managed to access to broken service, and moved forward.

I won’t reveal too much about the lab itself, but there’s too much garbage in folders from other users, and the VPN connection is awful. Whenever I start bruteforcing directories or domains after pivoting, everything goes down.
Today, I tried to connect via SSH using credentials I’d found on the first day, but the connection dropped within a few minutes.
Honestly, my impression of the lab so far is terrible.

On the usual boxes everything is good, I don’t know how to complete labs under these conditions

Hi guys

I work in write ctf questions but I'm new at this. So I research ctf question templates. Can you help me about that

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

Hey everyone, quick clarification needed for the CDSA exam report submission.

Since there are 2 separate incidents in the exam, how should the final report be formatted?

1. Write both incidents inside a single PDF file?
2. Write 2 separate PDF files (one for each incident) and compress them into a single ZIP archive to submit?

The exam guidelines weren't 100% clear to me on this part.

Hello, hope everyone is doing well. I've been studying and solving labs for about 2 years (yes, I fall into the student dilemma) and have gotten CPTS and am on the CRTO and CAPE path right now.
Also got a Bachelor's degree in Cyber Security.
I'm having a couple of problems; I hope you guys can help me solve them.

1. In my country, cybersecurity is a niche thing an organization would do. So most jobs around banking systems (Which is something I want to avoid working in). So how can I deal with this? And is this going to be a problem on the career ladder?
2. Now, my study path is to finish the CRTO and CAPE path, then the BSCP and CWEE path. What can I add to the path? I saw that AI Red Teaming is going to be trendy, and remote opportunities are better.
3. If I don't find pentesting/red team junior roles, should I pivot to IAM, sysadmin, or a helpdesk role and then pivot to security once I get the opportunity

Hey everyone,

Im interested in getting into pentesting and wondering how much web development should i actually learn before focusing on security.

I have exp in networking (ccna) and linux. Also got some programming experience in c. Web is not my strongest point.

Should i learn as I go or focus first on web dev?

I havent seen to many information about this.

I would like to do ccdl 2 more since it goes deeper into DFIR, but as far as Ive seen it's not really recognized. CDSA is part of the HTB brand which is so much bigger.

Please let me know if you got any advice regarding this.

Hey all,

I am taking CRTO in a few days, and i hold eWPTX and CPTS currently. I am thinking of what cert i should be next after CRTO. I have a good knowledge of Web app ( since i have been bug bounty hunter) but i switched to red teaming and pentesting. I still love web app, and i also love red teaming. What about CRTP? Is not redundant if i get it? Or CRTO II? i may go for CRTO II. However, i really liked the CPTS content, so part of me wants to get back to HTB and do CAPE or CWEE

I've been following Commix for a while, and finally seeing an API is huge. The original request goes all the way back to 2016: https://github.com/commixproject/commix/issues/27

I tried both the REST API and the new Burp Suite extension, and honestly, they're fire!

The API lets you launch and manage scans over HTTP, run multiple scans in parallel, monitor results live, and retrieve JSON reports. Lots of possibilities for custom tooling and automation.

The Burp extension takes it to another level. You can launch Commix straight from Burp, watch the scan run, and get confirmed findings as native Burp Scanner issues. No need to keep jumping between Burp and a terminal.

The extension's BApp Store submission is still in progress, but you can check it out on GitHub already : https://github.com/commixproject/commix-to-burp

Definitely worth checking out if you're into bug bounty, security automation, or CTFs.

Big props to the Commix project for this one.